{"resultsPerPage":1018,"startIndex":0,"totalResults":1018,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-25T03:32:07.714","vulnerabilities":[{"cve":{"id":"CVE-2026-105471","sourceIdentifier":"cna@vuldb.com","published":"2026-10-06T00:16:32.920","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Impacted is an unknown function of the file signup.php of the component Registration Handler. The manipulation of the argument fname results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"girishsaraf","product":"Online-Appointment-Booking-System","cpes":["cpe:2.3:a:girishsaraf:online-appointment-booking-system:*:*:*:*:*:*:*:*"],"modules":["Registration Handler"],"versions":[{"version":"f427b4757128ca253d33d0cc4e87bbb9c999a4d5","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:11:39.707125Z","id":"CVE-2026-105471","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/girishsaraf/Online-Appointment-Booking-System/","source":"cna@vuldb.com"},{"url":"https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/9","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105471","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/984337","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413617","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413617/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105762","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T00:16:33.090","lastModified":"2026-10-06T16:08:43.180","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remote_files.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint to send requests to internal services or cloud metadata endpoints, potentially exposing sensitive data and using the server as a network pivot. This issue is fixed in version 1.13.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"langgenius","product":"dify","versions":[{"version":"< 1.13.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:17:17.209823Z","id":"CVE-2026-105762","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/langgenius/dify/commit/2f87ecc0ce1d05ab3ef9537f29b84a5fa5823017","source":"security-advisories@github.com"},{"url":"https://github.com/langgenius/dify/pull/32236","source":"security-advisories@github.com"},{"url":"https://github.com/langgenius/dify/releases/tag/1.13.0","source":"security-advisories@github.com"},{"url":"https://github.com/langgenius/dify/security/advisories/GHSA-8235-vv5j-mmvg","source":"security-advisories@github.com"},{"url":"https://github.com/langgenius/dify/security/advisories/GHSA-8235-vv5j-mmvg","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105763","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T00:16:33.247","lastModified":"2026-10-08T03:16:35.543","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Twenty is an open-source CRM (customer relationship management) platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace, including plaintext IMAP, SMTP, and CalDAV passwords, because the field was not hidden and the lookup did not enforce the calling user's identity or account visibility. A normal workspace member could obtain other members' external-service credentials and use them to access mail or calendars and potentially reset third-party accounts. Google and Microsoft OAuth-only workspaces were not affected. This issue is fixed in version 2.7.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"twentyhq","product":"twenty","versions":[{"version":">= 1.20.10, < 2.7.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T02:34:24.264686Z","id":"CVE-2026-105763","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-522"}]}],"references":[{"url":"https://github.com/twentyhq/twenty/commit/57f13c9b9230f3c4c293ea6f3d8901990e6902c4","source":"security-advisories@github.com"},{"url":"https://github.com/twentyhq/twenty/pull/20673","source":"security-advisories@github.com"},{"url":"https://github.com/twentyhq/twenty/security/advisories/GHSA-mq5c-qp77-2cv3","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105764","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T00:16:33.450","lastModified":"2026-10-06T19:17:41.723","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumbnail-generation code in server/src/repositories/media.repository.ts passed to libvips. Files that bypassed libvips' native SVG loader fell through to ImageMagick, where attacker-controlled &lt;image href&gt; values reached unrestricted MSL and VIDEO coder operations. By storing one crafted asset and referencing its path from a second delayed-marker SVG, an attacker could execute code in the immich-server container when thumbnail processing ran. This issue is fixed in version 3.2.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"immich-app","product":"immich","versions":[{"version":"< 3.2.4","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:58:59.165779Z","id":"CVE-2026-105764","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/immich-app/immich/releases/tag/v3.2.4","source":"security-advisories@github.com"},{"url":"https://github.com/immich-app/immich/security/advisories/GHSA-q89f-h332-8q2h","source":"security-advisories@github.com"},{"url":"https://github.com/immich-app/immich/security/advisories/GHSA-q89f-h332-8q2h","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105782","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T00:16:33.613","lastModified":"2026-10-06T16:00:36.547","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path as a referrer policy class, imported the referenced object, and called it. A malicious website could supply a callable such as sys.exit and terminate a crawler processing the response. This issue is fixed in version 2.14.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"scrapy","product":"scrapy","versions":[{"version":">= 1.4.0, < 2.14.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:40:40.903121Z","id":"CVE-2026-105782","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-470"}]}],"references":[{"url":"https://github.com/scrapy/scrapy/commit/945b787a263586cb5803c01c6da57daad8997ae5","source":"security-advisories@github.com"},{"url":"https://github.com/scrapy/scrapy/commit/b6e5c58ae707a3d4bb491537b5519534050047e0","source":"security-advisories@github.com"},{"url":"https://github.com/scrapy/scrapy/releases/tag/2.14.2","source":"security-advisories@github.com"},{"url":"https://github.com/scrapy/scrapy/security/advisories/GHSA-cwxj-rr6w-m6w7","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105783","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T00:16:33.770","lastModified":"2026-10-06T15:17:15.623","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: * and allows an arbitrary website to call POST /auth and GET /auth/check because the pairing endpoints do not reject HTTP or HTTPS origins. The desktop confirmation dialog does not identify the requesting origin, so a victim who approves the generic prompt authorizes the attacking page, which then receives the permanent API token. The token provides ongoing read and write access to notes, folders, tags, resources, and master keys. This issue is fixed in version 3.7.13."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"laurent22","product":"joplin","versions":[{"version":"< 3.7.13","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:35:57.854745Z","id":"CVE-2026-105783","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-346"},{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://github.com/laurent22/joplin/commit/27ae5c0d404ee47ad24862cce917dda6eb2930b7","source":"security-advisories@github.com"},{"url":"https://github.com/laurent22/joplin/pull/16276","source":"security-advisories@github.com"},{"url":"https://github.com/laurent22/joplin/releases/tag/v3.7.13","source":"security-advisories@github.com"},{"url":"https://github.com/laurent22/joplin/security/advisories/GHSA-9728-v7ww-mxjv","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105784","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T00:16:33.940","lastModified":"2026-10-06T14:17:39.953","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/nodes/TextNode.tsx and packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/nodes/FileNode.tsx to render card content with the full Markdown renderer. The components insert the resulting HTML into the main application document through dangerouslySetInnerHTML. A malicious note can inject style elements and remote CSS imports that modify trusted application chrome, signal when the note is opened, and potentially disclose exposed attribute values. Content Security Policy blocks inline script execution, so the supported impact is CSS injection and UI redressing rather than code execution. This issue is fixed in version 3.7.13."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"laurent22","product":"joplin","versions":[{"version":"< 3.7.13","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","baseScore":4.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:16:05.462685Z","id":"CVE-2026-105784","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/laurent22/joplin/commit/7fb9ec93e47cec39a548a76e03d7ad660ca0f123","source":"security-advisories@github.com"},{"url":"https://github.com/laurent22/joplin/pull/16275","source":"security-advisories@github.com"},{"url":"https://github.com/laurent22/joplin/releases/tag/v3.7.13","source":"security-advisories@github.com"},{"url":"https://github.com/laurent22/joplin/security/advisories/GHSA-6h4j-86j4-x4q4","source":"security-advisories@github.com"},{"url":"https://github.com/laurent22/joplin/security/advisories/GHSA-6h4j-86j4-x4q4","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105785","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T00:16:34.107","lastModified":"2026-10-08T03:16:35.667","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to Joplin Server 3.7.2, packages/server/src/models/TokenModel.ts stores CSRF, account-confirmation, email-change, and password-reset tokens without a purpose, and packages/server/src/models/UserModel.ts allows UserModel.resetPassword to accept any token returned by TokenModel.userFromToken. An attacker who obtains a victim's CSRF or confirmation token through a separate disclosure channel can submit it to the public password-reset endpoint, replace the victim's password, and cause the existing sessions and API applications to be deleted. This issue is fixed in Joplin Server 3.7.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"laurent22","product":"joplin","versions":[{"version":"< 3.7.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T02:35:04.011804Z","id":"CVE-2026-105785","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-620"},{"lang":"en","value":"CWE-640"}]}],"references":[{"url":"https://github.com/laurent22/joplin/commit/7766eefa11fa006b6a1971da24e0c820cf1d2118","source":"security-advisories@github.com"},{"url":"https://github.com/laurent22/joplin/pull/16274","source":"security-advisories@github.com"},{"url":"https://github.com/laurent22/joplin/security/advisories/GHSA-8qm8-mp6h-qf35","source":"security-advisories@github.com"},{"url":"https://github.com/laurent22/joplin/security/advisories/GHSA-8qm8-mp6h-qf35","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105786","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T00:16:34.283","lastModified":"2026-10-06T18:16:46.723","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/src/models/ApplicationModel.ts accepts a caller-chosen application authorization identifier, applications/:id/confirm binds that identifier to a logged-in user through a generic consent page, and the public packages/server/src/routes/api/application_auth.ts endpoint passes it to ApplicationModel.createAppPassword without authenticating or binding the redeemer. An attacker can cause a victim to approve the attacker's identifier, redeem a durable application ID and password, and exchange the credential for a victim session with full read and write access to synchronized data. This vulnerability is fixed in 3.7.13."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"laurent22","product":"joplin","versions":[{"version":"< 3.7.13","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:39:13.061805Z","id":"CVE-2026-105786","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-330"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/laurent22/joplin/commit/1a0a50afc96d4c228c736293d53de96aa23f4d00","source":"security-advisories@github.com"},{"url":"https://github.com/laurent22/joplin/pull/16270","source":"security-advisories@github.com"},{"url":"https://github.com/laurent22/joplin/releases/tag/v3.7.13","source":"security-advisories@github.com"},{"url":"https://github.com/laurent22/joplin/security/advisories/GHSA-435m-gr6q-2fg6","source":"security-advisories@github.com"},{"url":"https://github.com/laurent22/joplin/security/advisories/GHSA-435m-gr6q-2fg6","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-82988","sourceIdentifier":"cret@cert.org","published":"2026-10-06T00:16:36.973","lastModified":"2026-10-06T15:03:59.427","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unprivileged APK installation via serving a malicious APK URL through an unauthenticated download endpoint"}],"affected":[{"source":"cret@cert.org","affectedData":[{"vendor":"Viewsonic","product":"vCast","versions":[{"version":"v0.0.0","lessThanOrEqual":"v3.2.715","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:12:32.814466Z","id":"CVE-2026-82988","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-434"},{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://blog.l3afs.space/posts/Vcast-Viewsonic-RCE-chain/","source":"cret@cert.org"},{"url":"https://kb.cert.org/vuls/id/234131","source":"cret@cert.org"}]}},{"cve":{"id":"CVE-2026-82989","sourceIdentifier":"cret@cert.org","published":"2026-10-06T00:16:37.097","lastModified":"2026-10-06T15:03:59.427","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject arbitrary input into service endpoints via network-based HTTP requests to unauthenticated endpoints"}],"affected":[{"source":"cret@cert.org","affectedData":[{"vendor":"Viewsonic","product":"vCast","versions":[{"version":"v0.0.0","lessThanOrEqual":"v3.2.715","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:06:46.321838Z","id":"CVE-2026-82989","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-147"}]}],"references":[{"url":"https://blog.l3afs.space/posts/Vcast-Viewsonic-RCE-chain/","source":"cret@cert.org"},{"url":"https://kb.cert.org/vuls/id/234131","source":"cret@cert.org"}]}},{"cve":{"id":"CVE-2026-104031","sourceIdentifier":"secalert@redhat.com","published":"2026-10-06T01:16:33.843","lastModified":"2026-10-06T15:09:20.387","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request processing is not released until the client connection terminates. A local attacker can exploit this vulnerability by maintaining an open connection and repeatedly submitting valid requests, leading to memory exhaustion and a Denial of Service (DoS)."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:01:37.457324Z","id":"CVE-2026-104031","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-772"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-104031","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479418","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-104032","sourceIdentifier":"secalert@redhat.com","published":"2026-10-06T01:16:33.997","lastModified":"2026-10-06T15:09:20.387","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in SSSD. An unprivileged local user can repeatedly request master automount map updates through the autofs responder due to missing authorization checks. This triggers global cache invalidation and forces repeated lookups to backend directory providers, leading to a Denial of Service (DoS) from degraded automount availability and elevated resource consumption."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:32:38.442451Z","id":"CVE-2026-104032","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-408"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-104032","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479381","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-104033","sourceIdentifier":"secalert@redhat.com","published":"2026-10-06T01:16:34.143","lastModified":"2026-10-07T21:17:07.780","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in SSSD. When configured to enforce account expiration using LDAP (Lightweight Directory Access Protocol) shadow attributes, SSSD fails to treat an expiration value of zero as an expired account. A user with valid credentials for an expired account can exploit this flaw to bypass access controls and authenticate to the system. This allows unauthorized access to persist after the account was intended to be deactivated."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:10:17.414601Z","id":"CVE-2026-104033","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-193"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-104033","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479271","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479271","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-104034","sourceIdentifier":"secalert@redhat.com","published":"2026-10-06T01:16:34.273","lastModified":"2026-10-06T15:17:11.980","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in SSSD. A use-after-free vulnerability exists in the Kerberos Credential Manager (KCM) responder during Kerberos ticket-granting ticket (TGT) renewal, where a deferred callback accesses memory that has already been released. An authenticated local user with a renewable Kerberos ticket can trigger this issue on systems configured with KCM renewal, causing the KCM responder service to crash and resulting in a Denial of Service (DoS)."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:42:49.745426Z","id":"CVE-2026-104034","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-825"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-104034","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479178","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-104035","sourceIdentifier":"secalert@redhat.com","published":"2026-10-06T01:16:34.420","lastModified":"2026-10-08T03:16:32.840","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in SSSD. An issue in the Kerberos Credential Manager (KCM) responder allows a local user to cause a Denial of Service (DoS) by maintaining a persistent connection and repeatedly storing and destroying credentials. Because the service fails to release cached objects from memory when credentials are removed, memory consumption grows continuously, ultimately exhausting available memory and rendering the service unresponsive."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T02:38:46.500408Z","id":"CVE-2026-104035","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-772"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-104035","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479107","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-104036","sourceIdentifier":"secalert@redhat.com","published":"2026-10-06T01:16:34.567","lastModified":"2026-10-06T15:09:20.387","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in SSSD's NFS idmap plugin. When retrieving cached user or group names, the plugin detects if an entry exceeds the destination buffer size but fails to abort before copying data. A local attacker can trigger this vulnerability by requesting identity lookups that resolve to oversized cached entries, resulting in an out-of-bounds write. This flaw primarily leads to a Denial of Service (DoS) by crashing the identity mapping service, and may also corrupt adjacent process memory."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H","baseScore":5.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:01:12.207991Z","id":"CVE-2026-104036","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-104036","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479057","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-104037","sourceIdentifier":"secalert@redhat.com","published":"2026-10-06T01:16:34.707","lastModified":"2026-10-06T15:09:20.387","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read, which can crash the responder process and result in a denial of service (DoS)."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:27:40.700175Z","id":"CVE-2026-104037","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-104037","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479030","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479030","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-104038","sourceIdentifier":"secalert@redhat.com","published":"2026-10-06T01:16:34.853","lastModified":"2026-10-07T21:17:07.993","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in sssd. A remote attacker can cause a denial of service (DoS) by submitting a certificate that lacks an expected Security Identifier (SID) extension. In deployments configured with SID-based certificate mapping rules, the service fails to verify the presence of the extension before processing it, causing the process to crash during authentication or lookup operations."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:08:30.462436Z","id":"CVE-2026-104038","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-476"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-104038","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478980","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478980","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105472","sourceIdentifier":"cna@vuldb.com","published":"2026-10-06T01:16:35.017","lastModified":"2026-10-08T03:16:33.793","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. The affected element is an unknown function of the file book.php of the component Booking Handler. This manipulation of the argument Doctor/appointment causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"girishsaraf","product":"Online-Appointment-Booking-System","cpes":["cpe:2.3:a:girishsaraf:online-appointment-booking-system:*:*:*:*:*:*:*:*"],"modules":["Booking Handler"],"versions":[{"version":"f427b4757128ca253d33d0cc4e87bbb9c999a4d5","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T02:39:30.745417Z","id":"CVE-2026-105472","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/girishsaraf/Online-Appointment-Booking-System/","source":"cna@vuldb.com"},{"url":"https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/10","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105472","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/984338","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413618","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413618/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-92821","sourceIdentifier":"secalert@redhat.com","published":"2026-10-06T01:16:36.280","lastModified":"2026-10-06T15:17:20.197","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP (Lightweight Directory Access Protocol) environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote authenticated user with an expired password using an alternative authentication method, such as SSH public key authentication, can exploit this flaw to bypass access control restrictions and gain unauthorized access to protected systems."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:42:42.644397Z","id":"CVE-2026-92821","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-393"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-92821","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479031","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-104039","sourceIdentifier":"secalert@redhat.com","published":"2026-10-06T02:17:03.013","lastModified":"2026-10-08T03:16:33.053","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in SSSD. A local user can cause a denial of service (DoS) by disrupting system authentication services. When handling Generic Security Services Application Programming Interface (GSSAPI) authentication in the Pluggable Authentication Module (PAM) responder, cached connection state is freed upon completion without clearing the reference pointer. An attacker can exploit this by sending an additional request over the same connection, causing the service to access invalid memory and unexpectedly terminate."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T02:39:57.403101Z","id":"CVE-2026-104039","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-825"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-104039","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478956","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-104040","sourceIdentifier":"secalert@redhat.com","published":"2026-10-06T02:17:03.177","lastModified":"2026-10-16T21:19:16.957","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol (OData) queries. A low-privileged local user can exploit this flaw by submitting a crafted search request, altering query filters to broaden user or group searches. This can lead to information disclosure by retrieving unintended directory objects, as well as a Denial of Service (DoS) through excessive processing and cache population."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":2.5},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:00:50.356306Z","id":"CVE-2026-104040","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-140"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:fedoraproject:sssd:2.12.0:*:*:*:*:*:*:*","matchCriteriaId":"3DC51156-297F-4FE9-B867-D51191E0C9CB"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*","matchCriteriaId":"932D137F-528B-4526-9A89-CD59FA1AB0FE"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*","matchCriteriaId":"142AD0DD-4CF3-4D74-9442-459CE3347E3A"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"F4CFF558-3C47-480D-A2F0-BABF26042943"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"7F6FB57C-2BC7-487C-96DD-132683AEB35D"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*","matchCriteriaId":"D65C2163-CFC2-4ABB-8F4E-CB09CEBD006C"}]}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-104040","source":"secalert@redhat.com","tags":["Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478915","source":"secalert@redhat.com","tags":["Exploit","Issue Tracking","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-104041","sourceIdentifier":"secalert@redhat.com","published":"2026-10-06T02:17:03.327","lastModified":"2026-10-06T15:09:20.387","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in SSSD. An unprivileged local user can repeatedly request lookups for nonexistent entries through the Name Service Switch (NSS) responder. Because the negative cache does not limit the total number of stored entries and only removes expired records when an existing key is rechecked, the cache can grow without bound. This behavior can lead to memory exhaustion, resulting in a Denial of Service (DoS) as the responder becomes unresponsive or terminates."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:19:20.997446Z","id":"CVE-2026-104041","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-104041","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478864","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478864","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-104042","sourceIdentifier":"secalert@redhat.com","published":"2026-10-06T02:17:03.470","lastModified":"2026-10-07T21:17:08.223","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in sssd. A local attacker can cause a Denial of Service (DoS) by sending a crafted Pluggable Authentication Module (PAM) request containing a zero-length authentication token to the responder socket. Due to missing input validation, the service attempts to read beyond buffer boundaries when processing the token, causing the PAM responder to crash."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:06:24.816136Z","id":"CVE-2026-104042","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-104042","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478862","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478862","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-104043","sourceIdentifier":"secalert@redhat.com","published":"2026-10-06T02:17:03.607","lastModified":"2026-10-06T15:17:12.117","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in SSSD. A local attacker with access to the Name Service Switch (NSS) responder UNIX socket can trigger an integer underflow by sending a specially crafted request with an undersized packet header. This issue causes an out-of-bounds memory read during packet parsing, crashing the responder process and resulting in a Denial of Service (DoS)."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:42:32.810560Z","id":"CVE-2026-104043","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-104043","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478852","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-104044","sourceIdentifier":"secalert@redhat.com","published":"2026-10-06T02:17:03.760","lastModified":"2026-10-08T03:16:33.270","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in sssd. A local attacker can trigger a Denial of Service (DoS) by sending a specially crafted Pluggable Authentication Module (PAM) request when passkey authentication is enabled. Due to a missing state validation check in passkey Kerberos handling, the PAM responder dereferences an uninitialized pointer and crashes. This failure disrupts authentication services on the host."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T02:40:29.227025Z","id":"CVE-2026-104044","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-476"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-104044","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478664","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-104380","sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","published":"2026-10-06T02:17:03.910","lastModified":"2026-10-06T15:03:59.427","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one.\n\nOn HTTP/2 and HTTP/3 a WebSocket handshake arrives as an Extended CONNECT, which is matched as a GET and so reaches every GET route, API operation and mount. The Origin check runs only when a websocket route matches. On this transport the handler's status is the handshake response, and a 2xx accepts it.\n\nA cross-origin page can open a WebSocket to any path and learn from its open or error event whether that path returns 2xx."}],"affected":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://cpan.org/modules","packageName":"Punk","modules":["Punk"],"programFiles":["include/punk/punk_serve.h"],"programRoutines":[{"name":"ps_serve_one"}],"packageURL":"pkg:cpan/Punk","versions":[{"version":"0.48","lessThan":"0.55","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:14:06.093601Z","id":"CVE-2026-104380","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary","description":[{"lang":"en","value":"CWE-1385"}]}],"references":[{"url":"https://metacpan.org/release/LNATION/Punk-0.55/changes","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://metacpan.org/release/LNATION/Punk-0.55/diff/LNATION/Punk-0.54","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/06/1","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-105484","sourceIdentifier":"cna@vuldb.com","published":"2026-10-06T02:17:04.040","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument file_name leads to os command injection. The attack may be performed from remote."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"TOTOLINK","product":"X6000R","cpes":["cpe:2.3:o:totolink:x6000r_firmware:*:*:*:*:*:*:*:*"],"modules":["UploadFirmwareFile Handler"],"versions":[{"version":"9.4.0cu.652_B20230116","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:24:46.638835Z","id":"CVE-2026-105484","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-105484","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/984434","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413619","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413619/cti","source":"cna@vuldb.com"},{"url":"https://www.totolink.net/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105486","sourceIdentifier":"cna@vuldb.com","published":"2026-10-06T02:17:04.213","lastModified":"2026-10-06T18:16:45.653","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 8.0-d0 mitigates this issue. The patch is named bb5fde228f4ca5bd26d96368b61f6e0c21df51df. The affected component should be upgraded."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"OSSRS","product":"srs","cpes":["cpe:2.3:a:ossrs:srs:*:*:*:*:*:*:*:*"],"modules":["System API"],"versions":[{"version":"7.0-a1","status":"affected"},{"version":"8.0-d0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:06:33.851218Z","id":"CVE-2026-105486","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://github.com/ossrs/srs/","source":"cna@vuldb.com"},{"url":"https://github.com/ossrs/srs/commit/bb5fde228f4ca5bd26d96368b61f6e0c21df51df","source":"cna@vuldb.com"},{"url":"https://github.com/ossrs/srs/issues/4690","source":"cna@vuldb.com"},{"url":"https://github.com/ossrs/srs/pull/4726","source":"cna@vuldb.com"},{"url":"https://github.com/ossrs/srs/releases/tag/v8.0-d0","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105486","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/986193","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413620","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413620/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105487","sourceIdentifier":"cna@vuldb.com","published":"2026-10-06T02:17:04.403","lastModified":"2026-10-06T13:16:45.150","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomain_discovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"yogeshojha","product":"reNgine","cpes":["cpe:2.3:a:yogeshojha:rengine:*:*:*:*:*:*:*:*"],"modules":["listTargets Endpoint"],"versions":[{"version":"2.0","status":"affected"},{"version":"2.1","status":"affected"},{"version":"2.2.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:00:06.424292Z","id":"CVE-2026-105487","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/yogeshojha/rengine/","source":"cna@vuldb.com"},{"url":"https://github.com/yogeshojha/rengine/issues/1561","source":"cna@vuldb.com"},{"url":"https://github.com/yogeshojha/rengine/pull/1562","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105487","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/986584","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413623","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413623/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105571","sourceIdentifier":"cna@vuldb.com","published":"2026-10-06T02:17:04.613","lastModified":"2026-10-08T03:16:33.943","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in PickMall Lilishop up to 4.2.4. The impacted element is an unknown function of the file /buyer/passport/member/bindMobile of the component Mobile Binding. This manipulation of the argument Username causes improper authorization. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"PickMall Lilishop","cpes":["cpe:2.3:a:pickmall_lilishop:pickmall_lilishop:*:*:*:*:*:*:*:*"],"modules":["Mobile Binding"],"versions":[{"version":"4.2.0","status":"affected"},{"version":"4.2.1","status":"affected"},{"version":"4.2.2","status":"affected"},{"version":"4.2.3","status":"affected"},{"version":"4.2.4","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T02:41:11.730038Z","id":"CVE-2026-105571","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://github.com/lilishop/lilishop/issues/148","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105571","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/989282","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413630","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413630/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105572","sourceIdentifier":"cna@vuldb.com","published":"2026-10-06T03:17:00.827","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in PickMall Lilishop up to 4.2.4. This affects an unknown function of the file /buyer/trade/receipt of the component Buyer Invoice List. Such manipulation of the argument memberId leads to authorization bypass. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"PickMall Lilishop","cpes":["cpe:2.3:a:pickmall_lilishop:pickmall_lilishop:*:*:*:*:*:*:*:*"],"modules":["Buyer Invoice List"],"versions":[{"version":"4.2.0","status":"affected"},{"version":"4.2.1","status":"affected"},{"version":"4.2.2","status":"affected"},{"version":"4.2.3","status":"affected"},{"version":"4.2.4","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:18:41.374453Z","id":"CVE-2026-105572","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"},{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/lilishop/lilishop/issues/149","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105572","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/989312","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413631","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413631/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105573","sourceIdentifier":"cna@vuldb.com","published":"2026-10-06T03:17:01.033","lastModified":"2026-10-06T18:16:45.803","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in newbee-ltd newbee-mall up to 2.7.5. This impacts an unknown function of the file /jshERP-boot/accountHead/updateAccountHeadAndDetail of the component Shopping Cart Quantity Handler. Performing a manipulation of the argument goodsCount results in business logic errors. The attack can be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"newbee-ltd","product":"newbee-mall","cpes":["cpe:2.3:a:newbee-ltd:newbee-mall:*:*:*:*:*:*:*:*"],"modules":["Shopping Cart Quantity Handler"],"versions":[{"version":"2.7.0","status":"affected"},{"version":"2.7.1","status":"affected"},{"version":"2.7.2","status":"affected"},{"version":"2.7.3","status":"affected"},{"version":"2.7.4","status":"affected"},{"version":"2.7.5","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:05:52.110937Z","id":"CVE-2026-105573","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-840"}]}],"references":[{"url":"https://github.com/newbee-ltd/newbee-mall/","source":"cna@vuldb.com"},{"url":"https://github.com/newbee-ltd/newbee-mall/issues/127","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105573","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/989313","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413632","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413632/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105610","sourceIdentifier":"cna@vuldb.com","published":"2026-10-06T03:17:01.237","lastModified":"2026-10-06T13:16:45.657","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in chillzhuang SpringBlade up to 5.0.1. The impacted element is an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/ParamController.java of the component Parameter Submit Management. The manipulation of the argument initPassword results in improper authorization. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"chillzhuang","product":"SpringBlade","cpes":["cpe:2.3:a:chillzhuang:springblade:*:*:*:*:*:*:*:*"],"modules":["Parameter Submit Management"],"versions":[{"version":"5.0.0","status":"affected"},{"version":"5.0.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:M/C:P/I:P/A:P","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"MULTIPLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":6.4,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T12:59:04.311133Z","id":"CVE-2026-105610","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://github.com/chillzhuang/SpringBlade/","source":"cna@vuldb.com"},{"url":"https://github.com/chillzhuang/SpringBlade/issues/41","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105610","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/989315","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413641","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413641/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105611","sourceIdentifier":"cna@vuldb.com","published":"2026-10-06T04:17:58.950","lastModified":"2026-10-08T03:16:34.090","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. This affects an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/RoleController.java of the component User Detail Endpoint. This manipulation of the argument ID causes improper authorization. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"chillzhuang","product":"SpringBlade","cpes":["cpe:2.3:a:chillzhuang:springblade:*:*:*:*:*:*:*:*"],"modules":["User Detail Endpoint"],"versions":[{"version":"5.0.0","status":"affected"},{"version":"5.0.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:M/C:P/I:N/A:N","baseScore":3.3,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"MULTIPLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":6.4,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T02:41:59.883059Z","id":"CVE-2026-105611","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://github.com/chillzhuang/SpringBlade/","source":"cna@vuldb.com"},{"url":"https://github.com/chillzhuang/SpringBlade/issues/42","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105611","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/989316","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413642","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413642/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105621","sourceIdentifier":"cna@vuldb.com","published":"2026-10-06T04:18:05.360","lastModified":"2026-10-06T14:17:37.943","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in jishenghua jshERP up to 3.5. Affected is the function updateAccountHeadAndDetail of the file jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java of the component Financial Receipt Update Handler. Performing a manipulation results in improper authorization. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"jishenghua","product":"jshERP","cpes":["cpe:2.3:a:jishenghua:jsherp:*:*:*:*:*:*:*:*"],"modules":["Financial Receipt Update Handler"],"versions":[{"version":"3.0","status":"affected"},{"version":"3.1","status":"affected"},{"version":"3.2","status":"affected"},{"version":"3.3","status":"affected"},{"version":"3.4","status":"affected"},{"version":"3.5","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:P","baseScore":5.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:15:00.738586Z","id":"CVE-2026-105621","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://github.com/jishenghua/jshERP/","source":"cna@vuldb.com"},{"url":"https://github.com/jishenghua/jshERP/issues/167","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105621","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/989317","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413644","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413644/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105703","sourceIdentifier":"cna@vuldb.com","published":"2026-10-06T04:18:05.587","lastModified":"2026-10-06T18:16:45.953","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3. The impacted element is an unknown function of the file loginsystem/admin/change-password.php of the component Change Password Handler. This manipulation of the argument currentpassword causes incorrect authorization. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"PHPGurukul","product":"User Registration & Login and User Management System","cpes":["cpe:2.3:a:phpgurukul:user_registration_login_and_user_management_system:*:*:*:*:*:*:*:*"],"modules":["Change Password Handler"],"versions":[{"version":"3.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:M/C:P/I:P/A:P","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"MULTIPLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":6.4,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:05:53.515706Z","id":"CVE-2026-105703","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/CyberShailendra1/phpgurukul-change-password-broken-auth","source":"cna@vuldb.com"},{"url":"https://phpgurukul.com/","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105703","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/992049","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413696","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413696/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105704","sourceIdentifier":"cna@vuldb.com","published":"2026-10-06T05:16:37.663","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the component Auth Guard. Such manipulation of the argument user_id leads to improper authentication. The attack can be executed remotely. The exploit is publicly available and might be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Drug Recommendation System","cpes":["cpe:2.3:a:sourcecodester:drug_recommendation_system:*:*:*:*:*:*:*:*"],"modules":["Auth Guard"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T12:52:39.154867Z","id":"CVE-2026-105704","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://github.com/hackliu/Vulnerability-Reports/blob/master/Drug-Recommender-Web-App/VULN-02-Broken-Access-Control.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105704","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/992051","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413697","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413697/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105705","sourceIdentifier":"cna@vuldb.com","published":"2026-10-06T05:16:37.847","lastModified":"2026-10-08T03:16:34.810","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. This impacts an unknown function of the file Admin/add_drug.php. Performing a manipulation results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Drug Recommendation System","cpes":["cpe:2.3:a:sourcecodester:drug_recommendation_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T02:42:56.458482Z","id":"CVE-2026-105705","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/hackliu/Vulnerability-Reports/blob/master/Drug-Recommender-Web-App/VULN-05-XSS-Reflected-Stored.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105705","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/992054","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413698","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413698/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105706","sourceIdentifier":"cna@vuldb.com","published":"2026-10-06T05:16:38.010","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected is an unknown function. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Drug Recommendation System","cpes":["cpe:2.3:a:sourcecodester:drug_recommendation_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:01:05.505576Z","id":"CVE-2026-105706","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/hackliu/Vulnerability-Reports/blob/master/Drug-Recommender-Web-App/VULN-06-CSRF-Missing-Tokens.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105706","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/992055","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413699","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413699/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105707","sourceIdentifier":"cna@vuldb.com","published":"2026-10-06T05:16:38.177","lastModified":"2026-10-06T18:16:46.097","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in uptrace up to 2.1.0-beta.8. Affected by this vulnerability is the function Login of the file pkg/org/user_handler.go. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"uptrace","cpes":["cpe:2.3:a:uptrace:uptrace:*:*:*:*:*:*:*:*"],"versions":[{"version":"2.1.0-beta.0","status":"affected"},{"version":"2.1.0-beta.1","status":"affected"},{"version":"2.1.0-beta.2","status":"affected"},{"version":"2.1.0-beta.3","status":"affected"},{"version":"2.1.0-beta.4","status":"affected"},{"version":"2.1.0-beta.5","status":"affected"},{"version":"2.1.0-beta.6","status":"affected"},{"version":"2.1.0-beta.7","status":"affected"},{"version":"2.1.0-beta.8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:06:35.338597Z","id":"CVE-2026-105707","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-209"}]}],"references":[{"url":"https://github.com/uptrace/uptrace/","source":"cna@vuldb.com"},{"url":"https://github.com/uptrace/uptrace/issues/600","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105707","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/992057","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413700","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413700/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105072","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T06:16:59.313","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WP Manage Ninja","product":"FluentBooking Pro","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"fluent-booking-pro","versions":[{"version":"n/a","lessThan":"2.5.0","versionType":"custom","status":"affected","changes":[{"at":"2.5.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:22:38.405435Z","id":"CVE-2026-105072","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/fluent-booking-pro/vulnerability/wordpress-fluentbooking-pro-plugin-2-5-0-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-105708","sourceIdentifier":"cna@vuldb.com","published":"2026-10-06T06:17:00.030","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in imgproxy up to 4.0.17. Affected by this vulnerability is the function sanitizeElement of the file processing/svg/svg.go of the component SVG Handler. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"imgproxy","cpes":["cpe:2.3:a:imgproxy:imgproxy:*:*:*:*:*:*:*:*"],"modules":["SVG Handler"],"versions":[{"version":"4.0.0","status":"affected"},{"version":"4.0.1","status":"affected"},{"version":"4.0.2","status":"affected"},{"version":"4.0.3","status":"affected"},{"version":"4.0.4","status":"affected"},{"version":"4.0.5","status":"affected"},{"version":"4.0.6","status":"affected"},{"version":"4.0.7","status":"affected"},{"version":"4.0.8","status":"affected"},{"version":"4.0.9","status":"affected"},{"version":"4.0.10","status":"affected"},{"version":"4.0.11","status":"affected"},{"version":"4.0.12","status":"affected"},{"version":"4.0.13","status":"affected"},{"version":"4.0.14","status":"affected"},{"version":"4.0.15","status":"affected"},{"version":"4.0.16","status":"affected"},{"version":"4.0.17","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T12:55:06.422301Z","id":"CVE-2026-105708","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/imgproxy/imgproxy/","source":"cna@vuldb.com"},{"url":"https://github.com/imgproxy/imgproxy/issues/1708","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105708","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/992216","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413711","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413711/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105775","sourceIdentifier":"cna@vuldb.com","published":"2026-10-06T06:17:00.280","lastModified":"2026-10-09T02:16:54.693","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in vllm-project vLLM up to 0.31.0. This impacts the function conv_ssm_forward of the file vllm/model_executor/layers/mamba/mamba_mixer2.py of the component Completions Request Handler. The manipulation leads to out-of-bounds read. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"vllm-project","product":"vLLM","cpes":["cpe:2.3:a:vllm-project:vllm:*:*:*:*:*:*:*:*"],"modules":["Completions Request Handler"],"versions":[{"version":"0.1","status":"affected"},{"version":"0.2","status":"affected"},{"version":"0.3","status":"affected"},{"version":"0.4","status":"affected"},{"version":"0.5","status":"affected"},{"version":"0.6","status":"affected"},{"version":"0.7","status":"affected"},{"version":"0.8","status":"affected"},{"version":"0.9","status":"affected"},{"version":"0.10","status":"affected"},{"version":"0.11","status":"affected"},{"version":"0.12","status":"affected"},{"version":"0.13","status":"affected"},{"version":"0.14","status":"affected"},{"version":"0.15","status":"affected"},{"version":"0.16","status":"affected"},{"version":"0.17","status":"affected"},{"version":"0.18","status":"affected"},{"version":"0.19","status":"affected"},{"version":"0.20","status":"affected"},{"version":"0.21","status":"affected"},{"version":"0.22","status":"affected"},{"version":"0.23","status":"affected"},{"version":"0.24","status":"affected"},{"version":"0.25","status":"affected"},{"version":"0.26","status":"affected"},{"version":"0.27","status":"affected"},{"version":"0.28","status":"affected"},{"version":"0.29","status":"affected"},{"version":"0.30","status":"affected"},{"version":"0.31.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:N/A:P","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T00:56:24.861003Z","id":"CVE-2026-105775","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-119"},{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/vllm-project/vllm/","source":"cna@vuldb.com"},{"url":"https://github.com/vllm-project/vllm/issues/57266","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105775","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/992291","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413808","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413808/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-32576","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T06:17:00.500","lastModified":"2026-10-06T16:17:07.373","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Authorization Bypass Through User-Controlled Key vulnerability in ZWEISCHNEIDER Faktur Pro for WooCommerce woorechnung allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Faktur Pro for WooCommerce: from n/a through 3.2.2."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ZWEISCHNEIDER","product":"Faktur Pro for WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"woorechnung","versions":[{"version":"0","lessThanOrEqual":"3.2.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:22:04.232587Z","id":"CVE-2026-32576","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/woorechnung/vulnerability/wordpress-faktur-pro-for-woocommerce-plugin-3-2-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-32582","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T06:17:00.660","lastModified":"2026-10-08T19:17:03.290","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in iatoai IATO MCP iato-mcp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IATO MCP: from n/a through 1.12.0."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"iatoai","product":"IATO MCP","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"iato-mcp","versions":[{"version":"0","lessThanOrEqual":"1.12.0","versionType":"custom","status":"affected","changes":[{"at":"1.12.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:21:37.592354Z","id":"CVE-2026-32582","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/iato-mcp/vulnerability/wordpress-iato-mcp-plugin-1-11-0-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39599","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T06:17:00.803","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"wallstrdev","product":"WDS MCP Content Manager","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wds-mcp-content-manager","versions":[{"version":"n/a","lessThanOrEqual":"3.10.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:21:33.197203Z","id":"CVE-2026-39599","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wds-mcp-content-manager/vulnerability/wordpress-wds-mcp-content-manager-plugin-3-10-4-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39723","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T06:17:00.947","lastModified":"2026-10-08T17:17:16.760","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Green Invoice Morning for WooCommerce wc-gateway-greeninvoice allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Morning for WooCommerce: from n/a through 2.4.1."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Green Invoice","product":"Morning for WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wc-gateway-greeninvoice","versions":[{"version":"0","lessThanOrEqual":"2.4.1","versionType":"custom","status":"affected","changes":[{"at":"2.4.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:16:19.420133Z","id":"CVE-2026-39723","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wc-gateway-greeninvoice/vulnerability/wordpress-morning-for-woocommerce-plugin-2-4-1-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39760","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T06:17:01.087","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Creative interactive media","product":"Real 3D FlipBook","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"real3d-flipbook-lite","versions":[{"version":"n/a","lessThanOrEqual":"5.5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:16:12.949264Z","id":"CVE-2026-39760","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/real3d-flipbook-lite/vulnerability/wordpress-real-3d-flipbook-plugin-5-5-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39789","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T06:17:01.227","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Broken Access Control in Fluent Affiliate Pro <= 1.6.4 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WP Manage Ninja","product":"Fluent Affiliate Pro","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"fluent-affiliate-pro","versions":[{"version":"n/a","lessThanOrEqual":"1.6.4","versionType":"custom","status":"affected","changes":[{"at":"1.6.5","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:16:04.540410Z","id":"CVE-2026-39789","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/fluent-affiliate-pro/vulnerability/wordpress-fluent-affiliate-pro-plugin-1-6-4-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-41558","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T06:17:01.370","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Bypass Vulnerability in WP Migration Plugin DB & Files – WP Synchro <= 1.16.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WP Synchro","product":"WP Migration Plugin DB & Files – WP Synchro","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wpsynchro","versions":[{"version":"n/a","lessThanOrEqual":"1.16.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:15:36.041810Z","id":"CVE-2026-41558","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-290"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wpsynchro/vulnerability/wordpress-wp-migration-plugin-db-files-wp-synchro-plugin-1-16-1-2fa-bypass-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-41563","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T06:17:01.530","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Sensitive Data Exposure in Sitemovr <= 1.0.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Dawer Drew","product":"Sitemovr","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"sitemovr","versions":[{"version":"n/a","lessThanOrEqual":"1.0.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:15:30.600639Z","id":"CVE-2026-41563","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-201"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/sitemovr/vulnerability/wordpress-sitemovr-plugin-1-0-1-sensitive-data-exposure-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-75962","sourceIdentifier":"security@wordfence.com","published":"2026-10-06T06:17:01.687","lastModified":"2026-10-09T02:17:04.463","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable without authentication on WordPress Multisite installations with public registration enabled, as WordPress accepts email addresses containing numeric HTML character references that Post SMTP's stricter validator rejects, persisting the attacker-controlled address verbatim to the email log via the failed-send exception message."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"saadiqbal","product":"Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.0.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T00:55:40.324173Z","id":"CVE-2026-75962","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/post-smtp/tags/3.9.5/Postman/Postman-Email-Log/PostmanEmailLogService.php#L215","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/post-smtp/tags/3.9.5/Postman/Postman-Mail/PostmanEmailAddress.php#L63","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/post-smtp/tags/3.9.5/Postman/PostmanEmailLogs.php#L538","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/post-smtp/tags/3.9.5/Postman/PostmanWpMail.php#L374","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/post-smtp/tags/3.9.5/script/postman-email-logs.js#L711","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3711068/post-smtp/trunk/Postman/Postman-Email-Log/PostmanEmailLogService.php","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&new=3711079%40post-smtp%2Ftags%2F4.0.2&old=3664536%40post-smtp%2Ftags%2F4.0.1","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/accac3da-0318-4e79-a163-ed9ff2af692b?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-97300","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T06:17:02.110","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Arraytics","product":"WP Event Solution","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-event-solution","versions":[{"version":"n/a","lessThanOrEqual":"4.1.25","versionType":"custom","status":"affected","changes":[{"at":"4.1.26","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:15:17.158809Z","id":"CVE-2026-97300","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-799"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-event-solution/vulnerability/wordpress-wp-event-solution-plugin-4-1-25-broken-access-control-vulnerability-2?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-105701","sourceIdentifier":"security@wordfence.com","published":"2026-10-06T07:16:56.207","lastModified":"2026-10-06T17:17:18.690","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. The exploit requires the attacker to first create a form with malicious email_settings via the REST API endpoint, then trigger form submission to execute the injected Twig expressions."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"Mauro Cassani","product":"ACPT (Premium)","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.0.66","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T16:06:24.914450Z","id":"CVE-2026-105701","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://acpt.io/changelog/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cd544ed-493e-4d4a-9eb8-ea83c47f3857?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-105776","sourceIdentifier":"cna@vuldb.com","published":"2026-10-06T07:16:56.357","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL up to ae783195ba7e0390d3b3bfaddd99944b7e9735a4. Affected by this vulnerability is an unknown functionality of the file /admin_transaction.php. This manipulation of the argument Username causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"bhagya3929","product":"Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL","cpes":["cpe:2.3:a:bhagya3929:employee-movement-tracking-and-monitoring-website-for-iocl:*:*:*:*:*:*:*:*"],"versions":[{"version":"ae783195ba7e0390d3b3bfaddd99944b7e9735a4","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T12:59:07.877380Z","id":"CVE-2026-105776","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/bhagya3929/Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL/","source":"cna@vuldb.com"},{"url":"https://github.com/bhagya3929/Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL/issues/1","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105776","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/992496","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413810","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413810/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105778","sourceIdentifier":"cna@vuldb.com","published":"2026-10-06T07:16:56.547","lastModified":"2026-10-06T18:16:46.563","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in Tenda AC5 02.03.01.111_multi. Affected by this issue is some unknown functionality of the file /goform/setWifi of the component Wifi Handler. Such manipulation of the argument wifiPwd leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Tenda","product":"AC5","cpes":["cpe:2.3:o:tenda:ac5_firmware:*:*:*:*:*:*:*:*"],"modules":["Wifi Handler"],"versions":[{"version":"02.03.01.111_multi","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:07:05.050647Z","id":"CVE-2026-105778","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-119"},{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://github.com/raisecnull/Tenda-AC5v3-BOF/blob/main/blog.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105778","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/992587","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413811","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413811/cti","source":"cna@vuldb.com"},{"url":"https://www.tenda.com.cn/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-25263","sourceIdentifier":"product-security@qualcomm.com","published":"2026-10-06T07:16:56.747","lastModified":"2026-10-09T14:10:14.323","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters."}],"affected":[{"source":"product-security@qualcomm.com","affectedData":[{"vendor":"Qualcomm, Inc.","product":"Snapdragon","defaultStatus":"unaffected","platforms":["Snapdragon Auto","Snapdragon CCW","Snapdragon Compute","Snapdragon Consumer IOT","Snapdragon Industrial IOT","Snapdragon Mobile","Snapdragon WBC","Snapdragon Wearables"],"versions":[{"version":"315 5G IoT Modem","status":"affected"},{"version":"5G Fixed Wireless Access Platform","status":"affected"},{"version":"Cologne","status":"affected"},{"version":"CQ7790","status":"affected"},{"version":"CQ8725S","status":"affected"},{"version":"CQ8750M","status":"affected"},{"version":"CSRB31024","status":"affected"},{"version":"C-V2X 9150","status":"affected"},{"version":"FastConnect 6200","status":"affected"},{"version":"FastConnect 6700","status":"affected"},{"version":"FastConnect 6800","status":"affected"},{"version":"FastConnect 6900","status":"affected"},{"version":"FastConnect 7800","status":"affected"},{"version":"G1 Gen 1","status":"affected"},{"version":"IQ10 Series","status":"affected"},{"version":"IQ6 Series Platform","status":"affected"},{"version":"IQ8 Series Platform","status":"affected"},{"version":"IQ9 Series Platform","status":"affected"},{"version":"Kalpeni","status":"affected"},{"version":"LeMans_AU_LGIT","status":"affected"},{"version":"LeMansAU","status":"affected"},{"version":"MBM415","status":"affected"},{"version":"MBM715","status":"affected"},{"version":"Milos","status":"affected"},{"version":"Monaco_IOT","status":"affected"},{"version":"Orne","status":"affected"},{"version":"Palawan25","status":"affected"},{"version":"Pandeiro","status":"affected"},{"version":"Q-4390","status":"affected"},{"version":"QAM8255P","status":"affected"},{"version":"QAM8295P","status":"affected"},{"version":"QAM8620P","status":"affected"},{"version":"QAMSRV1H","status":"affected"},{"version":"QAMSRV1M","status":"affected"},{"version":"QCA6310","status":"affected"},{"version":"QCA6335","status":"affected"},{"version":"QCA6391","status":"affected"},{"version":"QCA6426","status":"affected"},{"version":"QCA6436","status":"affected"},{"version":"QCA6564AU","status":"affected"},{"version":"QCA6574","status":"affected"},{"version":"QCA6574A","status":"affected"},{"version":"QCA6574AU","status":"affected"},{"version":"QCA6595","status":"affected"},{"version":"QCA6595AU","status":"affected"},{"version":"QCA6678AQ","status":"affected"},{"version":"QCA6688AQ","status":"affected"},{"version":"QCA6696","status":"affected"},{"version":"QCA6698AQ","status":"affected"},{"version":"QCA6698AU","status":"affected"},{"version":"QCA6797AQ","status":"affected"},{"version":"QCA8695AU","status":"affected"},{"version":"QCM2290","status":"affected"},{"version":"QCM4290","status":"affected"},{"version":"QCM4325","status":"affected"},{"version":"QCM5430","status":"affected"},{"version":"QCM6490","status":"affected"},{"version":"QCM8550","status":"affected"},{"version":"QCM8838","status":"affected"},{"version":"QCN9011","status":"affected"},{"version":"QCN9012","status":"affected"},{"version":"QCN9274","status":"affected"},{"version":"QCS2290","status":"affected"},{"version":"QCS410","status":"affected"},{"version":"QCS4290","status":"affected"},{"version":"QCS8550","status":"affected"},{"version":"QMP1000","status":"affected"},{"version":"QRB5165N","status":"affected"},{"version":"Qualcomm 215 Mobile Platform","status":"affected"},{"version":"Qualcomm Dragonwing Q-6690","status":"affected"},{"version":"Qualcomm Dragonwing Q-7790","status":"affected"},{"version":"Qualcomm Dragonwing QCM4490","status":"affected"},{"version":"Qualcomm Dragonwing QRB5165","status":"affected"},{"version":"Qualcomm Video Collaboration VC1 Platform","status":"affected"},{"version":"Qualcomm Video Collaboration VC3 Platform","status":"affected"},{"version":"Qualcomm Video Collaboration VC5 Platform","status":"affected"},{"version":"Robotics RB3 Platform","status":"affected"},{"version":"Robotics RB5 Platform","status":"affected"},{"version":"SA2150P","status":"affected"},{"version":"SA4150P","status":"affected"},{"version":"SA4155P","status":"affected"},{"version":"SA6145P","status":"affected"},{"version":"SA6150P","status":"affected"},{"version":"SA6155","status":"affected"},{"version":"SA6155P","status":"affected"},{"version":"SA7255P","status":"affected"},{"version":"SA7775P","status":"affected"},{"version":"SA8145P","status":"affected"},{"version":"SA8150P","status":"affected"},{"version":"SA8155","status":"affected"},{"version":"SA8155P","status":"affected"},{"version":"SA8195P","status":"affected"},{"version":"SA8255P","status":"affected"},{"version":"SA8295P","status":"affected"},{"version":"SA8620P","status":"affected"},{"version":"SA8770P","status":"affected"},{"version":"SA9000P","status":"affected"},{"version":"SAR1165P","status":"affected"},{"version":"SAR2130P","status":"affected"},{"version":"SC8380XP","status":"affected"},{"version":"SD 8 Gen1 5G","status":"affected"},{"version":"SD662","status":"affected"},{"version":"SD865 5G","status":"affected"},{"version":"SD888","status":"affected"},{"version":"SDA660","status":"affected"},{"version":"SDM429W","status":"affected"},{"version":"SDR753","status":"affected"},{"version":"SM6225P","status":"affected"},{"version":"SM6370","status":"affected"},{"version":"SM6650P","status":"affected"},{"version":"SM7250P","status":"affected"},{"version":"SM7315","status":"affected"},{"version":"SM7325P","status":"affected"},{"version":"SM7635P","status":"affected"},{"version":"SM7675","status":"affected"},{"version":"SM7675P","status":"affected"},{"version":"SM8550P","status":"affected"},{"version":"SM8635","status":"affected"},{"version":"SM8635P","status":"affected"},{"version":"SM8650Q","status":"affected"},{"version":"SM8750P","status":"affected"},{"version":"Snapdragon 4 Gen 1 Mobile Platform","status":"affected"},{"version":"Snapdragon 4 Gen 2 Mobile Platform","status":"affected"},{"version":"Snapdragon 429 Mobile Platform","status":"affected"},{"version":"Snapdragon 460 Mobile Platform","status":"affected"},{"version":"Snapdragon 480 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 480+ 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 6 Gen 4 Mobile Platform","status":"affected"},{"version":"Snapdragon 660 Mobile Platform","status":"affected"},{"version":"Snapdragon 662 Mobile Platform","status":"affected"},{"version":"Snapdragon 680 4G Mobile Platform","status":"affected"},{"version":"Snapdragon 685 4G Mobile Platform","status":"affected"},{"version":"Snapdragon 690 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 695 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 7 Gen 4 Mobile Platform","status":"affected"},{"version":"Snapdragon 720G Mobile Platform","status":"affected"},{"version":"Snapdragon 750G 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 765 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 765G 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 768G 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 778G 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 778G+ 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 780G 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 782G Mobile Platform","status":"affected"},{"version":"Snapdragon 7c+ Gen 3 Compute","status":"affected"},{"version":"Snapdragon 7s Gen 3 Mobile Platform","status":"affected"},{"version":"Snapdragon 8 Elite","status":"affected"},{"version":"Snapdragon 8 Gen 1 Mobile Platform","status":"affected"},{"version":"Snapdragon 8 Gen 2 Mobile Platform","status":"affected"},{"version":"Snapdragon 8 Gen 3 Mobile Platform","status":"affected"},{"version":"Snapdragon 8+ Gen 1 Mobile Platform","status":"affected"},{"version":"Snapdragon 8+ Gen 2 Mobile Platform","status":"affected"},{"version":"Snapdragon 845 Mobile Platform","status":"affected"},{"version":"Snapdragon 865 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 865+ 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 870 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 888 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 888+ 5G Mobile Platform","status":"affected"},{"version":"Snapdragon AR1 Gen 1 Platform","status":"affected"},{"version":"Snapdragon AR1+ Gen 1 Platform","status":"affected"},{"version":"Snapdragon Auto 5G Modem-RF","status":"affected"},{"version":"Snapdragon Ride Elite","status":"affected"},{"version":"Snapdragon W5+ Gen 1 Wearable Platform","status":"affected"},{"version":"Snapdragon X53 5G Modem-RF System","status":"affected"},{"version":"Snapdragon X55 5G Modem-RF System","status":"affected"},{"version":"Snapdragon XR2 5G Platform","status":"affected"},{"version":"Snapdragon XR2+ Gen 1 Platform","status":"affected"},{"version":"Snapdragon Auto 4G Modem","status":"affected"},{"version":"Snapdragon Cockpit Elite","status":"affected"},{"version":"Snapdragon Reality Elite Platform","status":"affected"},{"version":"Snapdragon Wear Elite platform","status":"affected"},{"version":"SRV1H","status":"affected"},{"version":"SRV1L","status":"affected"},{"version":"SRV1M","status":"affected"},{"version":"SSG2115P","status":"affected"},{"version":"SSG2125P","status":"affected"},{"version":"SW5100","status":"affected"},{"version":"SW5100P","status":"affected"},{"version":"SW-only","status":"affected"},{"version":"SXR1230P","status":"affected"},{"version":"SXR2130","status":"affected"},{"version":"SXR2230P","status":"affected"},{"version":"SXR2250P","status":"affected"},{"version":"TalynPlus","status":"affected"},{"version":"Themisto","status":"affected"},{"version":"Vision Intelligence 300 Platform","status":"affected"},{"version":"Vision Intelligence 400 Platform","status":"affected"},{"version":"WCD9326","status":"affected"},{"version":"WCD9335","status":"affected"},{"version":"WCD9340","status":"affected"},{"version":"WCD9341","status":"affected"},{"version":"WCD9360","status":"affected"},{"version":"WCD9370","status":"affected"},{"version":"WCD9375","status":"affected"},{"version":"WCD9378","status":"affected"},{"version":"WCD9380","status":"affected"},{"version":"WCD9385","status":"affected"},{"version":"WCD9390","status":"affected"},{"version":"WCD9395","status":"affected"},{"version":"WCN3615","status":"affected"},{"version":"WCN3620","status":"affected"},{"version":"WCN3660B","status":"affected"},{"version":"WCN3680B","status":"affected"},{"version":"WCN3910","status":"affected"},{"version":"WCN3950","status":"affected"},{"version":"WCN3980","status":"affected"},{"version":"WCN3988","status":"affected"},{"version":"WCN3990","status":"affected"},{"version":"WCN6450","status":"affected"},{"version":"WCN6650","status":"affected"},{"version":"WCN6740","status":"affected"},{"version":"WCN6755","status":"affected"},{"version":"WCN7860","status":"affected"},{"version":"WCN7861","status":"affected"},{"version":"WCN7880","status":"affected"},{"version":"WCN7881","status":"affected"},{"version":"WSA8810","status":"affected"},{"version":"WSA8815","status":"affected"},{"version":"WSA8830","status":"affected"},{"version":"WSA8832","status":"affected"},{"version":"WSA8835","status":"affected"},{"version":"WSA8840","status":"affected"},{"version":"WSA8845","status":"affected"},{"version":"WSA8845H","status":"affected"},{"version":"X1E80100","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"product-security@qualcomm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L","baseScore":6.6,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":0.8,"impactScore":5.3}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T12:58:06.828429Z","id":"CVE-2026-25263","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"product-security@qualcomm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_g1_gen_2_gaming_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"905C9267-C1B5-4A77-BC33-118986A907C7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_g1_gen_2_gaming_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"671C9107-7E54-4FBC-B03D-1EB4DCD8597E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:5g_fixed_wireless_access_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C9D9ABF8-3D6C-415B-B6F9-9A430D08E335"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:5g_fixed_wireless_access_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"CF1134A5-796D-476B-A0E6-4BDD7A96A109"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:9205_lte_modem_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"920F873B-F52D-4754-9726-BECCAD0CAC45"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:9205_lte_modem:-:*:*:*:*:*:*:*","matchCriteriaId":"5EB573E2-C2B9-4B12-9EEF-9152FBFE3927"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:9205s_modem_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D43C389A-8330-4747-8371-6E184236B134"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:9205s_modem:-:*:*:*:*:*:*:*","matchCriteriaId":"648ED714-9CF1-44D2-8360-D40708EA2ABB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:aqt1000_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EC6FCE91-BF38-49ED-8FFB-429BAFEE7832"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:aqt1000:-:*:*:*:*:*:*:*","matchCriteriaId":"715A9F94-5F9E-45E5-B07B-699410C01478"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8c_compute_platform_\\(sc8180xp-ad\\)_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E81ADBDE-BC6C-4FA2-B33F-553A8E42BB9F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8c_compute_platform_\\(sc8180xp-ad\\):-:*:*:*:*:*:*:*","matchCriteriaId":"F7A79274-E042-47F0-82C1-F3FFEF0BC058"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8cx_compute_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"36903AF3-4E2D-4990-B021-A1D980229077"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8cx_compute_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"472928D4-90F4-402D-B1F2-0CE358326A10"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8cx_compute_platform_\\\"poipu_pro\\\"_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C0D26DE7-964B-4B01-90E1-1D1E87522940"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8cx_compute_platform_\\\"poipu_pro\\\":-:*:*:*:*:*:*:*","matchCriteriaId":"651EE0A5-D583-4D99-89B0-A81A51EAF46B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8cx_gen_2_5g_compute_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C7ACDB5B-A32C-43A1-9086-D081E9FFF9AA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8cx_gen_2_5g_compute_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"583E50CC-2017-4092-A21E-7AAC53F53A25"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8cx_gen_2_5g_compute_platform_\\\"poipu_pro\\\"_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"969BA39F-1068-49F3-8EF2-A5F64C5A57DA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8cx_gen_2_5g_compute_platform_\\\"poipu_pro\\\":-:*:*:*:*:*:*:*","matchCriteriaId":"A7A57DE6-615E-45C5-9CCD-2A12905EC368"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_auto_5g_modem-rf_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"88AF39A5-F44E-4B14-AA6E-4F80D9EEB017"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_auto_5g_modem-rf:-:*:*:*:*:*:*:*","matchCriteriaId":"2A25FE8F-555A-4D85-8A94-A808B62EAE86"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_wear_1300_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5A402233-B76F-41D5-B7C2-325C8FC4D560"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_wear_1300_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"C8643194-C881-408A-AAA1-78572075120A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_x53_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4F80E77B-B207-4E49-99EF-A1F9ECFAAC99"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_x53_5g_modem-rf_system:-:*:*:*:*:*:*:*","matchCriteriaId":"9A12A6DC-63A2-4B52-971A-C014E40C1E6D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_x55_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AAFF2095-4257-40C9-8C48-B38C143159ED"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_x55_5g_modem-rf_system:-:*:*:*:*:*:*:*","matchCriteriaId":"7FEA2F1D-7D07-4684-BDC1-24224A53A8BC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_xr2_5g_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1A129620-8241-4A47-AAC8-CC7E10A09C9C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_xr2_5g_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"4CEDD78E-124C-4216-9B57-3B7B53463659"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_xr2\\+_gen_1_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BF9740EB-F82E-42EA-993E-A393B05CC6BB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_xr2\\+_gen_1_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"022A5532-03F7-4FB8-BA0D-4221178C9486"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_auto_4g_modem_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3C8F12FE-0057-4A13-9A7F-D12C114ECEF9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_auto_4g_modem:-:*:*:*:*:*:*:*","matchCriteriaId":"1271B0C7-2D91-4129-9B58-E6689DD68C39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:vision_intelligence_400_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6E685A5C-870C-41E9-91AA-7AA7535C4D85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:vision_intelligence_400_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"D8F52FE7-2C9C-4908-A578-2230ED6A1505"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9306_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FC012AD0-BCEE-4B1E-9B15-5D77D78CEA01"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9306:-:*:*:*:*:*:*:*","matchCriteriaId":"F51C69B9-F0AB-4BF5-A8C2-64FEB7075593"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9335_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"28717583-463A-468A-8073-ECF0F90585F6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9335:-:*:*:*:*:*:*:*","matchCriteriaId":"4D1A7188-7D5D-4D46-AEAB-08BA84FFF539"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9340_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8BA28CC6-C8BB-4F50-BFE3-A59F664A4F54"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9340:-:*:*:*:*:*:*:*","matchCriteriaId":"94D2BDF1-764C-48BA-8944-3275E8768078"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9341_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CE852339-1CAE-4983-9757-8F00EDEF1141"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9341:-:*:*:*:*:*:*:*","matchCriteriaId":"4D9E96B3-F1BB-46F8-B715-7DF90180F1E1"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9360_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C4D6C6B2-36DC-4D0D-AFF8-2108A090A78D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9360:-:*:*:*:*:*:*:*","matchCriteriaId":"28FEB3B1-F641-436D-AC4F-3304C37167C4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9370_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1295D869-F4DD-4766-B4AA-3513752F43B4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9370:-:*:*:*:*:*:*:*","matchCriteriaId":"B98784DC-3143-4D38-AD28-DBBDCCAB4272"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9371_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2503805B-B2A6-4AEE-8AB1-2B8A040702BD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9371:-:*:*:*:*:*:*:*","matchCriteriaId":"D3AD370C-2ED0-43CF-83D9-50DC92A01CA5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9375_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"34143ABA-7D09-429F-A65C-3A33438BF62C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9375:-:*:*:*:*:*:*:*","matchCriteriaId":"9D56DFE3-5EF1-4B23-BBD5-0203FBF9CCEC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9378_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4CFDBB5B-0A4F-4032-874F-D2A7EF933FB0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9378:-:*:*:*:*:*:*:*","matchCriteriaId":"D28A12D6-CC60-4BE9-ADEE-FAB58B05440F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"70292B01-617F-44AD-AF77-1AFC1450523D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9380:-:*:*:*:*:*:*:*","matchCriteriaId":"FA94C6D6-85DB-4031-AAF4-C399019AE16D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"92B17201-8185-47F1-9720-5AB4ECD11B22"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9385:-:*:*:*:*:*:*:*","matchCriteriaId":"E1FA2EB9-416F-4D69-8786-386CC73978AE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9390_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"896F1C04-9957-440F-BF01-C3772CC3B3DF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9390:-:*:*:*:*:*:*:*","matchCriteriaId":"A90555EB-47A7-4717-92D5-35B561825F06"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9395_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"699056F6-1517-4F25-AE07-4FFCF6923B9F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9395:-:*:*:*:*:*:*:*","matchCriteriaId":"E4C023D2-6FF5-4FFC-B9F2-895979166580"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3910_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9F0D7B24-D567-479A-B4F1-595FAA053418"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3910:-:*:*:*:*:*:*:*","matchCriteriaId":"33A8FAA1-F824-4561-9CCC-7F0DF12F740F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3950_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3FEF2DB6-00F5-4B07-953B-EF58B31267F1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3950:-:*:*:*:*:*:*:*","matchCriteriaId":"120E8F0F-EBEB-4565-9927-2D473F783EF7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3980_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9C6E9038-9B18-4958-BE1E-215901C9B4B2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3980:-:*:*:*:*:*:*:*","matchCriteriaId":"B36D3274-F8D0-49C5-A6D5-95F5DC6D1950"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4BFB25F-013B-48E3-99FF-3E8687F94423"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3988:-:*:*:*:*:*:*:*","matchCriteriaId":"BF676C5B-838B-446C-A689-6A25AB8A87E2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3990_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2744A053-5BD9-45A9-A2FC-791BCA0CCD4C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3990:-:*:*:*:*:*:*:*","matchCriteriaId":"D5F28E29-520F-469E-B048-62DE2EF07ADD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn6650_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"93398092-AF7C-4F04-874C-7E5B4CF7AB00"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn6650:-:*:*:*:*:*:*:*","matchCriteriaId":"7D242084-5844-4E43-8D7F-D2F8E3521F0C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn6755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2BC386D9-3D2B-40FA-A2D9-199BB138F46A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn6755:-:*:*:*:*:*:*:*","matchCriteriaId":"133FFD9F-FA09-4801-939B-AD1D507BE5FE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8810_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"15307882-7039-43E9-9BA3-035045988B99"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8810:-:*:*:*:*:*:*:*","matchCriteriaId":"AA85B322-E593-4499-829A-CC6D70BAE884"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E839A0B9-64C3-4C7A-82B7-D2AAF65928F8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8815:-:*:*:*:*:*:*:*","matchCriteriaId":"7E870D82-DE3B-4199-A730-C8FB545BAA98"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8830_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"11B69595-E488-4590-A150-CE5BE08B5E13"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8830:-:*:*:*:*:*:*:*","matchCriteriaId":"BF680174-5FA6-47D9-8EAB-CC2A37A7BD42"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8832_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7ACAD26E-B79E-4659-91A5-D301281F7D36"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8832:-:*:*:*:*:*:*:*","matchCriteriaId":"F0E46DA6-9494-4D92-A4AE-A272AF6ACCCC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F80BC68E-7476-4A40-9F48-53722FE9A5BF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8835:-:*:*:*:*:*:*:*","matchCriteriaId":"6B36F4B2-BAA3-45AD-9967-0EB482C99708"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8840_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA33DE15-C177-43B3-AD50-FF797753D12E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8840:-:*:*:*:*:*:*:*","matchCriteriaId":"AE1A5841-5BCB-4033-ACB9-23F3FCA65309"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8845_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5B47BF35-3AA0-4667-842E-19B0FE30BF3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8845:-:*:*:*:*:*:*:*","matchCriteriaId":"8A071672-9405-4418-9141-35CEADBB65AF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:ar8031_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FCE1ADA9-8042-4CDE-A2B9-E96665CB41BE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:ar8031:-:*:*:*:*:*:*:*","matchCriteriaId":"BB1DE046-DD70-4ACA-9DF4-59939DAC1889"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:c-v2x_9150_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4A725088-FC3B-4439-9189-72AA10954721"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:c-v2x_9150:-:*:*:*:*:*:*:*","matchCriteriaId":"B80D6366-4C0C-4C0D-9A38-769C66D62F0F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:csra6620_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FA42F2EA-5D00-42B8-B020-C27675B72915"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:csra6620:-:*:*:*:*:*:*:*","matchCriteriaId":"BFCF207D-B8C8-4860-89C7-673C821F0237"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:csra6640_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A8A35ECF-B12E-42DE-A74B-2C3BE03639A4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:csra6640:-:*:*:*:*:*:*:*","matchCriteriaId":"65B283D6-B2D2-49B6-98A8-08EDB54C1F15"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:csrb31024_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1EBF42F8-50BA-4172-A3A0-7FD1BA4B3ED3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:csrb31024:-:*:*:*:*:*:*:*","matchCriteriaId":"770F3924-BE27-4BDE-B922-680B3C9753EB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6200_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CDE1CBDE-3D28-463C-B215-AA7DF373EF09"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6200:-:*:*:*:*:*:*:*","matchCriteriaId":"66BD3B88-7CF9-482D-A2DD-67F6ACF4CC57"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6700_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"82B82E87-F3F4-466F-A76B-C8809121FF6F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6700:-:*:*:*:*:*:*:*","matchCriteriaId":"419A132E-E42C-4395-B74B-788A39DF1D13"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6800_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D89F035A-2388-48FC-AEBB-8429C6880F4A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6800:-:*:*:*:*:*:*:*","matchCriteriaId":"CA13EF4E-AAE6-45F4-9E41-78310E37CE81"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6900_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E670F500-9B71-4BBE-B5DA-221D35803C89"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6900:-:*:*:*:*:*:*:*","matchCriteriaId":"9ADEB5C5-B79A-4F45-B7D3-75945B38DB6C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_7800_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B3053D68-C5D8-4D47-A4F0-9F3AF2289E1D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_7800:-:*:*:*:*:*:*:*","matchCriteriaId":"638DBC7F-456F-487D-BED2-2214DFF8BEE2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:flight_rb5_5g_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AD36089F-92DF-49EC-9C6F-4300E4903CB2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:flight_rb5_5g_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"D19A754C-6900-4436-916D-F5361E0BC324"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fsm100_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4FCC7277-ECF0-4AEC-A0AF-85976EAB0F5A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fsm100_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"7AF97AB0-7691-4D66-801A-00311B259BE4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:g1_gen_1_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0556CCE6-B61B-4DE7-AD4B-333414280DF8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:g1_gen_1:-:*:*:*:*:*:*:*","matchCriteriaId":"CC734495-D935-40CC-9644-477E921F3EE0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:g2_gen_1_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"924DFF0F-E8B2-4B94-9B98-E0C2D6313C87"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:g2_gen_1:-:*:*:*:*:*:*:*","matchCriteriaId":"2A5E644B-D05F-4241-8E20-4A6DA1A56695"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:g3x_gen_2_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C167BE19-999E-4538-A23E-01F9C287A6C7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:g3x_gen_2:-:*:*:*:*:*:*:*","matchCriteriaId":"1026CB5F-E30A-42DE-8432-74412CC8BA00"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iq-615_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D2B2D5D-0213-4979-ACBF-BEF843166047"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iq-615:-:*:*:*:*:*:*:*","matchCriteriaId":"CE575B0C-DDE4-4E5A-9FE8-03305C804558"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iq-8275_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"253BF0D2-D24D-4EE3-A157-9853BBB368F2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iq-8275:-:*:*:*:*:*:*:*","matchCriteriaId":"78C6B840-62E9-4DDD-9376-2F7A8FB9D589"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iq-9075_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"08431A88-C176-48BB-918C-DF3FEABE78D4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iq-9075:-:*:*:*:*:*:*:*","matchCriteriaId":"3C50A35E-023A-404D-BFBC-FFCD1F30E872"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iqx5121_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"499A2520-436C-4B12-849D-98B94088CCDE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iqx5121:-:*:*:*:*:*:*:*","matchCriteriaId":"4C34A825-C928-4F8F-B076-19F8787A3440"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iqx7181_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F58C10B5-2BB1-4A8F-AF4B-2EC791C9FBBE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iqx7181:-:*:*:*:*:*:*:*","matchCriteriaId":"9EE22328-BBF8-473C-8F89-58AEF8CC9D75"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:mbm415_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"06917C11-6ABA-4972-A4A5-AEA69A5E73FE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:mbm415:-:*:*:*:*:*:*:*","matchCriteriaId":"9B1C6B87-2B59-4220-BC0D-7CE30F514728"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:monaco_iot_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D071BA3E-36AE-40E5-88FB-04012ABECBD2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:monaco_iot:-:*:*:*:*:*:*:*","matchCriteriaId":"F9FB6B54-7F16-497D-B211-327744F35ECB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:netrani_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9C52A53B-1182-47F3-9800-D8C58F954277"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:netrani:-:*:*:*:*:*:*:*","matchCriteriaId":"BEC1F084-78C8-4413-940A-47E9554CB6D0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca0000_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CC941093-1A7C-47B2-AB3B-05AE4AE2FBE4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca0000:-:*:*:*:*:*:*:*","matchCriteriaId":"7A2AA834-C17C-4E0E-A510-795818041E47"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca2066_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6366F2ED-C6B7-4579-B304-C5B6DF951EB4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca2066:-:*:*:*:*:*:*:*","matchCriteriaId":"09B688AF-E1A4-496C-924C-D6B725CBBE26"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca4004_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DFB39496-8699-4DAF-BD7B-AE69260B20CB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca4004:-:*:*:*:*:*:*:*","matchCriteriaId":"E9CFBC24-5F15-40DE-806E-62C1EE808992"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6391_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"83B53119-1B2F-4978-B7F5-33B84BE73B68"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6391:-:*:*:*:*:*:*:*","matchCriteriaId":"6FEBC0C5-CAA1-475C-96C2-B8D24B2E4536"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6420_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7E16994A-6DBA-426C-ADD2-B1E8B49FEDBF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6420:-:*:*:*:*:*:*:*","matchCriteriaId":"47E674DE-55AB-44E5-8E00-C804FC9D4DC0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6430_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"95AFC483-1468-43FC-96FA-A56165C290E0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6430:-:*:*:*:*:*:*:*","matchCriteriaId":"0A963FDF-6FF4-4F48-834E-2A14D241716D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6564_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00FE294D-4BE0-4436-9273-507E760884EC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6564:-:*:*:*:*:*:*:*","matchCriteriaId":"424CB795-58E5-43A4-A2EC-C563D93C5E72"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6564a_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"886124F6-B397-4EB6-8E01-6012E468ABE9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6564a:-:*:*:*:*:*:*:*","matchCriteriaId":"93ED74CE-6BF2-4983-8780-07D5336745B3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6564au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B59672A0-2FA6-46CC-B75A-C599B842AFB9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6564au:-:*:*:*:*:*:*:*","matchCriteriaId":"3847F4A5-90A5-4C84-B43F-0DDD81BD79CE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6574_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9B828AC8-4A01-4537-B2BD-8180C99F5C32"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6574:-:*:*:*:*:*:*:*","matchCriteriaId":"66C16E1E-9D4A-4F20-B697-833FDCCA86FB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6574a_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"828CFB37-76A6-4927-9D00-AF9A1C432DD6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6574a:-:*:*:*:*:*:*:*","matchCriteriaId":"11405993-5903-4716-B452-370281034B42"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6574au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D527E2B1-2A46-4FBA-9F7A-F5543677C8FB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6574au:-:*:*:*:*:*:*:*","matchCriteriaId":"8374DDB3-D484-4141-AE0C-42333D2721F6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6595_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"643EC76D-2836-48E6-81DA-78C4883C33CA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6595:-:*:*:*:*:*:*:*","matchCriteriaId":"477F6529-4CE1-44FC-B6EE-D24D44C71AE7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6595au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"288F637F-22F8-47CF-B67F-C798A730A1BD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6595au:-:*:*:*:*:*:*:*","matchCriteriaId":"D0996EA3-1C92-4933-BE34-9CF625E59FE7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6688aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AFBD264F-F24A-4CDD-B316-9514A61B91E7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6688aq:-:*:*:*:*:*:*:*","matchCriteriaId":"94CC5BC4-011D-4D2B-8891-97FBF61FD783"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6696_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0AE207DB-9770-40ED-961D-FDA75965826F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6696:-:*:*:*:*:*:*:*","matchCriteriaId":"0E23922D-C37F-476F-A623-4C1458A9156F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6698aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5FA1F8F4-EAF2-4704-A8A6-19AD3CA1B577"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6698aq:-:*:*:*:*:*:*:*","matchCriteriaId":"B3F7853D-09EE-476F-B48D-BB30AEB4A67D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8845h_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB7CF473-8B25-4851-91F2-1BD693CCDC85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8845h:-:*:*:*:*:*:*:*","matchCriteriaId":"91E591F2-8F72-4A5A-9264-2742EB2DABDA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6698au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3ACA09C0-84A5-493A-A9BD-EF95A8330D54"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6698au:-:*:*:*:*:*:*:*","matchCriteriaId":"3A2397BD-431C-4730-92E3-17A5C2445A65"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6797aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"797295C2-535C-46A9-A725-E1A5405F0436"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6797aq:-:*:*:*:*:*:*:*","matchCriteriaId":"8BFC575E-594E-4711-94B1-2DC8D03B9AC4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcc710_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2A75D017-032F-4369-917C-567EE2A809F2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcc710:-:*:*:*:*:*:*:*","matchCriteriaId":"107F0423-608C-404D-B58B-616A6494418F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm2290_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5AB1F0FA-25F3-4304-A3BC-5264E55CC092"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm2290:-:*:*:*:*:*:*:*","matchCriteriaId":"214A053F-D80C-4AD9-B4F1-83384095A3F3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm4290_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3C7FFB96-53E7-41A2-BC99-7ACD853214A8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm4290:-:*:*:*:*:*:*:*","matchCriteriaId":"74EBA77E-69A5-4145-9BEC-CD39BA132309"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm4325_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F2D8044B-D4E5-4174-A0FB-478F8434EE8F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm4325:-:*:*:*:*:*:*:*","matchCriteriaId":"163FE96E-DF5B-4B67-8EDE-44A5B9A8492D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm4490_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DA506489-4338-44DF-8F92-12E60AF0048C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm4490:-:*:*:*:*:*:*:*","matchCriteriaId":"A8718C37-A82A-4A08-A887-3F22B37601A9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm5430_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4EC5F81B-AA24-4E3C-9FC8-53E010AC977E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm5430:-:*:*:*:*:*:*:*","matchCriteriaId":"B5C66DAD-0D85-46B8-92D7-6D68B9429E9A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm6125_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AB226552-52D9-44F5-A170-35C44761A72B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm6125:-:*:*:*:*:*:*:*","matchCriteriaId":"FBB16DC4-CDC9-4936-9C6A-0ED8E1F6D056"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm6490_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"ADD6D51E-5787-42A6-8A02-4EBBAFFF9C94"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm6490:-:*:*:*:*:*:*:*","matchCriteriaId":"99AA0291-B822-4CAD-BA17-81B632FC3FEF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcn9011_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9306C34D-47E4-40CF-89F4-BA5263655D13"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcn9011:-:*:*:*:*:*:*:*","matchCriteriaId":"02BA009F-24E1-4953-BA95-2A5BC1CDBDBB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcn9012_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"61F34DD2-9DC0-49E5-BC85-1543EA199477"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcn9012:-:*:*:*:*:*:*:*","matchCriteriaId":"1A06879F-6FE9-448A-8186-8347D76F872B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs2290_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"93CDB7BC-89F2-4482-B8E3-9DDBD918C851"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs2290:-:*:*:*:*:*:*:*","matchCriteriaId":"76E03AE9-2485-449B-BCFD-3E452BB01FC6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs4290_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"06789CB9-E6FA-400D-90B6-C2DB6C8EF153"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs4290:-:*:*:*:*:*:*:*","matchCriteriaId":"FFCB9F22-57F2-4327-95B9-B2342A02E45E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs4490_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3336CDD7-9E7B-4FFB-A5CE-594B19B63A6C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs4490:-:*:*:*:*:*:*:*","matchCriteriaId":"1197E229-1E27-4CA3-A386-B77FAE5DFE1A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs8550_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FFF23DDB-98A0-4343-ADD3-5AB9C2383E7E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs8550:-:*:*:*:*:*:*:*","matchCriteriaId":"5ACB8AFB-5B91-4AA1-BA3A-1AF0B3503080"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qts110_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B2D4B026-2118-448D-A48D-36864DE715B8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qts110:-:*:*:*:*:*:*:*","matchCriteriaId":"5ED10480-E005-452C-A03C-D669CE94ABE4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:video_collaboration_vc1_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C3607443-848D-4334-B5E4-0DC27F28509B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:video_collaboration_vc1_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"2E8F00DD-C894-4236-8932-7F7FCD15D2A5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:video_collaboration_vc3_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DD4946C6-778F-4542-AB77-C9B86AF25C05"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:video_collaboration_vc3_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"6F1D604A-4530-42B3-80A0-58A82D658DDD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:video_collaboration_vc5_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"87CF9AD4-6E1B-47E8-B441-022A03858875"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:video_collaboration_vc5_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"791C1E60-162D-4881-80D5-895658FEC47E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:robotics_rb2_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"76F5D880-7BBD-4B33-AC47-9B5C4AA49A36"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:robotics_rb2_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"3D0194E5-328D-4E53-A1F2-1CFE333217F4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:robotics_rb5_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FCA73E75-F339-49BA-B1F6-619E4630DE92"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:robotics_rb5_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"5DA6E940-1059-4EA2-8225-0F754FE9F50F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa2150p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23586F55-C82A-4B4C-892A-EDAEE9ECE93D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa2150p:-:*:*:*:*:*:*:*","matchCriteriaId":"29A1C366-6B1F-43AA-92CF-623F91F29A06"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa4150p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0DC99C0C-8AE3-4918-B91D-2C26990FE931"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa4150p:-:*:*:*:*:*:*:*","matchCriteriaId":"A558A868-1B67-48D2-8A94-FDEA7126FAE7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa4155p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D8D28764-EF4F-4FB3-B936-B42397450EFD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa4155p:-:*:*:*:*:*:*:*","matchCriteriaId":"7964A762-467B-47D7-865F-30D48A0AE47C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa6145p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C66671C1-AE1A-44BE-9DB2-0B09FF4417DB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa6145p:-:*:*:*:*:*:*:*","matchCriteriaId":"74AA3929-3F80-4D54-B13A-9B070D5C03BB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa6150p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"054F77D6-FC66-4151-9005-DC7ECDB5C722"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa6150p:-:*:*:*:*:*:*:*","matchCriteriaId":"8ED3F589-16D9-46A7-A539-C9862473EE0D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa6155_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4C40544E-B040-491C-8DF3-50225E70B50C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa6155:-:*:*:*:*:*:*:*","matchCriteriaId":"A2DAC85C-CDC9-4784-A69A-147A2CE8A8B2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa6155p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8DC40C14-3B2D-4E00-9E0F-86E6BDBF2D81"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa6155p:-:*:*:*:*:*:*:*","matchCriteriaId":"0514D433-162C-4680-8912-721D19BE6201"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8145p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A71D74B0-0963-49FD-8E97-148C8993B263"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8145p:-:*:*:*:*:*:*:*","matchCriteriaId":"910CBFA4-50F7-4C7A-B9B9-B88C8A919827"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8150p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"69C1B02F-8D2D-42E7-B70D-41F4D9844FD1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8150p:-:*:*:*:*:*:*:*","matchCriteriaId":"3FEACAA9-C061-4713-9A54-37D8BFC0B00B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8155_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F33EB594-B0D3-42F2-B1CA-B0E6C9D82C6B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8155:-:*:*:*:*:*:*:*","matchCriteriaId":"50EF47E5-2875-412F-815D-44804BB3A739"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8155p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C8648B38-2597-401A-8F53-D582FA911569"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8155p:-:*:*:*:*:*:*:*","matchCriteriaId":"A01CD59B-8F21-4CD6-8A1A-7B37547A8715"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8195p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"51BC0A66-493B-43BE-B51F-640BDF2FF32E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8195p:-:*:*:*:*:*:*:*","matchCriteriaId":"D8DA4D12-7ABF-4A04-B44E-E1D68C8E58AB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sc8380xp_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14E3FE58-7F1C-4F5C-B62D-0CF124E14AB2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sc8380xp:-:*:*:*:*:*:*:*","matchCriteriaId":"FFCB0BBA-3F81-4FCA-B3DE-190C46DA50DB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen1_5g_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D0567B3-D81A-4EEE-868B-4DC2214C159D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen1_5g:-:*:*:*:*:*:*:*","matchCriteriaId":"76236C11-4903-4AD4-9134-3EDD3451EE43"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_662_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"37DF4D73-3ACC-41B3-8CA4-20DAECE6BFB7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_662_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"FE08D23A-2D0D-4472-8847-27B955F55165"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_865_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6C9F4285-1F09-40CD-B1AA-84B406FD6A71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_865_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"8623DD44-DFDD-442D-9789-11A527A450A4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6225p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8D2B7D93-4218-4FFF-B1C0-F50EC0B2B934"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6225p:-:*:*:*:*:*:*:*","matchCriteriaId":"00D9DCE1-B3CD-4F45-97DD-637AA27572DD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6250_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FACA2BF1-85D3-447F-A08D-B90330A22550"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6250:-:*:*:*:*:*:*:*","matchCriteriaId":"C2ABA18D-82C1-4366-B1D7-DED42DD3D5C5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6450p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEE752CE-2121-477E-A1C9-6A05DF36DFA9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6450p:-:*:*:*:*:*:*:*","matchCriteriaId":"DCA019DB-C24E-4C2B-B4E4-95F61E038FEA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6475p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E32FAA6A-E882-4978-B748-5617BE33F347"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6475p:-:*:*:*:*:*:*:*","matchCriteriaId":"FFFCBBD0-3F52-446F-9A6B-2D138463AB80"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6475q_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03B375DA-4A46-4BC6-B873-99538D53DFBD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6475q:-:*:*:*:*:*:*:*","matchCriteriaId":"ACEA2D75-14DB-4F87-8F3C-A6E9436ECA97"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7325p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4BEC725F-19B1-4078-B13D-CE624BE23344"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7325p:-:*:*:*:*:*:*:*","matchCriteriaId":"4EA43E38-A12D-49C3-B05C-A2AF07ED2710"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7435_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F7A95A9E-617A-4D3A-9A4E-0C0A29B3C8B5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7435:-:*:*:*:*:*:*:*","matchCriteriaId":"3559292E-B5A6-4F88-BC20-F6AA85F07C97"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7435p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"55C65D26-71D7-4840-B8B1-7C5EC69EB320"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7435p:-:*:*:*:*:*:*:*","matchCriteriaId":"B322FB35-2415-45EA-A350-746AFF734ACD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7525_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2410FF59-E0C0-4920-9656-C398DB06DEAE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7525:-:*:*:*:*:*:*:*","matchCriteriaId":"7D2B800C-4DBC-4028-875D-667C87D75247"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7550_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EEA5CE41-0596-4D38-9891-D1DF711EA7E9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7550:-:*:*:*:*:*:*:*","matchCriteriaId":"E1A901C6-FB73-4361-B391-4A4AF8C70029"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7550p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5C5D7E2C-0955-4B6E-96E4-CFA06D937492"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7550p:-:*:*:*:*:*:*:*","matchCriteriaId":"9D1D0F33-AD5A-4826-9A06-EAD2A8709974"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7635p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3A72DAA5-E10F-40A0-A8CC-541594A3279F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7635p:-:*:*:*:*:*:*:*","matchCriteriaId":"15CC657A-7623-4F37-AC52-8AF5C83D5BDA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8475p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8DBF6AE8-605B-4E72-BD3B-0B6C390FCE32"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8475p:-:*:*:*:*:*:*:*","matchCriteriaId":"26AAE148-96B6-4FDE-BABD-48F607464A38"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8550p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C4CDD6A2-5A3C-4572-8CE1-2F102333BB79"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8550p:-:*:*:*:*:*:*:*","matchCriteriaId":"699E5D17-6144-4F0A-8D52-1E8C83990E52"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:smart_audio_400_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"57B0086F-5F2C-4F89-AC53-D8429D6506CD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:smart_audio_400_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"FB8145C8-D978-4047-9203-602E854E7290"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_4_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2CCBF666-CB4E-44E1-9676-6891EDC73578"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_4_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"C767AB6A-1A8C-406C-A600-96A816F44E2F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_4_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"55AECCCF-0761-46B6-B669-E73096679AFB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_4_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"7DE87CA2-160A-43BF-AC18-DA788501B5B4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_460_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"390D7CAF-6C0B-4438-AA7D-AEEE127F4D3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_460_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"5BB1FC5E-CF6F-4E54-B78D-C01AFD034903"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_480_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA3F11F3-C9F4-460D-BD77-1BFBCC1F0592"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_480_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"25673A10-D99C-4F67-BDA7-9C2E4A70EF9C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_480\\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"50906EF2-01F7-4E97-9F49-F892DF41CB29"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_480\\+_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"B23A89FF-9C94-40C6-B9B7-3E8354777916"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_6_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EBB3BC1B-2EBC-457C-AE91-6BD408EB7D5F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_6_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"0870CC30-07F8-4FFF-85B4-FBACE947CC14"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_6_gen_3_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D69E4203-EA20-4D6F-BD1C-C8E550588F87"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_6_gen_3_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"C1225010-5A08-4D13-A3E2-4C57C4265605"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_680_4g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8D0ED00F-1345-43AD-83C6-E979890B84AB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_680_4g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"92C28019-B57D-4487-B551-F7B53395C6E5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_685_4g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C174F07D-0E33-43FD-9BAD-6C6D8B51B6A6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_685_4g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"47311B68-A07F-448B-99D5-9C92C8127A81"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_695_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A9A2DA11-5E4E-4E36-923C-A2D3CC2F2751"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_695_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"BE7DFAD4-1D21-4A3A-9E8C-10F00AD7C403"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"677D5A3F-2A0D-48F0-A1C5-B067BADFD11A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"CB79B015-A401-4FAD-8818-1475653C2B12"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7\\+_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C8E41CBD-D6AD-41CF-A469-92A7E228BBB6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7\\+_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"57E0BA08-3BF4-4E84-BBA9-B48F84197F9D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_778g_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"87ECCB82-B880-412D-A635-CA6F0B035F2B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_778g_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"424743C4-CE74-4A02-835A-023C9DA0CFAC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_778g\\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14EA48BF-BD65-43B2-8DC1-D97F75AD6FE5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_778g\\+_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"B86E317F-12BF-42F6-879B-88A85F7E3F81"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_782g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"194A4BD4-0DDF-49E5-AA89-40A5BFB71933"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_782g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"72FF9732-40D8-4C12-8259-BAA16FAB5A56"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7c_compute_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"65B3644E-74B5-41BB-BA43-F3E588D152CE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7c_compute_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"75F10C87-25C4-40A5-9B7E-904C2258CB3C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7c_gen_2_compute_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EC68355A-3202-4317-9767-26AFDD321789"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7c_gen_2_compute_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"AF331899-4AA1-4D55-B494-4FA47BB97AE5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7c\\+_gen_3_compute_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C4A050CA-8514-400A-A6B3-F513CC93CA14"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7c\\+_gen_3_compute:-:*:*:*:*:*:*:*","matchCriteriaId":"BD850305-1E76-4952-A3FB-F6229CBF7FE9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EB8FA32F-4690-4C5B-8968-474DA32FD0A4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"59BD8BEA-725A-4158-84BE-4AFD476ED03D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"60F5899C-BA8D-4B6B-BC61-F77B1EB64739"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"D39AD7CE-A017-4D74-A348-9E4B08363799"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8\\+_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"59CB6F2F-7C95-498B-9F9E-728930FD24A7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8\\+_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"284E62AF-2E4D-4E82-AC9A-F27DA71735EF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8\\+_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1FEDF458-DEA7-42A1-A56D-E11250139545"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8\\+_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"D5693438-0F20-47BB-BA32-7175C3152368"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_865\\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22303AD4-779C-45A3-8F33-3864C45E4328"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_865\\+_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"B8EC440D-D420-4477-8F14-427245B80631"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_870_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"41446A77-6EF3-4570-BAD2-4C761A2C4E7F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_870_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"448C401B-EF07-4385-A7B4-123D7808F64F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_888_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22A78236-5965-4F65-9001-3FE7FF6D27E8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_888_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"414C5C1D-A5DA-47C7-B6C9-3564DD4DD911"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_888\\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"01CBD543-635C-4C57-87B7-55DD3BA3C1A2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_888\\+_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"6A7272B6-AADB-4CCD-B041-66170C313C76"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8c_compute_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DC63E59F-CB68-435C-B1A4-7DA5D722142F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8c_compute_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"088D62A3-1FE5-42D6-9231-41DDE4DA37EF"}]}]}],"references":[{"url":"https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2026-bulletin.html","source":"product-security@qualcomm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-25267","sourceIdentifier":"product-security@qualcomm.com","published":"2026-10-06T07:16:56.997","lastModified":"2026-10-09T14:10:26.887","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Memory corruption when non-secure loader rewrites page tables before secure memory initialization."}],"affected":[{"source":"product-security@qualcomm.com","affectedData":[{"vendor":"Qualcomm, Inc.","product":"Snapdragon","defaultStatus":"unaffected","platforms":["Snapdragon Auto","Snapdragon Compute","Snapdragon Connectivity","Snapdragon Consumer IOT","Snapdragon Industrial IOT","Snapdragon Mobile","Snapdragon Voice & Music","Snapdragon WBC","Snapdragon Wired Infrastructure and Networking"],"versions":[{"version":"315 5G IoT Modem","status":"affected"},{"version":"5G Fixed Wireless Access Platform","status":"affected"},{"version":"9205 LTE Modem","status":"affected"},{"version":"9205S Modem","status":"affected"},{"version":"AQT1000","status":"affected"},{"version":"AR8031","status":"affected"},{"version":"AR8035","status":"affected"},{"version":"Cologne","status":"affected"},{"version":"CSRA6620","status":"affected"},{"version":"CSRA6640","status":"affected"},{"version":"CSRB31024","status":"affected"},{"version":"C-V2X 9150","status":"affected"},{"version":"FastConnect 6200","status":"affected"},{"version":"FastConnect 6700","status":"affected"},{"version":"FastConnect 6800","status":"affected"},{"version":"FastConnect 6900","status":"affected"},{"version":"FastConnect 7800","status":"affected"},{"version":"FSM100 Platform","status":"affected"},{"version":"G1 Gen 1","status":"affected"},{"version":"G3x Gen 2","status":"affected"},{"version":"IQ6 Series Platform","status":"affected"},{"version":"IQ8 Series Platform","status":"affected"},{"version":"IQ9 Series Platform","status":"affected"},{"version":"IQX5121","status":"affected"},{"version":"MBM415","status":"affected"},{"version":"Monaco_IOT","status":"affected"},{"version":"Networking Pro 1210 Platform","status":"affected"},{"version":"Networking Pro 1610 Platform","status":"affected"},{"version":"Networking Pro 610 Platform","status":"affected"},{"version":"Networking Pro 810 Platform","status":"affected"},{"version":"Q-4390","status":"affected"},{"version":"QCA0000","status":"affected"},{"version":"QCA4004","status":"affected"},{"version":"QCA6174A","status":"affected"},{"version":"QCA6391","status":"affected"},{"version":"QCA6420","status":"affected"},{"version":"QCA6421","status":"affected"},{"version":"QCA6426","status":"affected"},{"version":"QCA6430","status":"affected"},{"version":"QCA6431","status":"affected"},{"version":"QCA6436","status":"affected"},{"version":"QCA6564","status":"affected"},{"version":"QCA6564A","status":"affected"},{"version":"QCA6564AU","status":"affected"},{"version":"QCA6574","status":"affected"},{"version":"QCA6574A","status":"affected"},{"version":"QCA6574AU","status":"affected"},{"version":"QCA6595","status":"affected"},{"version":"QCA6595AU","status":"affected"},{"version":"QCA6688AQ","status":"affected"},{"version":"QCA6696","status":"affected"},{"version":"QCA6698AQ","status":"affected"},{"version":"QCA6698AU","status":"affected"},{"version":"QCA6797AQ","status":"affected"},{"version":"QCA8337","status":"affected"},{"version":"QCA9377","status":"affected"},{"version":"QCA9984","status":"affected"},{"version":"QCC2070","status":"affected"},{"version":"QCC6705","status":"affected"},{"version":"QCC710","status":"affected"},{"version":"QCC711","status":"affected"},{"version":"QCM2290","status":"affected"},{"version":"QCM4290","status":"affected"},{"version":"QCM4325","status":"affected"},{"version":"QCM5430","status":"affected"},{"version":"QCM6125","status":"affected"},{"version":"QCM6490","status":"affected"},{"version":"QCM8550","status":"affected"},{"version":"QCN7606","status":"affected"},{"version":"QCN9011","status":"affected"},{"version":"QCN9012","status":"affected"},{"version":"QCS2290","status":"affected"},{"version":"QCS410","status":"affected"},{"version":"QCS4290","status":"affected"},{"version":"QCS8155","status":"affected"},{"version":"QCS8550","status":"affected"},{"version":"QRB5165N","status":"affected"},{"version":"QSM8250","status":"affected"},{"version":"QSM8350","status":"affected"},{"version":"Qualcomm Dragonwing IQ-X","status":"affected"},{"version":"Qualcomm Dragonwing QCM4490","status":"affected"},{"version":"Qualcomm Dragonwing QRB5165","status":"affected"},{"version":"Qualcomm QTS110 Tracker","status":"affected"},{"version":"Qualcomm Video Collaboration VC1 Platform","status":"affected"},{"version":"Qualcomm Video Collaboration VC3 Platform","status":"affected"},{"version":"Qualcomm Video Collaboration VC5 Platform","status":"affected"},{"version":"Robotics RB2 Platform","status":"affected"},{"version":"Robotics RB5 Platform","status":"affected"},{"version":"SA2150P","status":"affected"},{"version":"SA4150P","status":"affected"},{"version":"SA4155P","status":"affected"},{"version":"SA6145P","status":"affected"},{"version":"SA6150P","status":"affected"},{"version":"SA6155","status":"affected"},{"version":"SA6155P","status":"affected"},{"version":"SA8145P","status":"affected"},{"version":"SA8150P","status":"affected"},{"version":"SA8155","status":"affected"},{"version":"SA8155P","status":"affected"},{"version":"SA8195P","status":"affected"},{"version":"SC8180X+SDX55","status":"affected"},{"version":"SC8380XP","status":"affected"},{"version":"SD 675","status":"affected"},{"version":"SD 8 Gen1 5G","status":"affected"},{"version":"SD460","status":"affected"},{"version":"SD662","status":"affected"},{"version":"SD730","status":"affected"},{"version":"SD855","status":"affected"},{"version":"SD865 5G","status":"affected"},{"version":"SD888","status":"affected"},{"version":"SDA640","status":"affected"},{"version":"SDM640","status":"affected"},{"version":"SM4125","status":"affected"},{"version":"SM6225P","status":"affected"},{"version":"SM6250","status":"affected"},{"version":"SM6250P","status":"affected"},{"version":"SM6370","status":"affected"},{"version":"SM7315","status":"affected"},{"version":"SM7325P","status":"affected"},{"version":"SM8550P","status":"affected"},{"version":"Smart Audio 400 Platform","status":"affected"},{"version":"Snapdragon 4 Gen 1 Mobile Platform","status":"affected"},{"version":"Snapdragon 4 Gen 2 Mobile Platform","status":"affected"},{"version":"Snapdragon 460 Mobile Platform","status":"affected"},{"version":"Snapdragon 480 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 480+ 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 662 Mobile Platform","status":"affected"},{"version":"Snapdragon 665 Mobile Platform","status":"affected"},{"version":"Snapdragon 675 Mobile Platform","status":"affected"},{"version":"Snapdragon 678 Mobile Platform","status":"affected"},{"version":"Snapdragon 680 4G Mobile Platform","status":"affected"},{"version":"Snapdragon 685 4G Mobile Platform","status":"affected"},{"version":"Snapdragon 695 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 720G Mobile Platform","status":"affected"},{"version":"Snapdragon 730 Mobile Platform","status":"affected"},{"version":"Snapdragon 730G Mobile Platform","status":"affected"},{"version":"Snapdragon 732G Mobile Platform","status":"affected"},{"version":"Snapdragon 778G 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 778G+ 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 780G 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 782G Mobile Platform","status":"affected"},{"version":"Snapdragon 7c Compute Platform","status":"affected"},{"version":"Snapdragon 7c Gen 2 Compute Platform \"Rennell Pro\"","status":"affected"},{"version":"Snapdragon 7c+ Gen 3 Compute","status":"affected"},{"version":"Snapdragon 8 Gen 1 Mobile Platform","status":"affected"},{"version":"Snapdragon 8 Gen 2 Mobile Platform","status":"affected"},{"version":"Snapdragon 8+ Gen 1 Mobile Platform","status":"affected"},{"version":"Snapdragon 8+ Gen 2 Mobile Platform","status":"affected"},{"version":"Snapdragon 855 Mobile Platform","status":"affected"},{"version":"Snapdragon 855+/860 Mobile Platform","status":"affected"},{"version":"Snapdragon 865 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 865+ 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 870 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 888 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 888+ 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 8c Compute Platform \"Poipu Lite\"","status":"affected"},{"version":"Snapdragon 8c Compute Platform (SC8180XP-AD) \"Poipu Lite\"","status":"affected"},{"version":"Snapdragon 8cx Compute Platform","status":"affected"},{"version":"Snapdragon 8cx Compute Platform \"Poipu Pro\"","status":"affected"},{"version":"Snapdragon 8cx Gen 2 5G Compute Platform","status":"affected"},{"version":"Snapdragon 8cx Gen 2 5G Compute Platform \"Poipu Pro\"","status":"affected"},{"version":"Snapdragon Auto 5G Modem-RF","status":"affected"},{"version":"Snapdragon C Platform","status":"affected"},{"version":"Snapdragon Wear 1300 Platform","status":"affected"},{"version":"Snapdragon X24 LTE Modem","status":"affected"},{"version":"Snapdragon X50 5G Modem-RF System","status":"affected"},{"version":"Snapdragon X53 5G Modem-RF System","status":"affected"},{"version":"Snapdragon X55 5G Modem-RF System","status":"affected"},{"version":"Snapdragon XR2 5G Platform","status":"affected"},{"version":"Snapdragon XR2+ Gen 1 Platform","status":"affected"},{"version":"Snapdragon Auto 4G Modem","status":"affected"},{"version":"SXR2130","status":"affected"},{"version":"TalynPlus","status":"affected"},{"version":"Vision Intelligence 300 Platform","status":"affected"},{"version":"Vision Intelligence 400 Platform","status":"affected"},{"version":"WCD9306","status":"affected"},{"version":"WCD9335","status":"affected"},{"version":"WCD9340","status":"affected"},{"version":"WCD9341","status":"affected"},{"version":"WCD9360","status":"affected"},{"version":"WCD9370","status":"affected"},{"version":"WCD9371","status":"affected"},{"version":"WCD9375","status":"affected"},{"version":"WCD9380","status":"affected"},{"version":"WCD9385","status":"affected"},{"version":"WCD9390","status":"affected"},{"version":"WCD9395","status":"affected"},{"version":"WCN3910","status":"affected"},{"version":"WCN3950","status":"affected"},{"version":"WCN3980","status":"affected"},{"version":"WCN3988","status":"affected"},{"version":"WCN3990","status":"affected"},{"version":"WCN3999","status":"affected"},{"version":"WCN6740","status":"affected"},{"version":"WSA8810","status":"affected"},{"version":"WSA8815","status":"affected"},{"version":"WSA8830","status":"affected"},{"version":"WSA8832","status":"affected"},{"version":"WSA8835","status":"affected"},{"version":"WSA8840","status":"affected"},{"version":"WSA8845","status":"affected"},{"version":"WSA8845H","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"product-security@qualcomm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-25267","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"product-security@qualcomm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6698au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3ACA09C0-84A5-493A-A9BD-EF95A8330D54"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6698au:-:*:*:*:*:*:*:*","matchCriteriaId":"3A2397BD-431C-4730-92E3-17A5C2445A65"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6797aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"797295C2-535C-46A9-A725-E1A5405F0436"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6797aq:-:*:*:*:*:*:*:*","matchCriteriaId":"8BFC575E-594E-4711-94B1-2DC8D03B9AC4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcc710_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2A75D017-032F-4369-917C-567EE2A809F2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcc710:-:*:*:*:*:*:*:*","matchCriteriaId":"107F0423-608C-404D-B58B-616A6494418F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm2290_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5AB1F0FA-25F3-4304-A3BC-5264E55CC092"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm2290:-:*:*:*:*:*:*:*","matchCriteriaId":"214A053F-D80C-4AD9-B4F1-83384095A3F3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm4290_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3C7FFB96-53E7-41A2-BC99-7ACD853214A8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm4290:-:*:*:*:*:*:*:*","matchCriteriaId":"74EBA77E-69A5-4145-9BEC-CD39BA132309"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm4325_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F2D8044B-D4E5-4174-A0FB-478F8434EE8F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm4325:-:*:*:*:*:*:*:*","matchCriteriaId":"163FE96E-DF5B-4B67-8EDE-44A5B9A8492D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm4490_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DA506489-4338-44DF-8F92-12E60AF0048C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm4490:-:*:*:*:*:*:*:*","matchCriteriaId":"A8718C37-A82A-4A08-A887-3F22B37601A9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm5430_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4EC5F81B-AA24-4E3C-9FC8-53E010AC977E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm5430:-:*:*:*:*:*:*:*","matchCriteriaId":"B5C66DAD-0D85-46B8-92D7-6D68B9429E9A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm6125_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AB226552-52D9-44F5-A170-35C44761A72B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm6125:-:*:*:*:*:*:*:*","matchCriteriaId":"FBB16DC4-CDC9-4936-9C6A-0ED8E1F6D056"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm6490_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"ADD6D51E-5787-42A6-8A02-4EBBAFFF9C94"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm6490:-:*:*:*:*:*:*:*","matchCriteriaId":"99AA0291-B822-4CAD-BA17-81B632FC3FEF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcn9011_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9306C34D-47E4-40CF-89F4-BA5263655D13"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcn9011:-:*:*:*:*:*:*:*","matchCriteriaId":"02BA009F-24E1-4953-BA95-2A5BC1CDBDBB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcn9012_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"61F34DD2-9DC0-49E5-BC85-1543EA199477"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcn9012:-:*:*:*:*:*:*:*","matchCriteriaId":"1A06879F-6FE9-448A-8186-8347D76F872B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs2290_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"93CDB7BC-89F2-4482-B8E3-9DDBD918C851"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs2290:-:*:*:*:*:*:*:*","matchCriteriaId":"76E03AE9-2485-449B-BCFD-3E452BB01FC6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs4290_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"06789CB9-E6FA-400D-90B6-C2DB6C8EF153"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs4290:-:*:*:*:*:*:*:*","matchCriteriaId":"FFCB9F22-57F2-4327-95B9-B2342A02E45E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs4490_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3336CDD7-9E7B-4FFB-A5CE-594B19B63A6C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs4490:-:*:*:*:*:*:*:*","matchCriteriaId":"1197E229-1E27-4CA3-A386-B77FAE5DFE1A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs8550_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FFF23DDB-98A0-4343-ADD3-5AB9C2383E7E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs8550:-:*:*:*:*:*:*:*","matchCriteriaId":"5ACB8AFB-5B91-4AA1-BA3A-1AF0B3503080"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qts110_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B2D4B026-2118-448D-A48D-36864DE715B8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qts110:-:*:*:*:*:*:*:*","matchCriteriaId":"5ED10480-E005-452C-A03C-D669CE94ABE4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:video_collaboration_vc1_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C3607443-848D-4334-B5E4-0DC27F28509B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:video_collaboration_vc1_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"2E8F00DD-C894-4236-8932-7F7FCD15D2A5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:video_collaboration_vc3_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DD4946C6-778F-4542-AB77-C9B86AF25C05"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:video_collaboration_vc3_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"6F1D604A-4530-42B3-80A0-58A82D658DDD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:video_collaboration_vc5_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"87CF9AD4-6E1B-47E8-B441-022A03858875"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:video_collaboration_vc5_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"791C1E60-162D-4881-80D5-895658FEC47E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:robotics_rb2_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"76F5D880-7BBD-4B33-AC47-9B5C4AA49A36"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:robotics_rb2_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"3D0194E5-328D-4E53-A1F2-1CFE333217F4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:robotics_rb5_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FCA73E75-F339-49BA-B1F6-619E4630DE92"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:robotics_rb5_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"5DA6E940-1059-4EA2-8225-0F754FE9F50F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa2150p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23586F55-C82A-4B4C-892A-EDAEE9ECE93D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa2150p:-:*:*:*:*:*:*:*","matchCriteriaId":"29A1C366-6B1F-43AA-92CF-623F91F29A06"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa4150p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0DC99C0C-8AE3-4918-B91D-2C26990FE931"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa4150p:-:*:*:*:*:*:*:*","matchCriteriaId":"A558A868-1B67-48D2-8A94-FDEA7126FAE7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa4155p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D8D28764-EF4F-4FB3-B936-B42397450EFD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa4155p:-:*:*:*:*:*:*:*","matchCriteriaId":"7964A762-467B-47D7-865F-30D48A0AE47C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa6145p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C66671C1-AE1A-44BE-9DB2-0B09FF4417DB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa6145p:-:*:*:*:*:*:*:*","matchCriteriaId":"74AA3929-3F80-4D54-B13A-9B070D5C03BB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa6150p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"054F77D6-FC66-4151-9005-DC7ECDB5C722"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa6150p:-:*:*:*:*:*:*:*","matchCriteriaId":"8ED3F589-16D9-46A7-A539-C9862473EE0D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa6155_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4C40544E-B040-491C-8DF3-50225E70B50C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa6155:-:*:*:*:*:*:*:*","matchCriteriaId":"A2DAC85C-CDC9-4784-A69A-147A2CE8A8B2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa6155p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8DC40C14-3B2D-4E00-9E0F-86E6BDBF2D81"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa6155p:-:*:*:*:*:*:*:*","matchCriteriaId":"0514D433-162C-4680-8912-721D19BE6201"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8145p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A71D74B0-0963-49FD-8E97-148C8993B263"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8145p:-:*:*:*:*:*:*:*","matchCriteriaId":"910CBFA4-50F7-4C7A-B9B9-B88C8A919827"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8150p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"69C1B02F-8D2D-42E7-B70D-41F4D9844FD1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8150p:-:*:*:*:*:*:*:*","matchCriteriaId":"3FEACAA9-C061-4713-9A54-37D8BFC0B00B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8155_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F33EB594-B0D3-42F2-B1CA-B0E6C9D82C6B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8155:-:*:*:*:*:*:*:*","matchCriteriaId":"50EF47E5-2875-412F-815D-44804BB3A739"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8155p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C8648B38-2597-401A-8F53-D582FA911569"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8155p:-:*:*:*:*:*:*:*","matchCriteriaId":"A01CD59B-8F21-4CD6-8A1A-7B37547A8715"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8195p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"51BC0A66-493B-43BE-B51F-640BDF2FF32E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8195p:-:*:*:*:*:*:*:*","matchCriteriaId":"D8DA4D12-7ABF-4A04-B44E-E1D68C8E58AB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sc8380xp_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14E3FE58-7F1C-4F5C-B62D-0CF124E14AB2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sc8380xp:-:*:*:*:*:*:*:*","matchCriteriaId":"FFCB0BBA-3F81-4FCA-B3DE-190C46DA50DB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen1_5g_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D0567B3-D81A-4EEE-868B-4DC2214C159D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen1_5g:-:*:*:*:*:*:*:*","matchCriteriaId":"76236C11-4903-4AD4-9134-3EDD3451EE43"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_662_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"37DF4D73-3ACC-41B3-8CA4-20DAECE6BFB7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_662_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"FE08D23A-2D0D-4472-8847-27B955F55165"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_865_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6C9F4285-1F09-40CD-B1AA-84B406FD6A71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_865_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"8623DD44-DFDD-442D-9789-11A527A450A4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6225p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8D2B7D93-4218-4FFF-B1C0-F50EC0B2B934"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6225p:-:*:*:*:*:*:*:*","matchCriteriaId":"00D9DCE1-B3CD-4F45-97DD-637AA27572DD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6250_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FACA2BF1-85D3-447F-A08D-B90330A22550"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6250:-:*:*:*:*:*:*:*","matchCriteriaId":"C2ABA18D-82C1-4366-B1D7-DED42DD3D5C5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_g1_gen_2_gaming_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"905C9267-C1B5-4A77-BC33-118986A907C7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_g1_gen_2_gaming_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"671C9107-7E54-4FBC-B03D-1EB4DCD8597E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:5g_fixed_wireless_access_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C9D9ABF8-3D6C-415B-B6F9-9A430D08E335"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:5g_fixed_wireless_access_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"CF1134A5-796D-476B-A0E6-4BDD7A96A109"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:9205_lte_modem_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"920F873B-F52D-4754-9726-BECCAD0CAC45"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:9205_lte_modem:-:*:*:*:*:*:*:*","matchCriteriaId":"5EB573E2-C2B9-4B12-9EEF-9152FBFE3927"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:9205s_modem_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D43C389A-8330-4747-8371-6E184236B134"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:9205s_modem:-:*:*:*:*:*:*:*","matchCriteriaId":"648ED714-9CF1-44D2-8360-D40708EA2ABB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:aqt1000_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EC6FCE91-BF38-49ED-8FFB-429BAFEE7832"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:aqt1000:-:*:*:*:*:*:*:*","matchCriteriaId":"715A9F94-5F9E-45E5-B07B-699410C01478"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:ar8031_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FCE1ADA9-8042-4CDE-A2B9-E96665CB41BE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:ar8031:-:*:*:*:*:*:*:*","matchCriteriaId":"BB1DE046-DD70-4ACA-9DF4-59939DAC1889"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:c-v2x_9150_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4A725088-FC3B-4439-9189-72AA10954721"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:c-v2x_9150:-:*:*:*:*:*:*:*","matchCriteriaId":"B80D6366-4C0C-4C0D-9A38-769C66D62F0F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:csra6620_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FA42F2EA-5D00-42B8-B020-C27675B72915"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:csra6620:-:*:*:*:*:*:*:*","matchCriteriaId":"BFCF207D-B8C8-4860-89C7-673C821F0237"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:csra6640_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A8A35ECF-B12E-42DE-A74B-2C3BE03639A4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:csra6640:-:*:*:*:*:*:*:*","matchCriteriaId":"65B283D6-B2D2-49B6-98A8-08EDB54C1F15"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:csrb31024_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1EBF42F8-50BA-4172-A3A0-7FD1BA4B3ED3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:csrb31024:-:*:*:*:*:*:*:*","matchCriteriaId":"770F3924-BE27-4BDE-B922-680B3C9753EB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6200_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CDE1CBDE-3D28-463C-B215-AA7DF373EF09"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6200:-:*:*:*:*:*:*:*","matchCriteriaId":"66BD3B88-7CF9-482D-A2DD-67F6ACF4CC57"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6700_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"82B82E87-F3F4-466F-A76B-C8809121FF6F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6700:-:*:*:*:*:*:*:*","matchCriteriaId":"419A132E-E42C-4395-B74B-788A39DF1D13"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6800_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D89F035A-2388-48FC-AEBB-8429C6880F4A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6800:-:*:*:*:*:*:*:*","matchCriteriaId":"CA13EF4E-AAE6-45F4-9E41-78310E37CE81"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6900_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E670F500-9B71-4BBE-B5DA-221D35803C89"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6900:-:*:*:*:*:*:*:*","matchCriteriaId":"9ADEB5C5-B79A-4F45-B7D3-75945B38DB6C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_7800_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B3053D68-C5D8-4D47-A4F0-9F3AF2289E1D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_7800:-:*:*:*:*:*:*:*","matchCriteriaId":"638DBC7F-456F-487D-BED2-2214DFF8BEE2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:flight_rb5_5g_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AD36089F-92DF-49EC-9C6F-4300E4903CB2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:flight_rb5_5g_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"D19A754C-6900-4436-916D-F5361E0BC324"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fsm100_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4FCC7277-ECF0-4AEC-A0AF-85976EAB0F5A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fsm100_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"7AF97AB0-7691-4D66-801A-00311B259BE4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:g1_gen_1_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0556CCE6-B61B-4DE7-AD4B-333414280DF8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:g1_gen_1:-:*:*:*:*:*:*:*","matchCriteriaId":"CC734495-D935-40CC-9644-477E921F3EE0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:g2_gen_1_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"924DFF0F-E8B2-4B94-9B98-E0C2D6313C87"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:g2_gen_1:-:*:*:*:*:*:*:*","matchCriteriaId":"2A5E644B-D05F-4241-8E20-4A6DA1A56695"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:g3x_gen_2_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C167BE19-999E-4538-A23E-01F9C287A6C7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:g3x_gen_2:-:*:*:*:*:*:*:*","matchCriteriaId":"1026CB5F-E30A-42DE-8432-74412CC8BA00"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iq-615_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D2B2D5D-0213-4979-ACBF-BEF843166047"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iq-615:-:*:*:*:*:*:*:*","matchCriteriaId":"CE575B0C-DDE4-4E5A-9FE8-03305C804558"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iq-8275_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"253BF0D2-D24D-4EE3-A157-9853BBB368F2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iq-8275:-:*:*:*:*:*:*:*","matchCriteriaId":"78C6B840-62E9-4DDD-9376-2F7A8FB9D589"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iq-9075_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"08431A88-C176-48BB-918C-DF3FEABE78D4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iq-9075:-:*:*:*:*:*:*:*","matchCriteriaId":"3C50A35E-023A-404D-BFBC-FFCD1F30E872"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iqx5121_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"499A2520-436C-4B12-849D-98B94088CCDE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iqx5121:-:*:*:*:*:*:*:*","matchCriteriaId":"4C34A825-C928-4F8F-B076-19F8787A3440"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iqx7181_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F58C10B5-2BB1-4A8F-AF4B-2EC791C9FBBE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iqx7181:-:*:*:*:*:*:*:*","matchCriteriaId":"9EE22328-BBF8-473C-8F89-58AEF8CC9D75"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:mbm415_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"06917C11-6ABA-4972-A4A5-AEA69A5E73FE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:mbm415:-:*:*:*:*:*:*:*","matchCriteriaId":"9B1C6B87-2B59-4220-BC0D-7CE30F514728"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:monaco_iot_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D071BA3E-36AE-40E5-88FB-04012ABECBD2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:monaco_iot:-:*:*:*:*:*:*:*","matchCriteriaId":"F9FB6B54-7F16-497D-B211-327744F35ECB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:netrani_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9C52A53B-1182-47F3-9800-D8C58F954277"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:netrani:-:*:*:*:*:*:*:*","matchCriteriaId":"BEC1F084-78C8-4413-940A-47E9554CB6D0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca0000_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CC941093-1A7C-47B2-AB3B-05AE4AE2FBE4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca0000:-:*:*:*:*:*:*:*","matchCriteriaId":"7A2AA834-C17C-4E0E-A510-795818041E47"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca2066_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6366F2ED-C6B7-4579-B304-C5B6DF951EB4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca2066:-:*:*:*:*:*:*:*","matchCriteriaId":"09B688AF-E1A4-496C-924C-D6B725CBBE26"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca4004_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DFB39496-8699-4DAF-BD7B-AE69260B20CB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca4004:-:*:*:*:*:*:*:*","matchCriteriaId":"E9CFBC24-5F15-40DE-806E-62C1EE808992"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6391_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"83B53119-1B2F-4978-B7F5-33B84BE73B68"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6391:-:*:*:*:*:*:*:*","matchCriteriaId":"6FEBC0C5-CAA1-475C-96C2-B8D24B2E4536"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6420_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7E16994A-6DBA-426C-ADD2-B1E8B49FEDBF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6420:-:*:*:*:*:*:*:*","matchCriteriaId":"47E674DE-55AB-44E5-8E00-C804FC9D4DC0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6430_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"95AFC483-1468-43FC-96FA-A56165C290E0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6430:-:*:*:*:*:*:*:*","matchCriteriaId":"0A963FDF-6FF4-4F48-834E-2A14D241716D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6564_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00FE294D-4BE0-4436-9273-507E760884EC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6564:-:*:*:*:*:*:*:*","matchCriteriaId":"424CB795-58E5-43A4-A2EC-C563D93C5E72"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6564a_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"886124F6-B397-4EB6-8E01-6012E468ABE9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6564a:-:*:*:*:*:*:*:*","matchCriteriaId":"93ED74CE-6BF2-4983-8780-07D5336745B3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6564au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B59672A0-2FA6-46CC-B75A-C599B842AFB9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6564au:-:*:*:*:*:*:*:*","matchCriteriaId":"3847F4A5-90A5-4C84-B43F-0DDD81BD79CE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6574_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9B828AC8-4A01-4537-B2BD-8180C99F5C32"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6574:-:*:*:*:*:*:*:*","matchCriteriaId":"66C16E1E-9D4A-4F20-B697-833FDCCA86FB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6574a_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"828CFB37-76A6-4927-9D00-AF9A1C432DD6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6574a:-:*:*:*:*:*:*:*","matchCriteriaId":"11405993-5903-4716-B452-370281034B42"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6574au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D527E2B1-2A46-4FBA-9F7A-F5543677C8FB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6574au:-:*:*:*:*:*:*:*","matchCriteriaId":"8374DDB3-D484-4141-AE0C-42333D2721F6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6595_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"643EC76D-2836-48E6-81DA-78C4883C33CA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6595:-:*:*:*:*:*:*:*","matchCriteriaId":"477F6529-4CE1-44FC-B6EE-D24D44C71AE7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6595au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"288F637F-22F8-47CF-B67F-C798A730A1BD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6595au:-:*:*:*:*:*:*:*","matchCriteriaId":"D0996EA3-1C92-4933-BE34-9CF625E59FE7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6688aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AFBD264F-F24A-4CDD-B316-9514A61B91E7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6688aq:-:*:*:*:*:*:*:*","matchCriteriaId":"94CC5BC4-011D-4D2B-8891-97FBF61FD783"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6696_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0AE207DB-9770-40ED-961D-FDA75965826F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6696:-:*:*:*:*:*:*:*","matchCriteriaId":"0E23922D-C37F-476F-A623-4C1458A9156F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6698aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5FA1F8F4-EAF2-4704-A8A6-19AD3CA1B577"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6698aq:-:*:*:*:*:*:*:*","matchCriteriaId":"B3F7853D-09EE-476F-B48D-BB30AEB4A67D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8845h_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB7CF473-8B25-4851-91F2-1BD693CCDC85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8845h:-:*:*:*:*:*:*:*","matchCriteriaId":"91E591F2-8F72-4A5A-9264-2742EB2DABDA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6450p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEE752CE-2121-477E-A1C9-6A05DF36DFA9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6450p:-:*:*:*:*:*:*:*","matchCriteriaId":"DCA019DB-C24E-4C2B-B4E4-95F61E038FEA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6475p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E32FAA6A-E882-4978-B748-5617BE33F347"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6475p:-:*:*:*:*:*:*:*","matchCriteriaId":"FFFCBBD0-3F52-446F-9A6B-2D138463AB80"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6475q_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03B375DA-4A46-4BC6-B873-99538D53DFBD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6475q:-:*:*:*:*:*:*:*","matchCriteriaId":"ACEA2D75-14DB-4F87-8F3C-A6E9436ECA97"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7325p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4BEC725F-19B1-4078-B13D-CE624BE23344"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7325p:-:*:*:*:*:*:*:*","matchCriteriaId":"4EA43E38-A12D-49C3-B05C-A2AF07ED2710"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7435_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F7A95A9E-617A-4D3A-9A4E-0C0A29B3C8B5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7435:-:*:*:*:*:*:*:*","matchCriteriaId":"3559292E-B5A6-4F88-BC20-F6AA85F07C97"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7435p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"55C65D26-71D7-4840-B8B1-7C5EC69EB320"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7435p:-:*:*:*:*:*:*:*","matchCriteriaId":"B322FB35-2415-45EA-A350-746AFF734ACD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7525_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2410FF59-E0C0-4920-9656-C398DB06DEAE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7525:-:*:*:*:*:*:*:*","matchCriteriaId":"7D2B800C-4DBC-4028-875D-667C87D75247"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7550_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EEA5CE41-0596-4D38-9891-D1DF711EA7E9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7550:-:*:*:*:*:*:*:*","matchCriteriaId":"E1A901C6-FB73-4361-B391-4A4AF8C70029"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7550p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5C5D7E2C-0955-4B6E-96E4-CFA06D937492"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7550p:-:*:*:*:*:*:*:*","matchCriteriaId":"9D1D0F33-AD5A-4826-9A06-EAD2A8709974"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7635p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3A72DAA5-E10F-40A0-A8CC-541594A3279F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7635p:-:*:*:*:*:*:*:*","matchCriteriaId":"15CC657A-7623-4F37-AC52-8AF5C83D5BDA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8475p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8DBF6AE8-605B-4E72-BD3B-0B6C390FCE32"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8475p:-:*:*:*:*:*:*:*","matchCriteriaId":"26AAE148-96B6-4FDE-BABD-48F607464A38"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8550p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C4CDD6A2-5A3C-4572-8CE1-2F102333BB79"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8550p:-:*:*:*:*:*:*:*","matchCriteriaId":"699E5D17-6144-4F0A-8D52-1E8C83990E52"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:smart_audio_400_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"57B0086F-5F2C-4F89-AC53-D8429D6506CD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:smart_audio_400_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"FB8145C8-D978-4047-9203-602E854E7290"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_4_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2CCBF666-CB4E-44E1-9676-6891EDC73578"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_4_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"C767AB6A-1A8C-406C-A600-96A816F44E2F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_4_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"55AECCCF-0761-46B6-B669-E73096679AFB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_4_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"7DE87CA2-160A-43BF-AC18-DA788501B5B4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_460_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"390D7CAF-6C0B-4438-AA7D-AEEE127F4D3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_460_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"5BB1FC5E-CF6F-4E54-B78D-C01AFD034903"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_480_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA3F11F3-C9F4-460D-BD77-1BFBCC1F0592"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_480_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"25673A10-D99C-4F67-BDA7-9C2E4A70EF9C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_480\\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"50906EF2-01F7-4E97-9F49-F892DF41CB29"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_480\\+_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"B23A89FF-9C94-40C6-B9B7-3E8354777916"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_6_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EBB3BC1B-2EBC-457C-AE91-6BD408EB7D5F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_6_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"0870CC30-07F8-4FFF-85B4-FBACE947CC14"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_6_gen_3_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D69E4203-EA20-4D6F-BD1C-C8E550588F87"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_6_gen_3_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"C1225010-5A08-4D13-A3E2-4C57C4265605"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_680_4g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8D0ED00F-1345-43AD-83C6-E979890B84AB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_680_4g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"92C28019-B57D-4487-B551-F7B53395C6E5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_685_4g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C174F07D-0E33-43FD-9BAD-6C6D8B51B6A6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_685_4g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"47311B68-A07F-448B-99D5-9C92C8127A81"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_695_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A9A2DA11-5E4E-4E36-923C-A2D3CC2F2751"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_695_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"BE7DFAD4-1D21-4A3A-9E8C-10F00AD7C403"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"677D5A3F-2A0D-48F0-A1C5-B067BADFD11A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"CB79B015-A401-4FAD-8818-1475653C2B12"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7\\+_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C8E41CBD-D6AD-41CF-A469-92A7E228BBB6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7\\+_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"57E0BA08-3BF4-4E84-BBA9-B48F84197F9D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_778g_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"87ECCB82-B880-412D-A635-CA6F0B035F2B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_778g_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"424743C4-CE74-4A02-835A-023C9DA0CFAC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_778g\\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14EA48BF-BD65-43B2-8DC1-D97F75AD6FE5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_778g\\+_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"B86E317F-12BF-42F6-879B-88A85F7E3F81"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_782g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"194A4BD4-0DDF-49E5-AA89-40A5BFB71933"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_782g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"72FF9732-40D8-4C12-8259-BAA16FAB5A56"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7c_compute_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"65B3644E-74B5-41BB-BA43-F3E588D152CE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7c_compute_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"75F10C87-25C4-40A5-9B7E-904C2258CB3C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7c_gen_2_compute_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EC68355A-3202-4317-9767-26AFDD321789"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7c_gen_2_compute_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"AF331899-4AA1-4D55-B494-4FA47BB97AE5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7c\\+_gen_3_compute_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C4A050CA-8514-400A-A6B3-F513CC93CA14"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7c\\+_gen_3_compute:-:*:*:*:*:*:*:*","matchCriteriaId":"BD850305-1E76-4952-A3FB-F6229CBF7FE9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EB8FA32F-4690-4C5B-8968-474DA32FD0A4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"59BD8BEA-725A-4158-84BE-4AFD476ED03D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"60F5899C-BA8D-4B6B-BC61-F77B1EB64739"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"D39AD7CE-A017-4D74-A348-9E4B08363799"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8\\+_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"59CB6F2F-7C95-498B-9F9E-728930FD24A7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8\\+_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"284E62AF-2E4D-4E82-AC9A-F27DA71735EF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8\\+_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1FEDF458-DEA7-42A1-A56D-E11250139545"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8\\+_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"D5693438-0F20-47BB-BA32-7175C3152368"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_865\\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22303AD4-779C-45A3-8F33-3864C45E4328"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_865\\+_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"B8EC440D-D420-4477-8F14-427245B80631"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_870_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"41446A77-6EF3-4570-BAD2-4C761A2C4E7F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_870_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"448C401B-EF07-4385-A7B4-123D7808F64F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_888_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22A78236-5965-4F65-9001-3FE7FF6D27E8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_888_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"414C5C1D-A5DA-47C7-B6C9-3564DD4DD911"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_888\\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"01CBD543-635C-4C57-87B7-55DD3BA3C1A2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_888\\+_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"6A7272B6-AADB-4CCD-B041-66170C313C76"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8c_compute_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DC63E59F-CB68-435C-B1A4-7DA5D722142F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8c_compute_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"088D62A3-1FE5-42D6-9231-41DDE4DA37EF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8c_compute_platform_\\(sc8180xp-ad\\)_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E81ADBDE-BC6C-4FA2-B33F-553A8E42BB9F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8c_compute_platform_\\(sc8180xp-ad\\):-:*:*:*:*:*:*:*","matchCriteriaId":"F7A79274-E042-47F0-82C1-F3FFEF0BC058"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8cx_compute_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"36903AF3-4E2D-4990-B021-A1D980229077"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8cx_compute_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"472928D4-90F4-402D-B1F2-0CE358326A10"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8cx_compute_platform_\\\"poipu_pro\\\"_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C0D26DE7-964B-4B01-90E1-1D1E87522940"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8cx_compute_platform_\\\"poipu_pro\\\":-:*:*:*:*:*:*:*","matchCriteriaId":"651EE0A5-D583-4D99-89B0-A81A51EAF46B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8cx_gen_2_5g_compute_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C7ACDB5B-A32C-43A1-9086-D081E9FFF9AA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8cx_gen_2_5g_compute_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"583E50CC-2017-4092-A21E-7AAC53F53A25"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8cx_gen_2_5g_compute_platform_\\\"poipu_pro\\\"_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"969BA39F-1068-49F3-8EF2-A5F64C5A57DA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8cx_gen_2_5g_compute_platform_\\\"poipu_pro\\\":-:*:*:*:*:*:*:*","matchCriteriaId":"A7A57DE6-615E-45C5-9CCD-2A12905EC368"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_auto_5g_modem-rf_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"88AF39A5-F44E-4B14-AA6E-4F80D9EEB017"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_auto_5g_modem-rf:-:*:*:*:*:*:*:*","matchCriteriaId":"2A25FE8F-555A-4D85-8A94-A808B62EAE86"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_wear_1300_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5A402233-B76F-41D5-B7C2-325C8FC4D560"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_wear_1300_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"C8643194-C881-408A-AAA1-78572075120A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_x53_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4F80E77B-B207-4E49-99EF-A1F9ECFAAC99"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_x53_5g_modem-rf_system:-:*:*:*:*:*:*:*","matchCriteriaId":"9A12A6DC-63A2-4B52-971A-C014E40C1E6D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_x55_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AAFF2095-4257-40C9-8C48-B38C143159ED"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_x55_5g_modem-rf_system:-:*:*:*:*:*:*:*","matchCriteriaId":"7FEA2F1D-7D07-4684-BDC1-24224A53A8BC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_xr2_5g_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1A129620-8241-4A47-AAC8-CC7E10A09C9C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_xr2_5g_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"4CEDD78E-124C-4216-9B57-3B7B53463659"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_xr2\\+_gen_1_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BF9740EB-F82E-42EA-993E-A393B05CC6BB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_xr2\\+_gen_1_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"022A5532-03F7-4FB8-BA0D-4221178C9486"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_auto_4g_modem_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3C8F12FE-0057-4A13-9A7F-D12C114ECEF9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_auto_4g_modem:-:*:*:*:*:*:*:*","matchCriteriaId":"1271B0C7-2D91-4129-9B58-E6689DD68C39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:vision_intelligence_400_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6E685A5C-870C-41E9-91AA-7AA7535C4D85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:vision_intelligence_400_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"D8F52FE7-2C9C-4908-A578-2230ED6A1505"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9306_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FC012AD0-BCEE-4B1E-9B15-5D77D78CEA01"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9306:-:*:*:*:*:*:*:*","matchCriteriaId":"F51C69B9-F0AB-4BF5-A8C2-64FEB7075593"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9335_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"28717583-463A-468A-8073-ECF0F90585F6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9335:-:*:*:*:*:*:*:*","matchCriteriaId":"4D1A7188-7D5D-4D46-AEAB-08BA84FFF539"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9340_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8BA28CC6-C8BB-4F50-BFE3-A59F664A4F54"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9340:-:*:*:*:*:*:*:*","matchCriteriaId":"94D2BDF1-764C-48BA-8944-3275E8768078"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9341_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CE852339-1CAE-4983-9757-8F00EDEF1141"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9341:-:*:*:*:*:*:*:*","matchCriteriaId":"4D9E96B3-F1BB-46F8-B715-7DF90180F1E1"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9360_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C4D6C6B2-36DC-4D0D-AFF8-2108A090A78D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9360:-:*:*:*:*:*:*:*","matchCriteriaId":"28FEB3B1-F641-436D-AC4F-3304C37167C4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9370_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1295D869-F4DD-4766-B4AA-3513752F43B4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9370:-:*:*:*:*:*:*:*","matchCriteriaId":"B98784DC-3143-4D38-AD28-DBBDCCAB4272"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9371_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2503805B-B2A6-4AEE-8AB1-2B8A040702BD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9371:-:*:*:*:*:*:*:*","matchCriteriaId":"D3AD370C-2ED0-43CF-83D9-50DC92A01CA5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9375_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"34143ABA-7D09-429F-A65C-3A33438BF62C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9375:-:*:*:*:*:*:*:*","matchCriteriaId":"9D56DFE3-5EF1-4B23-BBD5-0203FBF9CCEC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9378_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4CFDBB5B-0A4F-4032-874F-D2A7EF933FB0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9378:-:*:*:*:*:*:*:*","matchCriteriaId":"D28A12D6-CC60-4BE9-ADEE-FAB58B05440F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"70292B01-617F-44AD-AF77-1AFC1450523D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9380:-:*:*:*:*:*:*:*","matchCriteriaId":"FA94C6D6-85DB-4031-AAF4-C399019AE16D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"92B17201-8185-47F1-9720-5AB4ECD11B22"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9385:-:*:*:*:*:*:*:*","matchCriteriaId":"E1FA2EB9-416F-4D69-8786-386CC73978AE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9390_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"896F1C04-9957-440F-BF01-C3772CC3B3DF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9390:-:*:*:*:*:*:*:*","matchCriteriaId":"A90555EB-47A7-4717-92D5-35B561825F06"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9395_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"699056F6-1517-4F25-AE07-4FFCF6923B9F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9395:-:*:*:*:*:*:*:*","matchCriteriaId":"E4C023D2-6FF5-4FFC-B9F2-895979166580"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3910_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9F0D7B24-D567-479A-B4F1-595FAA053418"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3910:-:*:*:*:*:*:*:*","matchCriteriaId":"33A8FAA1-F824-4561-9CCC-7F0DF12F740F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3950_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3FEF2DB6-00F5-4B07-953B-EF58B31267F1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3950:-:*:*:*:*:*:*:*","matchCriteriaId":"120E8F0F-EBEB-4565-9927-2D473F783EF7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3980_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9C6E9038-9B18-4958-BE1E-215901C9B4B2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3980:-:*:*:*:*:*:*:*","matchCriteriaId":"B36D3274-F8D0-49C5-A6D5-95F5DC6D1950"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4BFB25F-013B-48E3-99FF-3E8687F94423"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3988:-:*:*:*:*:*:*:*","matchCriteriaId":"BF676C5B-838B-446C-A689-6A25AB8A87E2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3990_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2744A053-5BD9-45A9-A2FC-791BCA0CCD4C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3990:-:*:*:*:*:*:*:*","matchCriteriaId":"D5F28E29-520F-469E-B048-62DE2EF07ADD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn6650_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"93398092-AF7C-4F04-874C-7E5B4CF7AB00"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn6650:-:*:*:*:*:*:*:*","matchCriteriaId":"7D242084-5844-4E43-8D7F-D2F8E3521F0C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn6755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2BC386D9-3D2B-40FA-A2D9-199BB138F46A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn6755:-:*:*:*:*:*:*:*","matchCriteriaId":"133FFD9F-FA09-4801-939B-AD1D507BE5FE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8810_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"15307882-7039-43E9-9BA3-035045988B99"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8810:-:*:*:*:*:*:*:*","matchCriteriaId":"AA85B322-E593-4499-829A-CC6D70BAE884"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E839A0B9-64C3-4C7A-82B7-D2AAF65928F8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8815:-:*:*:*:*:*:*:*","matchCriteriaId":"7E870D82-DE3B-4199-A730-C8FB545BAA98"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8830_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"11B69595-E488-4590-A150-CE5BE08B5E13"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8830:-:*:*:*:*:*:*:*","matchCriteriaId":"BF680174-5FA6-47D9-8EAB-CC2A37A7BD42"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8832_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7ACAD26E-B79E-4659-91A5-D301281F7D36"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8832:-:*:*:*:*:*:*:*","matchCriteriaId":"F0E46DA6-9494-4D92-A4AE-A272AF6ACCCC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F80BC68E-7476-4A40-9F48-53722FE9A5BF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8835:-:*:*:*:*:*:*:*","matchCriteriaId":"6B36F4B2-BAA3-45AD-9967-0EB482C99708"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8840_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA33DE15-C177-43B3-AD50-FF797753D12E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8840:-:*:*:*:*:*:*:*","matchCriteriaId":"AE1A5841-5BCB-4033-ACB9-23F3FCA65309"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8845_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5B47BF35-3AA0-4667-842E-19B0FE30BF3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8845:-:*:*:*:*:*:*:*","matchCriteriaId":"8A071672-9405-4418-9141-35CEADBB65AF"}]}]}],"references":[{"url":"https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2026-bulletin.html","source":"product-security@qualcomm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-25269","sourceIdentifier":"product-security@qualcomm.com","published":"2026-10-06T07:16:57.207","lastModified":"2026-10-09T14:10:36.473","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Memory corruption when processing camera requests with excessive batch and IO buffer configurations exceeds allocated memory size."}],"affected":[{"source":"product-security@qualcomm.com","affectedData":[{"vendor":"Qualcomm, Inc.","product":"Snapdragon","defaultStatus":"unaffected","platforms":["Snapdragon Auto","Snapdragon CCW","Snapdragon Compute","Snapdragon Consumer IOT","Snapdragon Industrial IOT","Snapdragon Mobile","Snapdragon WBC"],"versions":[{"version":"Cologne","status":"affected"},{"version":"CQ7790","status":"affected"},{"version":"CQ8725S","status":"affected"},{"version":"CQ8750M","status":"affected"},{"version":"FastConnect 6700","status":"affected"},{"version":"FastConnect 6900","status":"affected"},{"version":"FastConnect 7800","status":"affected"},{"version":"IQ10 Series","status":"affected"},{"version":"IQ6 Series Platform","status":"affected"},{"version":"IQ8 Series Platform","status":"affected"},{"version":"IQ9 Series Platform","status":"affected"},{"version":"LeMans_AU_LGIT","status":"affected"},{"version":"LeMansAU","status":"affected"},{"version":"MBM715","status":"affected"},{"version":"Milos","status":"affected"},{"version":"Monaco_IOT","status":"affected"},{"version":"Orne","status":"affected"},{"version":"Palawan25","status":"affected"},{"version":"Pandeiro","status":"affected"},{"version":"QAM8255P","status":"affected"},{"version":"QAMSRV1H","status":"affected"},{"version":"QAMSRV1M","status":"affected"},{"version":"QCA6391","status":"affected"},{"version":"QCA6595","status":"affected"},{"version":"QCA6595AU","status":"affected"},{"version":"QCA6678AQ","status":"affected"},{"version":"QCA6698AQ","status":"affected"},{"version":"QCA6698AU","status":"affected"},{"version":"QCA6797AQ","status":"affected"},{"version":"QCA8695AU","status":"affected"},{"version":"QCM5430","status":"affected"},{"version":"QCM6490","status":"affected"},{"version":"QCM8550","status":"affected"},{"version":"QCM8838","status":"affected"},{"version":"QCN9011","status":"affected"},{"version":"QCN9012","status":"affected"},{"version":"QCN9274","status":"affected"},{"version":"QCS8550","status":"affected"},{"version":"QLN1083BD","status":"affected"},{"version":"QLN1086BD","status":"affected"},{"version":"QMP1000","status":"affected"},{"version":"QPA1083BD","status":"affected"},{"version":"QPA1086BD","status":"affected"},{"version":"Qualcomm Dragonwing Q-6690","status":"affected"},{"version":"Qualcomm Dragonwing Q-7790","status":"affected"},{"version":"Qualcomm Dragonwing Q-8845","status":"affected"},{"version":"Qualcomm Dragonwing QCM4490","status":"affected"},{"version":"Qualcomm Video Collaboration VC3 Platform","status":"affected"},{"version":"QXM1083","status":"affected"},{"version":"QXM1086","status":"affected"},{"version":"QXM1093","status":"affected"},{"version":"QXM1094","status":"affected"},{"version":"QXM1095","status":"affected"},{"version":"QXM1096","status":"affected"},{"version":"SA7255P","status":"affected"},{"version":"SA7775P","status":"affected"},{"version":"SA8255P","status":"affected"},{"version":"SA8620P","status":"affected"},{"version":"SA8770P","status":"affected"},{"version":"SA9000P","status":"affected"},{"version":"SAR1165P","status":"affected"},{"version":"SAR2130P","status":"affected"},{"version":"SC8380XP","status":"affected"},{"version":"SD 8 Gen1 5G","status":"affected"},{"version":"SD865 5G","status":"affected"},{"version":"SDR753","status":"affected"},{"version":"SM6650P","status":"affected"},{"version":"SM7635P","status":"affected"},{"version":"SM7675","status":"affected"},{"version":"SM7675P","status":"affected"},{"version":"SM8550P","status":"affected"},{"version":"SM8635","status":"affected"},{"version":"SM8635P","status":"affected"},{"version":"SM8650Q","status":"affected"},{"version":"SM8750P","status":"affected"},{"version":"Snapdragon 4 Gen 2 Mobile Platform","status":"affected"},{"version":"Snapdragon 6 Gen 4 Mobile Platform","status":"affected"},{"version":"Snapdragon 7 Gen 4 Mobile Platform","status":"affected"},{"version":"Snapdragon 7s Gen 3 Mobile Platform","status":"affected"},{"version":"Snapdragon 8 Elite","status":"affected"},{"version":"Snapdragon 8 Elite Gen 5","status":"affected"},{"version":"Snapdragon 8 Gen 1 Mobile Platform","status":"affected"},{"version":"Snapdragon 8 Gen 2 Mobile Platform","status":"affected"},{"version":"Snapdragon 8 Gen 3 Mobile Platform","status":"affected"},{"version":"Snapdragon 8+ Gen 1 Mobile Platform","status":"affected"},{"version":"Snapdragon 8+ Gen 2 Mobile Platform","status":"affected"},{"version":"Snapdragon AR1 Gen 1 Platform","status":"affected"},{"version":"Snapdragon AR1+ Gen 1 Platform","status":"affected"},{"version":"Snapdragon Ride Elite","status":"affected"},{"version":"Snapdragon XR2 5G Platform","status":"affected"},{"version":"Snapdragon XR2+ Gen 1 Platform","status":"affected"},{"version":"Snapdragon Cockpit Elite","status":"affected"},{"version":"Snapdragon Reality Elite Platform","status":"affected"},{"version":"SRV1H","status":"affected"},{"version":"SRV1M","status":"affected"},{"version":"SW-only","status":"affected"},{"version":"SXR2230P","status":"affected"},{"version":"SXR2250P","status":"affected"},{"version":"TalynPlus","status":"affected"},{"version":"WCD9370","status":"affected"},{"version":"WCD9375","status":"affected"},{"version":"WCD9378","status":"affected"},{"version":"WCD9380","status":"affected"},{"version":"WCD9385","status":"affected"},{"version":"WCD9390","status":"affected"},{"version":"WCD9395","status":"affected"},{"version":"WCN3950","status":"affected"},{"version":"WCN3988","status":"affected"},{"version":"WCN6450","status":"affected"},{"version":"WCN6650","status":"affected"},{"version":"WCN6755","status":"affected"},{"version":"WCN7860","status":"affected"},{"version":"WCN7861","status":"affected"},{"version":"WCN7880","status":"affected"},{"version":"WCN7881","status":"affected"},{"version":"WSA8810","status":"affected"},{"version":"WSA8815","status":"affected"},{"version":"WSA8830","status":"affected"},{"version":"WSA8832","status":"affected"},{"version":"WSA8835","status":"affected"},{"version":"WSA8840","status":"affected"},{"version":"WSA8845","status":"affected"},{"version":"WSA8845H","status":"affected"},{"version":"X1E80100","status":"affected"},{"version":"XRV7209","status":"affected"},{"version":"XRV9209","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"product-security@qualcomm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-25269","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"product-security@qualcomm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_g1_gen_2_gaming_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"905C9267-C1B5-4A77-BC33-118986A907C7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_g1_gen_2_gaming_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"671C9107-7E54-4FBC-B03D-1EB4DCD8597E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cologne_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8FF959C0-5AAB-4DC5-AE8F-4EFA21A00B5E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cologne:-:*:*:*:*:*:*:*","matchCriteriaId":"E31E0C48-FB61-47C8-B28B-3A701E85E126"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq2390m_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8DAB4A10-45A2-47B2-AAED-46DCC9740396"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq2390m:-:*:*:*:*:*:*:*","matchCriteriaId":"F793F65B-324E-416A-B9CD-0496F5E9CB8C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq2390s_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B0928CC-C507-4437-946B-B2AD400E9B3E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq2390s:-:*:*:*:*:*:*:*","matchCriteriaId":"E6FAF059-0D17-40DD-B0DA-A708081F6062"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq8750m_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23301B23-E3B8-4FFA-BC7A-33FDDEEDC425"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq8750m:-:*:*:*:*:*:*:*","matchCriteriaId":"F05B2437-B6C0-41C4-818E-12AFE616D790"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq8845s_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4FB1D261-4C1B-4D43-B8ED-975E526A2FF5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq8845s:-:*:*:*:*:*:*:*","matchCriteriaId":"54AC5C16-88A9-4C16-B7AF-835E53D7DFA4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq8850ns_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"867A0C11-FBA0-46F1-871F-1800A7A75BB3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq8850ns:-:*:*:*:*:*:*:*","matchCriteriaId":"9885533F-4021-429D-917F-0A2733725B43"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6200_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CDE1CBDE-3D28-463C-B215-AA7DF373EF09"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6200:-:*:*:*:*:*:*:*","matchCriteriaId":"66BD3B88-7CF9-482D-A2DD-67F6ACF4CC57"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6700_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"82B82E87-F3F4-466F-A76B-C8809121FF6F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6700:-:*:*:*:*:*:*:*","matchCriteriaId":"419A132E-E42C-4395-B74B-788A39DF1D13"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6900_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E670F500-9B71-4BBE-B5DA-221D35803C89"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6900:-:*:*:*:*:*:*:*","matchCriteriaId":"9ADEB5C5-B79A-4F45-B7D3-75945B38DB6C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_7800_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B3053D68-C5D8-4D47-A4F0-9F3AF2289E1D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_7800:-:*:*:*:*:*:*:*","matchCriteriaId":"638DBC7F-456F-487D-BED2-2214DFF8BEE2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:g2_gen_1_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"924DFF0F-E8B2-4B94-9B98-E0C2D6313C87"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:g2_gen_1:-:*:*:*:*:*:*:*","matchCriteriaId":"2A5E644B-D05F-4241-8E20-4A6DA1A56695"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:g3x_gen_2_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C167BE19-999E-4538-A23E-01F9C287A6C7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:g3x_gen_2:-:*:*:*:*:*:*:*","matchCriteriaId":"1026CB5F-E30A-42DE-8432-74412CC8BA00"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iq-615_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D2B2D5D-0213-4979-ACBF-BEF843166047"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iq-615:-:*:*:*:*:*:*:*","matchCriteriaId":"CE575B0C-DDE4-4E5A-9FE8-03305C804558"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iq-8275_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"253BF0D2-D24D-4EE3-A157-9853BBB368F2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iq-8275:-:*:*:*:*:*:*:*","matchCriteriaId":"78C6B840-62E9-4DDD-9376-2F7A8FB9D589"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iq-9075_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"08431A88-C176-48BB-918C-DF3FEABE78D4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iq-9075:-:*:*:*:*:*:*:*","matchCriteriaId":"3C50A35E-023A-404D-BFBC-FFCD1F30E872"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:lemans_au_lgit_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5767FE95-737F-4C20-A5AB-EC641A68D906"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:lemans_au_lgit:-:*:*:*:*:*:*:*","matchCriteriaId":"33323A49-9267-421B-96E1-80C5FA709EBC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:lemansau_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2DF0ED3F-C98B-458E-ADCC-C922402BB185"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:lemansau:-:*:*:*:*:*:*:*","matchCriteriaId":"102A4B5E-1739-4C31-A626-ABF6B02FEE29"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:mbm715_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F9E2ED64-0268-4C88-9553-D6EF646C3BA1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:mbm715:-:*:*:*:*:*:*:*","matchCriteriaId":"861D5B95-47E1-4374-9EF6-157516FF5171"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:milos_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22EFC07D-16C3-4CCC-A928-EA5EA69CAB65"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:milos:-:*:*:*:*:*:*:*","matchCriteriaId":"0D3491C1-A427-4CEC-B8BD-6A1930E6827F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:milos_iot_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"18471E2B-412C-4D07-9997-C8663902D7B5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:milos_iot:-:*:*:*:*:*:*:*","matchCriteriaId":"0284E269-A212-4474-AE46-255D5245096F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:monaco_iot_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D071BA3E-36AE-40E5-88FB-04012ABECBD2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:monaco_iot:-:*:*:*:*:*:*:*","matchCriteriaId":"F9FB6B54-7F16-497D-B211-327744F35ECB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:netrani_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9C52A53B-1182-47F3-9800-D8C58F954277"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:netrani:-:*:*:*:*:*:*:*","matchCriteriaId":"BEC1F084-78C8-4413-940A-47E9554CB6D0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:orne_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"19FB8345-BBFC-4E18-A4E6-64A159D7F65B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:orne:-:*:*:*:*:*:*:*","matchCriteriaId":"FFDA4056-3F1B-4F3A-BE59-1908BD3DE5E9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:palawan25_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C18C3535-3074-41DE-B40F-F3055BAFF686"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:palawan25:-:*:*:*:*:*:*:*","matchCriteriaId":"7B590B1E-06D1-4C99-BDDF-4A086BEBB4C7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:pandeiro_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F8EF0C-BB48-47E1-A045-254D79388F75"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:pandeiro:-:*:*:*:*:*:*:*","matchCriteriaId":"058950FC-ED72-4E91-AE13-87E738ADC083"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qam8255p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3723C7B1-A7E2-401F-8D6D-189350F6BCA5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qam8255p:-:*:*:*:*:*:*:*","matchCriteriaId":"B12B89EF-7B12-481E-BCBC-F12B9D16321A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qamsrv1h_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F8673334-5E11-4E95-B33D-3029499F71DF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qamsrv1h:-:*:*:*:*:*:*:*","matchCriteriaId":"EC0B32F6-5EF0-4591-99D7-D0E9B09DEC5A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qamsrv1m_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CE03AB2A-3ED9-4489-8E5B-4FCF8BAA8559"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qamsrv1m:-:*:*:*:*:*:*:*","matchCriteriaId":"9E646738-6A87-4470-9640-6A5A1DF3AF78"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6391_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"83B53119-1B2F-4978-B7F5-33B84BE73B68"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6391:-:*:*:*:*:*:*:*","matchCriteriaId":"6FEBC0C5-CAA1-475C-96C2-B8D24B2E4536"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6595_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"643EC76D-2836-48E6-81DA-78C4883C33CA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6595:-:*:*:*:*:*:*:*","matchCriteriaId":"477F6529-4CE1-44FC-B6EE-D24D44C71AE7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6595au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"288F637F-22F8-47CF-B67F-C798A730A1BD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6595au:-:*:*:*:*:*:*:*","matchCriteriaId":"D0996EA3-1C92-4933-BE34-9CF625E59FE7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6678aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D001127D-8160-42F0-B8B9-2FAA2976B530"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6678aq:-:*:*:*:*:*:*:*","matchCriteriaId":"C9EB615F-FD4C-450B-AB25-E936FD9816C4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6698aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5FA1F8F4-EAF2-4704-A8A6-19AD3CA1B577"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6698aq:-:*:*:*:*:*:*:*","matchCriteriaId":"B3F7853D-09EE-476F-B48D-BB30AEB4A67D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6698au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3ACA09C0-84A5-493A-A9BD-EF95A8330D54"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6698au:-:*:*:*:*:*:*:*","matchCriteriaId":"3A2397BD-431C-4730-92E3-17A5C2445A65"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6797aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"797295C2-535C-46A9-A725-E1A5405F0436"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6797aq:-:*:*:*:*:*:*:*","matchCriteriaId":"8BFC575E-594E-4711-94B1-2DC8D03B9AC4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca8695au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"55A21DB0-4722-4421-8E97-B0E31B93E53B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca8695au:-:*:*:*:*:*:*:*","matchCriteriaId":"797B8944-61F0-4522-97FE-3C172369F477"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm4490_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DA506489-4338-44DF-8F92-12E60AF0048C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm4490:-:*:*:*:*:*:*:*","matchCriteriaId":"A8718C37-A82A-4A08-A887-3F22B37601A9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm5430_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4EC5F81B-AA24-4E3C-9FC8-53E010AC977E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm5430:-:*:*:*:*:*:*:*","matchCriteriaId":"B5C66DAD-0D85-46B8-92D7-6D68B9429E9A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm6490_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"ADD6D51E-5787-42A6-8A02-4EBBAFFF9C94"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm6490:-:*:*:*:*:*:*:*","matchCriteriaId":"99AA0291-B822-4CAD-BA17-81B632FC3FEF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm8838_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7C6535AE-8680-4AB9-ABF6-82DAE1795531"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm8838:-:*:*:*:*:*:*:*","matchCriteriaId":"9C3FEACB-1AE1-4BF2-9552-C31A32DCCA9B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcn9011_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9306C34D-47E4-40CF-89F4-BA5263655D13"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcn9011:-:*:*:*:*:*:*:*","matchCriteriaId":"02BA009F-24E1-4953-BA95-2A5BC1CDBDBB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcn9012_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"61F34DD2-9DC0-49E5-BC85-1543EA199477"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcn9012:-:*:*:*:*:*:*:*","matchCriteriaId":"1A06879F-6FE9-448A-8186-8347D76F872B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs4490_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3336CDD7-9E7B-4FFB-A5CE-594B19B63A6C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs4490:-:*:*:*:*:*:*:*","matchCriteriaId":"1197E229-1E27-4CA3-A386-B77FAE5DFE1A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs6690_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F8AD50C4-E725-48B8-8291-A62EF153D50A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs6690:-:*:*:*:*:*:*:*","matchCriteriaId":"4B5A7BC1-E4B1-486C-A433-D206A42A1356"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs8550_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FFF23DDB-98A0-4343-ADD3-5AB9C2383E7E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs8550:-:*:*:*:*:*:*:*","matchCriteriaId":"5ACB8AFB-5B91-4AA1-BA3A-1AF0B3503080"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qln1083bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FD70F234-1EE7-4362-97F6-5AEDB7078D03"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qln1083bd:-:*:*:*:*:*:*:*","matchCriteriaId":"C569A848-B70C-42EF-B6D5-4A86547586EE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qln1086bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F218DF06-C40A-4738-ABB5-A3FA2243EF84"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qln1086bd:-:*:*:*:*:*:*:*","matchCriteriaId":"2E2A0CD0-66FA-45D6-BBC7-03641203EC73"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qmp1000_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5298473D-8B34-42E6-BC32-69A3800972B4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qmp1000:-:*:*:*:*:*:*:*","matchCriteriaId":"2A1CF44E-FFC2-4DCB-8DC2-46422D912448"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qmp2001_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0B53AF78-37B0-4D64-A7D3-1729D0248D61"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qmp2001:-:*:*:*:*:*:*:*","matchCriteriaId":"560E36D2-27DB-4590-A879-C2071ED72641"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qna715_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7B3FD468-BE2F-4C80-843B-7EC3845F6923"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qna715:-:*:*:*:*:*:*:*","matchCriteriaId":"342A6C3B-5128-40C5-BB3B-151D5B6C7BDA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qpa1083bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B0208F7B-A959-485E-B004-A34CB7C7C4C9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qpa1083bd:-:*:*:*:*:*:*:*","matchCriteriaId":"FBDAC812-4603-4D24-A861-23825E32D44E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qpa1086bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7F6DEF72-A8FF-4B67-AA6C-5CB4AA7B35E1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qpa1086bd:-:*:*:*:*:*:*:*","matchCriteriaId":"00EF6875-B088-40BD-A526-C962789CDC5A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:video_collaboration_vc3_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DD4946C6-778F-4542-AB77-C9B86AF25C05"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:video_collaboration_vc3_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"6F1D604A-4530-42B3-80A0-58A82D658DDD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1083_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0CE74B89-5E3F-428E-8000-E3452B8B6953"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1083:-:*:*:*:*:*:*:*","matchCriteriaId":"DC11B7A6-E621-463D-B861-6B203EADFA57"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1086_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E48759CC-B751-4466-87DF-2D0AB220C0FB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1086:-:*:*:*:*:*:*:*","matchCriteriaId":"E7F1C9D2-6616-4F74-85C2-1850B5C3F6BC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1093_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9A46B609-BD06-4BB7-B055-1F71C555E93D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1093:-:*:*:*:*:*:*:*","matchCriteriaId":"59598462-1E53-4F6D-BAB5-06ACEDF6CD9F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1094_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8F30D66E-2802-4394-BC39-5E04711234FF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1094:-:*:*:*:*:*:*:*","matchCriteriaId":"078EC383-784F-4468-B94C-AE7CC9808419"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1095_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B7B67C93-0453-4696-8F3D-0AD664922C44"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1095:-:*:*:*:*:*:*:*","matchCriteriaId":"D61C46AA-9130-46A8-BD04-8B4235118B81"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1096_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2E2D5E44-48F6-41E8-A38B-A2E070E16AA9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1096:-:*:*:*:*:*:*:*","matchCriteriaId":"9BD0372F-5140-4966-9A27-6B5A606C0665"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa7255p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2B651F0A-34DA-400F-A376-B499BFDF8E86"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa7255p:-:*:*:*:*:*:*:*","matchCriteriaId":"4CFF093D-98C8-470F-8330-E5126E06343A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa7775p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6C32CA38-5D48-4108-9858-FD66E20CAF2F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa7775p:-:*:*:*:*:*:*:*","matchCriteriaId":"E1997F8B-17B8-4DE3-BCF7-726928720592"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8255p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EC6E268D-C4AF-4950-9223-39EA36D538A8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8255p:-:*:*:*:*:*:*:*","matchCriteriaId":"073C1A81-D02B-4F2F-9378-CD1B2DCE0E5B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8620p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6ACE6D64-A498-482F-8270-718F4884CFFD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8620p:-:*:*:*:*:*:*:*","matchCriteriaId":"B6E016D6-1B83-4261-A27E-1F9873F81E14"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8770p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"781CCC31-C08F-499B-BE73-6C7DB70437AF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8770p:-:*:*:*:*:*:*:*","matchCriteriaId":"75AFAA21-0589-4C6A-9418-34EE8A61BBAD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa9000p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A024AB04-B213-4018-A4C1-FA467C7BA775"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa9000p:-:*:*:*:*:*:*:*","matchCriteriaId":"A2A8AB7C-5D34-4794-8C06-2193075B323F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sar1165p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D97CD52-4CB0-4F57-9C24-530B326B8D9D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sar1165p:-:*:*:*:*:*:*:*","matchCriteriaId":"582EE932-DDE5-4BE5-837C-523FE3EFBA5D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sar2130p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"95696696-D2AE-4358-AF5D-3ED14F969964"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sar2130p:-:*:*:*:*:*:*:*","matchCriteriaId":"1A6FC469-463F-4EC1-B4EF-010BDB9BAA05"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sc8380xp_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14E3FE58-7F1C-4F5C-B62D-0CF124E14AB2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sc8380xp:-:*:*:*:*:*:*:*","matchCriteriaId":"FFCB0BBA-3F81-4FCA-B3DE-190C46DA50DB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen1_5g_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D0567B3-D81A-4EEE-868B-4DC2214C159D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen1_5g:-:*:*:*:*:*:*:*","matchCriteriaId":"76236C11-4903-4AD4-9134-3EDD3451EE43"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_865_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6C9F4285-1F09-40CD-B1AA-84B406FD6A71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_865_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"8623DD44-DFDD-442D-9789-11A527A450A4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sdr753_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A49B142B-E8DC-4A79-B969-2C2FBE2E009A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sdr753:-:*:*:*:*:*:*:*","matchCriteriaId":"8A1A6C7D-EAB0-4D8D-9A3E-DA066F4ACF7D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm4875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E21AC0DB-36FF-4B36-9CA9-809949B0CA53"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm4875:-:*:*:*:*:*:*:*","matchCriteriaId":"471434D6-35A1-4F4E-85C5-0180383BD315"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6450p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEE752CE-2121-477E-A1C9-6A05DF36DFA9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6450p:-:*:*:*:*:*:*:*","matchCriteriaId":"DCA019DB-C24E-4C2B-B4E4-95F61E038FEA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6475p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E32FAA6A-E882-4978-B748-5617BE33F347"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6475p:-:*:*:*:*:*:*:*","matchCriteriaId":"FFFCBBD0-3F52-446F-9A6B-2D138463AB80"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6475q_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03B375DA-4A46-4BC6-B873-99538D53DFBD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6475q:-:*:*:*:*:*:*:*","matchCriteriaId":"ACEA2D75-14DB-4F87-8F3C-A6E9436ECA97"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6650p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"09020F3F-C869-42DF-BD9C-E78056CC8123"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6650p:-:*:*:*:*:*:*:*","matchCriteriaId":"E8272228-2D68-45F2-A670-B5D6E90D9C14"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6850_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DE09FF94-7751-4EED-B269-C7BB056CA90C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6850:-:*:*:*:*:*:*:*","matchCriteriaId":"02B1463D-EE74-42DC-95D5-D0F66260CB32"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7435_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F7A95A9E-617A-4D3A-9A4E-0C0A29B3C8B5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7435:-:*:*:*:*:*:*:*","matchCriteriaId":"3559292E-B5A6-4F88-BC20-F6AA85F07C97"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7435p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"55C65D26-71D7-4840-B8B1-7C5EC69EB320"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7435p:-:*:*:*:*:*:*:*","matchCriteriaId":"B322FB35-2415-45EA-A350-746AFF734ACD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7525_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2410FF59-E0C0-4920-9656-C398DB06DEAE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7525:-:*:*:*:*:*:*:*","matchCriteriaId":"7D2B800C-4DBC-4028-875D-667C87D75247"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7550_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EEA5CE41-0596-4D38-9891-D1DF711EA7E9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7550:-:*:*:*:*:*:*:*","matchCriteriaId":"E1A901C6-FB73-4361-B391-4A4AF8C70029"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7550p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5C5D7E2C-0955-4B6E-96E4-CFA06D937492"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7550p:-:*:*:*:*:*:*:*","matchCriteriaId":"9D1D0F33-AD5A-4826-9A06-EAD2A8709974"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7635p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3A72DAA5-E10F-40A0-A8CC-541594A3279F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7635p:-:*:*:*:*:*:*:*","matchCriteriaId":"15CC657A-7623-4F37-AC52-8AF5C83D5BDA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7675_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"012C20A8-3F48-48DD-9A77-65C9CB1F6C30"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7675:-:*:*:*:*:*:*:*","matchCriteriaId":"EE992A86-36BC-40E3-8E96-6542560BE8EC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9371_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2503805B-B2A6-4AEE-8AB1-2B8A040702BD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9371:-:*:*:*:*:*:*:*","matchCriteriaId":"D3AD370C-2ED0-43CF-83D9-50DC92A01CA5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9375_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"34143ABA-7D09-429F-A65C-3A33438BF62C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9375:-:*:*:*:*:*:*:*","matchCriteriaId":"9D56DFE3-5EF1-4B23-BBD5-0203FBF9CCEC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9378_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4CFDBB5B-0A4F-4032-874F-D2A7EF933FB0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9378:-:*:*:*:*:*:*:*","matchCriteriaId":"D28A12D6-CC60-4BE9-ADEE-FAB58B05440F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"70292B01-617F-44AD-AF77-1AFC1450523D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9380:-:*:*:*:*:*:*:*","matchCriteriaId":"FA94C6D6-85DB-4031-AAF4-C399019AE16D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"92B17201-8185-47F1-9720-5AB4ECD11B22"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9385:-:*:*:*:*:*:*:*","matchCriteriaId":"E1FA2EB9-416F-4D69-8786-386CC73978AE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9390_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"896F1C04-9957-440F-BF01-C3772CC3B3DF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9390:-:*:*:*:*:*:*:*","matchCriteriaId":"A90555EB-47A7-4717-92D5-35B561825F06"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9395_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"699056F6-1517-4F25-AE07-4FFCF6923B9F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9395:-:*:*:*:*:*:*:*","matchCriteriaId":"E4C023D2-6FF5-4FFC-B9F2-895979166580"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3950_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3FEF2DB6-00F5-4B07-953B-EF58B31267F1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3950:-:*:*:*:*:*:*:*","matchCriteriaId":"120E8F0F-EBEB-4565-9927-2D473F783EF7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4BFB25F-013B-48E3-99FF-3E8687F94423"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3988:-:*:*:*:*:*:*:*","matchCriteriaId":"BF676C5B-838B-446C-A689-6A25AB8A87E2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn6450_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1FAFC9FA-E6EF-44C5-BD50-2824C7711541"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn6450:-:*:*:*:*:*:*:*","matchCriteriaId":"6F895CDD-F9BB-45AD-AE60-71F4549114A4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn6650_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"93398092-AF7C-4F04-874C-7E5B4CF7AB00"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn6650:-:*:*:*:*:*:*:*","matchCriteriaId":"7D242084-5844-4E43-8D7F-D2F8E3521F0C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn6755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2BC386D9-3D2B-40FA-A2D9-199BB138F46A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn6755:-:*:*:*:*:*:*:*","matchCriteriaId":"133FFD9F-FA09-4801-939B-AD1D507BE5FE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7760_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"506C6CE1-6BDF-4542-82C1-820D10D8181A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7760:-:*:*:*:*:*:*:*","matchCriteriaId":"72F8CE3B-2BDC-40B1-BB04-A3A7E25B8096"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7860_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2EB8794F-7998-424E-AF68-E4A4F9310F65"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7860:-:*:*:*:*:*:*:*","matchCriteriaId":"799D69CE-3FCC-4B19-8B00-9AF38111D983"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7861_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"57608D47-894C-4895-B4B3-4733D55D57DB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7861:-:*:*:*:*:*:*:*","matchCriteriaId":"2FFD2C38-1A61-4BED-ABFA-DAE0C4B78620"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7880_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"63735D33-9F09-4841-9FE0-0D9AB604BECF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7880:-:*:*:*:*:*:*:*","matchCriteriaId":"E826F765-4C2E-4319-BBC4-DEB02AAD783F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D765C392-5F38-4E6A-9E88-59629E7A6911"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7881:-:*:*:*:*:*:*:*","matchCriteriaId":"FAE8F4F9-F692-4EC0-A3FE-2CDD681DCBFD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8810_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"15307882-7039-43E9-9BA3-035045988B99"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8810:-:*:*:*:*:*:*:*","matchCriteriaId":"AA85B322-E593-4499-829A-CC6D70BAE884"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E839A0B9-64C3-4C7A-82B7-D2AAF65928F8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8815:-:*:*:*:*:*:*:*","matchCriteriaId":"7E870D82-DE3B-4199-A730-C8FB545BAA98"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8830_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"11B69595-E488-4590-A150-CE5BE08B5E13"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8830:-:*:*:*:*:*:*:*","matchCriteriaId":"BF680174-5FA6-47D9-8EAB-CC2A37A7BD42"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8832_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7ACAD26E-B79E-4659-91A5-D301281F7D36"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8832:-:*:*:*:*:*:*:*","matchCriteriaId":"F0E46DA6-9494-4D92-A4AE-A272AF6ACCCC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F80BC68E-7476-4A40-9F48-53722FE9A5BF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8835:-:*:*:*:*:*:*:*","matchCriteriaId":"6B36F4B2-BAA3-45AD-9967-0EB482C99708"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8840_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA33DE15-C177-43B3-AD50-FF797753D12E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8840:-:*:*:*:*:*:*:*","matchCriteriaId":"AE1A5841-5BCB-4033-ACB9-23F3FCA65309"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8845_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5B47BF35-3AA0-4667-842E-19B0FE30BF3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8845:-:*:*:*:*:*:*:*","matchCriteriaId":"8A071672-9405-4418-9141-35CEADBB65AF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8845h_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB7CF473-8B25-4851-91F2-1BD693CCDC85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8845h:-:*:*:*:*:*:*:*","matchCriteriaId":"91E591F2-8F72-4A5A-9264-2742EB2DABDA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8850_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FA243934-7BFA-47AA-B78C-CCB25377E471"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8850:-:*:*:*:*:*:*:*","matchCriteriaId":"2FD65035-4D20-48D5-874E-47CD9C7A985C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8850w_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22707187-A56D-48AD-800F-A438FD844546"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8850w:-:*:*:*:*:*:*:*","matchCriteriaId":"F526A54A-F974-4D0A-A1A6-FABBB6711CD0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8855c_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"671E0B82-5D58-4644-8806-7F4CAFFB6641"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8855c:-:*:*:*:*:*:*:*","matchCriteriaId":"CC066321-B3CC-4E88-BFA9-414B8D095207"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:x1e80100_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42F453E4-02CC-4E48-A25B-F1394069F524"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:x1e80100:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6671AE-3490-4D85-A20C-3DA26F7D7AEB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:xrv7209_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CC6C6243-E092-4903-BC20-E3B0CECBC790"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:xrv7209:-:*:*:*:*:*:*:*","matchCriteriaId":"AAA33761-D61C-4A81-B233-5E2D50F3596F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:xrv9209_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D693483-72F9-42B1-8EDA-8DABD537F428"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:xrv9209:-:*:*:*:*:*:*:*","matchCriteriaId":"43F4A7D9-055D-475B-BFE4-61A86C7397F8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7675p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3B46F132-4049-40D0-8351-C1C6FD2B47A0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7675p:-:*:*:*:*:*:*:*","matchCriteriaId":"1846514C-1F95-4568-98DE-C57214401841"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7750p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B8A511E-B43B-4617-A3B3-03F4EE80CA1D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7750p:-:*:*:*:*:*:*:*","matchCriteriaId":"BAE215A4-3860-45B1-BDFC-B614692F7905"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8475p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8DBF6AE8-605B-4E72-BD3B-0B6C390FCE32"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8475p:-:*:*:*:*:*:*:*","matchCriteriaId":"26AAE148-96B6-4FDE-BABD-48F607464A38"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8550p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C4CDD6A2-5A3C-4572-8CE1-2F102333BB79"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8550p:-:*:*:*:*:*:*:*","matchCriteriaId":"699E5D17-6144-4F0A-8D52-1E8C83990E52"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8635_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"65865EE9-59C0-498F-A4C5-EC00D4642603"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8635:-:*:*:*:*:*:*:*","matchCriteriaId":"CE02AB51-6FB6-4727-999B-A7466CEDC534"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8635p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"88F63D90-4BFC-4EFA-8B74-7A5027A7052D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8635p:-:*:*:*:*:*:*:*","matchCriteriaId":"20EB529B-6B9F-464F-A98B-A8ABE0F01ADB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8650q_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1CAA8D9D-0238-4223-8F7B-134ECBB6FA05"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8650q:-:*:*:*:*:*:*:*","matchCriteriaId":"D8A722B8-E1E4-43B4-8882-591CE8C5C166"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8735p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B24D04FB-6823-452C-8F0D-0088E9B402EC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8735p:-:*:*:*:*:*:*:*","matchCriteriaId":"B9CCD62E-F9D1-4CF9-9595-3BF28DED89AC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8750p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4D8ABDBF-BABC-4219-8A18-BDFC8C826B1F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8750p:-:*:*:*:*:*:*:*","matchCriteriaId":"685D81D0-7E95-4DBA-A05B-7C708A5DFDF0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8845p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A205320E-6C60-4F6A-90D5-06CABAF0FDEA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8845p:-:*:*:*:*:*:*:*","matchCriteriaId":"0FB8CE86-605E-4B3D-82E5-A55093ABCE5F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_4_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"55AECCCF-0761-46B6-B669-E73096679AFB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_4_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"7DE87CA2-160A-43BF-AC18-DA788501B5B4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_460_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"390D7CAF-6C0B-4438-AA7D-AEEE127F4D3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_460_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"5BB1FC5E-CF6F-4E54-B78D-C01AFD034903"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_6_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EBB3BC1B-2EBC-457C-AE91-6BD408EB7D5F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_6_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"0870CC30-07F8-4FFF-85B4-FBACE947CC14"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_6_gen_3_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D69E4203-EA20-4D6F-BD1C-C8E550588F87"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_6_gen_3_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"C1225010-5A08-4D13-A3E2-4C57C4265605"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_6_gen_4_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"20ABA235-1380-4D76-A248-36A6E905AEB2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_6_gen_4_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"923775B3-1916-4E60-A888-574AB3F3E282"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_662_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"37DF4D73-3ACC-41B3-8CA4-20DAECE6BFB7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_662_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"FE08D23A-2D0D-4472-8847-27B955F55165"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"677D5A3F-2A0D-48F0-A1C5-B067BADFD11A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"CB79B015-A401-4FAD-8818-1475653C2B12"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7_gen_4_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"48BB1413-6719-4026-9154-0AF3BA32C26B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7_gen_4_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"97851334-202F-4695-A4B2-6D0B221D6E23"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7\\+_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C8E41CBD-D6AD-41CF-A469-92A7E228BBB6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7\\+_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"57E0BA08-3BF4-4E84-BBA9-B48F84197F9D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7s_gen_3_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BBD338C6-F731-4B5D-9DE1-32259A23FBC2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7s_gen_3_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"3AB83DA5-30ED-44E8-8517-1988B2D1EC6B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_elite_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EA50192-07B0-4404-93D4-EC4F3B1918B7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_elite:-:*:*:*:*:*:*:*","matchCriteriaId":"26C7FC48-08CB-4E50-B8D3-8AF30549FDF8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_elite_gen_5_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"41070BDB-15E4-4DD7-A132-A14AA24978E5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_elite_gen_5:-:*:*:*:*:*:*:*","matchCriteriaId":"102460A6-9637-4883-9230-2CC888D5D74E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EB8FA32F-4690-4C5B-8968-474DA32FD0A4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"59BD8BEA-725A-4158-84BE-4AFD476ED03D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"60F5899C-BA8D-4B6B-BC61-F77B1EB64739"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"D39AD7CE-A017-4D74-A348-9E4B08363799"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen_3_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0FAB6D60-1C03-4F85-B874-FF169402ED09"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen_3_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"C89A8D93-46DA-4547-A9F1-076FC0D5119D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen_5_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4D8D8AD-B291-4AEC-8817-D7C99E79FF49"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen_5:-:*:*:*:*:*:*:*","matchCriteriaId":"8CA08EA8-A47E-4797-8644-0A48D509939C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8\\+_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"59CB6F2F-7C95-498B-9F9E-728930FD24A7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8\\+_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"284E62AF-2E4D-4E82-AC9A-F27DA71735EF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8\\+_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1FEDF458-DEA7-42A1-A56D-E11250139545"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8\\+_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"D5693438-0F20-47BB-BA32-7175C3152368"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_ar1_gen_1_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"53E5BBDA-C07D-42E2-9A34-EC1F6454CAA4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_ar1_gen_1_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"0BB2408F-C768-4DD2-B834-B62E188D6CC2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_ar1\\+_gen_1_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BE30A5E0-10D5-4679-ACA6-4ED991335A6F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_ar1\\+_gen_1_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"CFA75B74-D20D-4C8B-BFA2-5DE4848410CD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_ride_elite__firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F0E59814-7DAA-4A91-882E-A42BBDE0C57A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_ride_elite_:-:*:*:*:*:*:*:*","matchCriteriaId":"A90ED287-F533-400B-B201-589AA4437164"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_xr2_5g_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1A129620-8241-4A47-AAC8-CC7E10A09C9C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_xr2_5g_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"4CEDD78E-124C-4216-9B57-3B7B53463659"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_xr2\\+_gen_1_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BF9740EB-F82E-42EA-993E-A393B05CC6BB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_xr2\\+_gen_1_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"022A5532-03F7-4FB8-BA0D-4221178C9486"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_cockpit_elite_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D4E05762-315D-46A9-93DB-435DB78FEE71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_cockpit_elite:-:*:*:*:*:*:*:*","matchCriteriaId":"5028FDF9-6852-4C88-97D8-CE6392960A55"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_reality_elite_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"08ACBE23-DBE3-4AE0-B9EA-F3A73290D5F0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_reality_elite_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"3F82A885-4CAB-44F2-85FA-3D581283A936"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:srv1h_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0CD199F5-DA68-4BEB-AA99-11572DA26B4F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:srv1h:-:*:*:*:*:*:*:*","matchCriteriaId":"8ACA2D4D-FC77-4C1A-8278-1C27B3EA3303"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:srv1m_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4B29E7F-8BFE-466A-B357-63F8A2160C4E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:srv1m:-:*:*:*:*:*:*:*","matchCriteriaId":"6D55CC7D-2E65-4CA9-9892-B6FBCC087E6F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sxr2230p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD6444F6-A477-4B4C-8A09-C22C47CCE45B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sxr2230p:-:*:*:*:*:*:*:*","matchCriteriaId":"F3E20681-4FC4-46E2-AF77-BCF03BC8E77E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sxr2250p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"68A93ED1-F509-439E-AE7B-F0EC87AE759F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sxr2250p:-:*:*:*:*:*:*:*","matchCriteriaId":"FB5E2A98-EDD0-4298-911D-EC7527D5A424"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9370_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1295D869-F4DD-4766-B4AA-3513752F43B4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9370:-:*:*:*:*:*:*:*","matchCriteriaId":"B98784DC-3143-4D38-AD28-DBBDCCAB4272"}]}]}],"references":[{"url":"https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2026-bulletin.html","source":"product-security@qualcomm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-25270","sourceIdentifier":"product-security@qualcomm.com","published":"2026-10-06T07:16:57.367","lastModified":"2026-10-09T14:10:57.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver."}],"affected":[{"source":"product-security@qualcomm.com","affectedData":[{"vendor":"Qualcomm, Inc.","product":"Snapdragon","defaultStatus":"unaffected","platforms":["Snapdragon Compute","Snapdragon Industrial IOT","Snapdragon Mobile","Snapdragon Wearables"],"versions":[{"version":"FastConnect 6700","status":"affected"},{"version":"FastConnect 6900","status":"affected"},{"version":"FastConnect 7800","status":"affected"},{"version":"Kalpeni","status":"affected"},{"version":"QCM6490","status":"affected"},{"version":"Qualcomm Dragonwing QCM4490","status":"affected"},{"version":"Qualcomm Video Collaboration VC3 Platform","status":"affected"},{"version":"SD865 5G","status":"affected"},{"version":"Snapdragon 8 Gen 1 Mobile Platform","status":"affected"},{"version":"Snapdragon XR2 5G Platform","status":"affected"},{"version":"Snapdragon XR2+ Gen 1 Platform","status":"affected"},{"version":"SW5100","status":"affected"},{"version":"SW5100P","status":"affected"},{"version":"SXR2230P","status":"affected"},{"version":"SXR2250P","status":"affected"},{"version":"WCD9370","status":"affected"},{"version":"WCD9375","status":"affected"},{"version":"WCD9378","status":"affected"},{"version":"WCD9380","status":"affected"},{"version":"WCD9385","status":"affected"},{"version":"WCN3950","status":"affected"},{"version":"WCN3980","status":"affected"},{"version":"WCN3988","status":"affected"},{"version":"WSA8810","status":"affected"},{"version":"WSA8815","status":"affected"},{"version":"WSA8830","status":"affected"},{"version":"WSA8832","status":"affected"},{"version":"WSA8835","status":"affected"},{"version":"WSA8840","status":"affected"},{"version":"WSA8845","status":"affected"},{"version":"WSA8845H","status":"affected"},{"version":"X1E80100","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"product-security@qualcomm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T12:46:18.255807Z","id":"CVE-2026-25270","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"product-security@qualcomm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_g1_gen_2_gaming_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"905C9267-C1B5-4A77-BC33-118986A907C7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_g1_gen_2_gaming_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"671C9107-7E54-4FBC-B03D-1EB4DCD8597E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cologne_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8FF959C0-5AAB-4DC5-AE8F-4EFA21A00B5E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cologne:-:*:*:*:*:*:*:*","matchCriteriaId":"E31E0C48-FB61-47C8-B28B-3A701E85E126"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:congo_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4DA1D059-7672-40F5-BB2E-3072475666A0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:congo:-:*:*:*:*:*:*:*","matchCriteriaId":"48C84939-F83F-4E79-902C-32B77C4A4BBB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq2390m_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8DAB4A10-45A2-47B2-AAED-46DCC9740396"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq2390m:-:*:*:*:*:*:*:*","matchCriteriaId":"F793F65B-324E-416A-B9CD-0496F5E9CB8C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq2390s_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B0928CC-C507-4437-946B-B2AD400E9B3E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq2390s:-:*:*:*:*:*:*:*","matchCriteriaId":"E6FAF059-0D17-40DD-B0DA-A708081F6062"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sc8380xp_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14E3FE58-7F1C-4F5C-B62D-0CF124E14AB2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sc8380xp:-:*:*:*:*:*:*:*","matchCriteriaId":"FFCB0BBA-3F81-4FCA-B3DE-190C46DA50DB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen1_5g_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D0567B3-D81A-4EEE-868B-4DC2214C159D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen1_5g:-:*:*:*:*:*:*:*","matchCriteriaId":"76236C11-4903-4AD4-9134-3EDD3451EE43"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_662_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"37DF4D73-3ACC-41B3-8CA4-20DAECE6BFB7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_662_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"FE08D23A-2D0D-4472-8847-27B955F55165"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_865_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6C9F4285-1F09-40CD-B1AA-84B406FD6A71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_865_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"8623DD44-DFDD-442D-9789-11A527A450A4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sdr753_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A49B142B-E8DC-4A79-B969-2C2FBE2E009A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sdr753:-:*:*:*:*:*:*:*","matchCriteriaId":"8A1A6C7D-EAB0-4D8D-9A3E-DA066F4ACF7D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm4850_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E7D1CC27-76AE-42A7-98BD-38ED7E63B733"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm4850:-:*:*:*:*:*:*:*","matchCriteriaId":"BD6059A3-2B16-4EE7-B4C5-4376F875A5CC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm4850p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E58014BF-A65B-4DA3-86AB-57FB93B21A4D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm4850p:-:*:*:*:*:*:*:*","matchCriteriaId":"221FC5B4-6059-4F7E-AFDE-7D6A8DB91A4A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm4875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E21AC0DB-36FF-4B36-9CA9-809949B0CA53"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm4875:-:*:*:*:*:*:*:*","matchCriteriaId":"471434D6-35A1-4F4E-85C5-0180383BD315"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6225p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8D2B7D93-4218-4FFF-B1C0-F50EC0B2B934"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6225p:-:*:*:*:*:*:*:*","matchCriteriaId":"00D9DCE1-B3CD-4F45-97DD-637AA27572DD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6450p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEE752CE-2121-477E-A1C9-6A05DF36DFA9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6450p:-:*:*:*:*:*:*:*","matchCriteriaId":"DCA019DB-C24E-4C2B-B4E4-95F61E038FEA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6475p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E32FAA6A-E882-4978-B748-5617BE33F347"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6475p:-:*:*:*:*:*:*:*","matchCriteriaId":"FFFCBBD0-3F52-446F-9A6B-2D138463AB80"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6475q_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03B375DA-4A46-4BC6-B873-99538D53DFBD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6475q:-:*:*:*:*:*:*:*","matchCriteriaId":"ACEA2D75-14DB-4F87-8F3C-A6E9436ECA97"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6650p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"09020F3F-C869-42DF-BD9C-E78056CC8123"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6650p:-:*:*:*:*:*:*:*","matchCriteriaId":"E8272228-2D68-45F2-A670-B5D6E90D9C14"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6850_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DE09FF94-7751-4EED-B269-C7BB056CA90C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6850:-:*:*:*:*:*:*:*","matchCriteriaId":"02B1463D-EE74-42DC-95D5-D0F66260CB32"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7325p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4BEC725F-19B1-4078-B13D-CE624BE23344"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7325p:-:*:*:*:*:*:*:*","matchCriteriaId":"4EA43E38-A12D-49C3-B05C-A2AF07ED2710"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7435_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F7A95A9E-617A-4D3A-9A4E-0C0A29B3C8B5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7435:-:*:*:*:*:*:*:*","matchCriteriaId":"3559292E-B5A6-4F88-BC20-F6AA85F07C97"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7435p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"55C65D26-71D7-4840-B8B1-7C5EC69EB320"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7435p:-:*:*:*:*:*:*:*","matchCriteriaId":"B322FB35-2415-45EA-A350-746AFF734ACD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7525_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2410FF59-E0C0-4920-9656-C398DB06DEAE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7525:-:*:*:*:*:*:*:*","matchCriteriaId":"7D2B800C-4DBC-4028-875D-667C87D75247"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7550_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EEA5CE41-0596-4D38-9891-D1DF711EA7E9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7550:-:*:*:*:*:*:*:*","matchCriteriaId":"E1A901C6-FB73-4361-B391-4A4AF8C70029"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7550p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5C5D7E2C-0955-4B6E-96E4-CFA06D937492"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7550p:-:*:*:*:*:*:*:*","matchCriteriaId":"9D1D0F33-AD5A-4826-9A06-EAD2A8709974"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7635p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3A72DAA5-E10F-40A0-A8CC-541594A3279F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7635p:-:*:*:*:*:*:*:*","matchCriteriaId":"15CC657A-7623-4F37-AC52-8AF5C83D5BDA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7675_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"012C20A8-3F48-48DD-9A77-65C9CB1F6C30"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7675:-:*:*:*:*:*:*:*","matchCriteriaId":"EE992A86-36BC-40E3-8E96-6542560BE8EC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7675p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3B46F132-4049-40D0-8351-C1C6FD2B47A0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7675p:-:*:*:*:*:*:*:*","matchCriteriaId":"1846514C-1F95-4568-98DE-C57214401841"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7750p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B8A511E-B43B-4617-A3B3-03F4EE80CA1D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7750p:-:*:*:*:*:*:*:*","matchCriteriaId":"BAE215A4-3860-45B1-BDFC-B614692F7905"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8475p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8DBF6AE8-605B-4E72-BD3B-0B6C390FCE32"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8475p:-:*:*:*:*:*:*:*","matchCriteriaId":"26AAE148-96B6-4FDE-BABD-48F607464A38"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8550p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C4CDD6A2-5A3C-4572-8CE1-2F102333BB79"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8550p:-:*:*:*:*:*:*:*","matchCriteriaId":"699E5D17-6144-4F0A-8D52-1E8C83990E52"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8635_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"65865EE9-59C0-498F-A4C5-EC00D4642603"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8635:-:*:*:*:*:*:*:*","matchCriteriaId":"CE02AB51-6FB6-4727-999B-A7466CEDC534"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8635p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"88F63D90-4BFC-4EFA-8B74-7A5027A7052D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8635p:-:*:*:*:*:*:*:*","matchCriteriaId":"20EB529B-6B9F-464F-A98B-A8ABE0F01ADB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8650q_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1CAA8D9D-0238-4223-8F7B-134ECBB6FA05"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8650q:-:*:*:*:*:*:*:*","matchCriteriaId":"D8A722B8-E1E4-43B4-8882-591CE8C5C166"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8735p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B24D04FB-6823-452C-8F0D-0088E9B402EC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8735p:-:*:*:*:*:*:*:*","matchCriteriaId":"B9CCD62E-F9D1-4CF9-9595-3BF28DED89AC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8750p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4D8ABDBF-BABC-4219-8A18-BDFC8C826B1F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8750p:-:*:*:*:*:*:*:*","matchCriteriaId":"685D81D0-7E95-4DBA-A05B-7C708A5DFDF0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8845p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A205320E-6C60-4F6A-90D5-06CABAF0FDEA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8845p:-:*:*:*:*:*:*:*","matchCriteriaId":"0FB8CE86-605E-4B3D-82E5-A55093ABCE5F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8950_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"09662E75-32BB-4D24-8A81-B743FF0DE323"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8950:-:*:*:*:*:*:*:*","matchCriteriaId":"8D44C02D-3FCA-4885-A1B5-7C2836B1233B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8950p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D5350DB-39BD-4BF4-87AB-5FD6DECB25D3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8950p:-:*:*:*:*:*:*:*","matchCriteriaId":"0AE6E7D9-E7E8-490E-B801-D97F522CA0FA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8975_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42D47A7D-A79C-4EA0-AEDF-533F4F9933B9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8975:-:*:*:*:*:*:*:*","matchCriteriaId":"1CC31B0D-3890-442E-87BE-47E58A0F6537"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8975p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"73D04C5D-A3A8-45A3-A83E-03DF5EF400C2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8975p:-:*:*:*:*:*:*:*","matchCriteriaId":"A67DF502-A50C-4E7E-B457-F46B7149B85C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:smart_audio_400_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"57B0086F-5F2C-4F89-AC53-D8429D6506CD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:smart_audio_400_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"FB8145C8-D978-4047-9203-602E854E7290"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_4_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2CCBF666-CB4E-44E1-9676-6891EDC73578"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_4_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"C767AB6A-1A8C-406C-A600-96A816F44E2F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_4_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"55AECCCF-0761-46B6-B669-E73096679AFB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_4_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"7DE87CA2-160A-43BF-AC18-DA788501B5B4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_460_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"390D7CAF-6C0B-4438-AA7D-AEEE127F4D3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_460_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"5BB1FC5E-CF6F-4E54-B78D-C01AFD034903"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq7790_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9FEBA60-92CC-4660-B410-74A9D0AEB7B9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq7790:-:*:*:*:*:*:*:*","matchCriteriaId":"25B3F423-6AF3-472A-A178-21776C708A88"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq8725s_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C6143A36-BA18-432C-A6BB-2F33B1509C44"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq8725s:-:*:*:*:*:*:*:*","matchCriteriaId":"09EE5F30-46A6-423B-94AF-E7F4DAB532CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq8750m_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23301B23-E3B8-4FFA-BC7A-33FDDEEDC425"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq8750m:-:*:*:*:*:*:*:*","matchCriteriaId":"F05B2437-B6C0-41C4-818E-12AFE616D790"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq8845s_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4FB1D261-4C1B-4D43-B8ED-975E526A2FF5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq8845s:-:*:*:*:*:*:*:*","matchCriteriaId":"54AC5C16-88A9-4C16-B7AF-835E53D7DFA4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq8850ns_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"867A0C11-FBA0-46F1-871F-1800A7A75BB3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq8850ns:-:*:*:*:*:*:*:*","matchCriteriaId":"9885533F-4021-429D-917F-0A2733725B43"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:csra6620_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FA42F2EA-5D00-42B8-B020-C27675B72915"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:csra6620:-:*:*:*:*:*:*:*","matchCriteriaId":"BFCF207D-B8C8-4860-89C7-673C821F0237"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:csra6640_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A8A35ECF-B12E-42DE-A74B-2C3BE03639A4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:csra6640:-:*:*:*:*:*:*:*","matchCriteriaId":"65B283D6-B2D2-49B6-98A8-08EDB54C1F15"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6200_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CDE1CBDE-3D28-463C-B215-AA7DF373EF09"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6200:-:*:*:*:*:*:*:*","matchCriteriaId":"66BD3B88-7CF9-482D-A2DD-67F6ACF4CC57"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6700_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"82B82E87-F3F4-466F-A76B-C8809121FF6F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6700:-:*:*:*:*:*:*:*","matchCriteriaId":"419A132E-E42C-4395-B74B-788A39DF1D13"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6900_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E670F500-9B71-4BBE-B5DA-221D35803C89"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6900:-:*:*:*:*:*:*:*","matchCriteriaId":"9ADEB5C5-B79A-4F45-B7D3-75945B38DB6C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_7800_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B3053D68-C5D8-4D47-A4F0-9F3AF2289E1D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_7800:-:*:*:*:*:*:*:*","matchCriteriaId":"638DBC7F-456F-487D-BED2-2214DFF8BEE2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:g1_gen_1_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0556CCE6-B61B-4DE7-AD4B-333414280DF8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:g1_gen_1:-:*:*:*:*:*:*:*","matchCriteriaId":"CC734495-D935-40CC-9644-477E921F3EE0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:g2_gen_1_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"924DFF0F-E8B2-4B94-9B98-E0C2D6313C87"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:g2_gen_1:-:*:*:*:*:*:*:*","matchCriteriaId":"2A5E644B-D05F-4241-8E20-4A6DA1A56695"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:g3x_gen_2_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C167BE19-999E-4538-A23E-01F9C287A6C7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:g3x_gen_2:-:*:*:*:*:*:*:*","matchCriteriaId":"1026CB5F-E30A-42DE-8432-74412CC8BA00"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iq-615_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D2B2D5D-0213-4979-ACBF-BEF843166047"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iq-615:-:*:*:*:*:*:*:*","matchCriteriaId":"CE575B0C-DDE4-4E5A-9FE8-03305C804558"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iq-8275_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"253BF0D2-D24D-4EE3-A157-9853BBB368F2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iq-8275:-:*:*:*:*:*:*:*","matchCriteriaId":"78C6B840-62E9-4DDD-9376-2F7A8FB9D589"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iq-9075_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"08431A88-C176-48BB-918C-DF3FEABE78D4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iq-9075:-:*:*:*:*:*:*:*","matchCriteriaId":"3C50A35E-023A-404D-BFBC-FFCD1F30E872"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:kalpeni_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5A2D4C45-005F-4A02-BFD7-84893FF1A0E8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:kalpeni:-:*:*:*:*:*:*:*","matchCriteriaId":"B3178A79-485F-40DB-A71D-B29BD3875A7D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:lemans_au_lgit_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5767FE95-737F-4C20-A5AB-EC641A68D906"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:lemans_au_lgit:-:*:*:*:*:*:*:*","matchCriteriaId":"33323A49-9267-421B-96E1-80C5FA709EBC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:lemansau_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2DF0ED3F-C98B-458E-ADCC-C922402BB185"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:lemansau:-:*:*:*:*:*:*:*","matchCriteriaId":"102A4B5E-1739-4C31-A626-ABF6B02FEE29"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:mbm415_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"06917C11-6ABA-4972-A4A5-AEA69A5E73FE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:mbm415:-:*:*:*:*:*:*:*","matchCriteriaId":"9B1C6B87-2B59-4220-BC0D-7CE30F514728"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:mbm715_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F9E2ED64-0268-4C88-9553-D6EF646C3BA1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:mbm715:-:*:*:*:*:*:*:*","matchCriteriaId":"861D5B95-47E1-4374-9EF6-157516FF5171"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:milos_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22EFC07D-16C3-4CCC-A928-EA5EA69CAB65"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:milos:-:*:*:*:*:*:*:*","matchCriteriaId":"0D3491C1-A427-4CEC-B8BD-6A1930E6827F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:milos_iot_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"18471E2B-412C-4D07-9997-C8663902D7B5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:milos_iot:-:*:*:*:*:*:*:*","matchCriteriaId":"0284E269-A212-4474-AE46-255D5245096F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:monaco_iot_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D071BA3E-36AE-40E5-88FB-04012ABECBD2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:monaco_iot:-:*:*:*:*:*:*:*","matchCriteriaId":"F9FB6B54-7F16-497D-B211-327744F35ECB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:netrani_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9C52A53B-1182-47F3-9800-D8C58F954277"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:netrani:-:*:*:*:*:*:*:*","matchCriteriaId":"BEC1F084-78C8-4413-940A-47E9554CB6D0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:orne_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"19FB8345-BBFC-4E18-A4E6-64A159D7F65B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:orne:-:*:*:*:*:*:*:*","matchCriteriaId":"FFDA4056-3F1B-4F3A-BE59-1908BD3DE5E9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:palawan25_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C18C3535-3074-41DE-B40F-F3055BAFF686"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:palawan25:-:*:*:*:*:*:*:*","matchCriteriaId":"7B590B1E-06D1-4C99-BDDF-4A086BEBB4C7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:pandeiro_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F8EF0C-BB48-47E1-A045-254D79388F75"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:pandeiro:-:*:*:*:*:*:*:*","matchCriteriaId":"058950FC-ED72-4E91-AE13-87E738ADC083"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:q-4390_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F534D99F-9B90-457A-B2EE-8E2E05ECC9A2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:q-4390:-:*:*:*:*:*:*:*","matchCriteriaId":"3733BE8F-DF77-49E9-866F-B426194148B3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qam8255p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3723C7B1-A7E2-401F-8D6D-189350F6BCA5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qam8255p:-:*:*:*:*:*:*:*","matchCriteriaId":"B12B89EF-7B12-481E-BCBC-F12B9D16321A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qamsrv1h_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F8673334-5E11-4E95-B33D-3029499F71DF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qamsrv1h:-:*:*:*:*:*:*:*","matchCriteriaId":"EC0B32F6-5EF0-4591-99D7-D0E9B09DEC5A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qamsrv1m_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CE03AB2A-3ED9-4489-8E5B-4FCF8BAA8559"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qamsrv1m:-:*:*:*:*:*:*:*","matchCriteriaId":"9E646738-6A87-4470-9640-6A5A1DF3AF78"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6391_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"83B53119-1B2F-4978-B7F5-33B84BE73B68"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6391:-:*:*:*:*:*:*:*","matchCriteriaId":"6FEBC0C5-CAA1-475C-96C2-B8D24B2E4536"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6595au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"288F637F-22F8-47CF-B67F-C798A730A1BD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6595au:-:*:*:*:*:*:*:*","matchCriteriaId":"D0996EA3-1C92-4933-BE34-9CF625E59FE7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6678aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D001127D-8160-42F0-B8B9-2FAA2976B530"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6678aq:-:*:*:*:*:*:*:*","matchCriteriaId":"C9EB615F-FD4C-450B-AB25-E936FD9816C4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6698aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5FA1F8F4-EAF2-4704-A8A6-19AD3CA1B577"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6698aq:-:*:*:*:*:*:*:*","matchCriteriaId":"B3F7853D-09EE-476F-B48D-BB30AEB4A67D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6698au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3ACA09C0-84A5-493A-A9BD-EF95A8330D54"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6698au:-:*:*:*:*:*:*:*","matchCriteriaId":"3A2397BD-431C-4730-92E3-17A5C2445A65"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6797aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"797295C2-535C-46A9-A725-E1A5405F0436"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6797aq:-:*:*:*:*:*:*:*","matchCriteriaId":"8BFC575E-594E-4711-94B1-2DC8D03B9AC4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca8695au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"55A21DB0-4722-4421-8E97-B0E31B93E53B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca8695au:-:*:*:*:*:*:*:*","matchCriteriaId":"797B8944-61F0-4522-97FE-3C172369F477"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sxr2250p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"68A93ED1-F509-439E-AE7B-F0EC87AE759F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sxr2250p:-:*:*:*:*:*:*:*","matchCriteriaId":"FB5E2A98-EDD0-4298-911D-EC7527D5A424"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:themisto_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"55DE7B27-56A2-4046-9E03-8215587C8827"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:themisto:-:*:*:*:*:*:*:*","matchCriteriaId":"0853EA22-4EFD-4037-8B83-CB7C18417D23"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9335_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"28717583-463A-468A-8073-ECF0F90585F6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9335:-:*:*:*:*:*:*:*","matchCriteriaId":"4D1A7188-7D5D-4D46-AEAB-08BA84FFF539"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9370_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1295D869-F4DD-4766-B4AA-3513752F43B4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9370:-:*:*:*:*:*:*:*","matchCriteriaId":"B98784DC-3143-4D38-AD28-DBBDCCAB4272"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9371_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2503805B-B2A6-4AEE-8AB1-2B8A040702BD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9371:-:*:*:*:*:*:*:*","matchCriteriaId":"D3AD370C-2ED0-43CF-83D9-50DC92A01CA5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9375_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"34143ABA-7D09-429F-A65C-3A33438BF62C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9375:-:*:*:*:*:*:*:*","matchCriteriaId":"9D56DFE3-5EF1-4B23-BBD5-0203FBF9CCEC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9378_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4CFDBB5B-0A4F-4032-874F-D2A7EF933FB0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9378:-:*:*:*:*:*:*:*","matchCriteriaId":"D28A12D6-CC60-4BE9-ADEE-FAB58B05440F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"70292B01-617F-44AD-AF77-1AFC1450523D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9380:-:*:*:*:*:*:*:*","matchCriteriaId":"FA94C6D6-85DB-4031-AAF4-C399019AE16D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"92B17201-8185-47F1-9720-5AB4ECD11B22"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9385:-:*:*:*:*:*:*:*","matchCriteriaId":"E1FA2EB9-416F-4D69-8786-386CC73978AE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9390_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"896F1C04-9957-440F-BF01-C3772CC3B3DF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9390:-:*:*:*:*:*:*:*","matchCriteriaId":"A90555EB-47A7-4717-92D5-35B561825F06"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9395_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"699056F6-1517-4F25-AE07-4FFCF6923B9F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9395:-:*:*:*:*:*:*:*","matchCriteriaId":"E4C023D2-6FF5-4FFC-B9F2-895979166580"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3910_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9F0D7B24-D567-479A-B4F1-595FAA053418"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3910:-:*:*:*:*:*:*:*","matchCriteriaId":"33A8FAA1-F824-4561-9CCC-7F0DF12F740F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3950_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3FEF2DB6-00F5-4B07-953B-EF58B31267F1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3950:-:*:*:*:*:*:*:*","matchCriteriaId":"120E8F0F-EBEB-4565-9927-2D473F783EF7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3980_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9C6E9038-9B18-4958-BE1E-215901C9B4B2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3980:-:*:*:*:*:*:*:*","matchCriteriaId":"B36D3274-F8D0-49C5-A6D5-95F5DC6D1950"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4BFB25F-013B-48E3-99FF-3E8687F94423"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3988:-:*:*:*:*:*:*:*","matchCriteriaId":"BF676C5B-838B-446C-A689-6A25AB8A87E2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn6450_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1FAFC9FA-E6EF-44C5-BD50-2824C7711541"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn6450:-:*:*:*:*:*:*:*","matchCriteriaId":"6F895CDD-F9BB-45AD-AE60-71F4549114A4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn6650_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"93398092-AF7C-4F04-874C-7E5B4CF7AB00"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn6650:-:*:*:*:*:*:*:*","matchCriteriaId":"7D242084-5844-4E43-8D7F-D2F8E3521F0C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn6755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2BC386D9-3D2B-40FA-A2D9-199BB138F46A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn6755:-:*:*:*:*:*:*:*","matchCriteriaId":"133FFD9F-FA09-4801-939B-AD1D507BE5FE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7760_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"506C6CE1-6BDF-4542-82C1-820D10D8181A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7760:-:*:*:*:*:*:*:*","matchCriteriaId":"72F8CE3B-2BDC-40B1-BB04-A3A7E25B8096"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7860_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2EB8794F-7998-424E-AF68-E4A4F9310F65"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7860:-:*:*:*:*:*:*:*","matchCriteriaId":"799D69CE-3FCC-4B19-8B00-9AF38111D983"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7861_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"57608D47-894C-4895-B4B3-4733D55D57DB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7861:-:*:*:*:*:*:*:*","matchCriteriaId":"2FFD2C38-1A61-4BED-ABFA-DAE0C4B78620"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7880_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"63735D33-9F09-4841-9FE0-0D9AB604BECF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7880:-:*:*:*:*:*:*:*","matchCriteriaId":"E826F765-4C2E-4319-BBC4-DEB02AAD783F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D765C392-5F38-4E6A-9E88-59629E7A6911"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7881:-:*:*:*:*:*:*:*","matchCriteriaId":"FAE8F4F9-F692-4EC0-A3FE-2CDD681DCBFD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn8841_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C7A02129-BB8C-43F1-BFC1-3632BA299AB6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn8841:-:*:*:*:*:*:*:*","matchCriteriaId":"4082B1D2-9CBD-48FE-93EF-C069A4B6A466"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8810_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"15307882-7039-43E9-9BA3-035045988B99"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8810:-:*:*:*:*:*:*:*","matchCriteriaId":"AA85B322-E593-4499-829A-CC6D70BAE884"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E839A0B9-64C3-4C7A-82B7-D2AAF65928F8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8815:-:*:*:*:*:*:*:*","matchCriteriaId":"7E870D82-DE3B-4199-A730-C8FB545BAA98"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8830_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"11B69595-E488-4590-A150-CE5BE08B5E13"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8830:-:*:*:*:*:*:*:*","matchCriteriaId":"BF680174-5FA6-47D9-8EAB-CC2A37A7BD42"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8832_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7ACAD26E-B79E-4659-91A5-D301281F7D36"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8832:-:*:*:*:*:*:*:*","matchCriteriaId":"F0E46DA6-9494-4D92-A4AE-A272AF6ACCCC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F80BC68E-7476-4A40-9F48-53722FE9A5BF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8835:-:*:*:*:*:*:*:*","matchCriteriaId":"6B36F4B2-BAA3-45AD-9967-0EB482C99708"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8840_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA33DE15-C177-43B3-AD50-FF797753D12E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8840:-:*:*:*:*:*:*:*","matchCriteriaId":"AE1A5841-5BCB-4033-ACB9-23F3FCA65309"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8845_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5B47BF35-3AA0-4667-842E-19B0FE30BF3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8845:-:*:*:*:*:*:*:*","matchCriteriaId":"8A071672-9405-4418-9141-35CEADBB65AF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8845h_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB7CF473-8B25-4851-91F2-1BD693CCDC85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8845h:-:*:*:*:*:*:*:*","matchCriteriaId":"91E591F2-8F72-4A5A-9264-2742EB2DABDA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8850_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FA243934-7BFA-47AA-B78C-CCB25377E471"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8850:-:*:*:*:*:*:*:*","matchCriteriaId":"2FD65035-4D20-48D5-874E-47CD9C7A985C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8850w_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22707187-A56D-48AD-800F-A438FD844546"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8850w:-:*:*:*:*:*:*:*","matchCriteriaId":"F526A54A-F974-4D0A-A1A6-FABBB6711CD0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8855c_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"671E0B82-5D58-4644-8806-7F4CAFFB6641"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8855c:-:*:*:*:*:*:*:*","matchCriteriaId":"CC066321-B3CC-4E88-BFA9-414B8D095207"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:x1e80100_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42F453E4-02CC-4E48-A25B-F1394069F524"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:x1e80100:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6671AE-3490-4D85-A20C-3DA26F7D7AEB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:xrv7209_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CC6C6243-E092-4903-BC20-E3B0CECBC790"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:xrv7209:-:*:*:*:*:*:*:*","matchCriteriaId":"AAA33761-D61C-4A81-B233-5E2D50F3596F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:xrv9209_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D693483-72F9-42B1-8EDA-8DABD537F428"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:xrv9209:-:*:*:*:*:*:*:*","matchCriteriaId":"43F4A7D9-055D-475B-BFE4-61A86C7397F8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm2290_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5AB1F0FA-25F3-4304-A3BC-5264E55CC092"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm2290:-:*:*:*:*:*:*:*","matchCriteriaId":"214A053F-D80C-4AD9-B4F1-83384095A3F3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm4290_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3C7FFB96-53E7-41A2-BC99-7ACD853214A8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm4290:-:*:*:*:*:*:*:*","matchCriteriaId":"74EBA77E-69A5-4145-9BEC-CD39BA132309"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm4325_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F2D8044B-D4E5-4174-A0FB-478F8434EE8F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm4325:-:*:*:*:*:*:*:*","matchCriteriaId":"163FE96E-DF5B-4B67-8EDE-44A5B9A8492D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm4490_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DA506489-4338-44DF-8F92-12E60AF0048C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm4490:-:*:*:*:*:*:*:*","matchCriteriaId":"A8718C37-A82A-4A08-A887-3F22B37601A9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm5430_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4EC5F81B-AA24-4E3C-9FC8-53E010AC977E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm5430:-:*:*:*:*:*:*:*","matchCriteriaId":"B5C66DAD-0D85-46B8-92D7-6D68B9429E9A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm6490_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"ADD6D51E-5787-42A6-8A02-4EBBAFFF9C94"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm6490:-:*:*:*:*:*:*:*","matchCriteriaId":"99AA0291-B822-4CAD-BA17-81B632FC3FEF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm8838_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7C6535AE-8680-4AB9-ABF6-82DAE1795531"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm8838:-:*:*:*:*:*:*:*","matchCriteriaId":"9C3FEACB-1AE1-4BF2-9552-C31A32DCCA9B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcn9011_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9306C34D-47E4-40CF-89F4-BA5263655D13"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcn9011:-:*:*:*:*:*:*:*","matchCriteriaId":"02BA009F-24E1-4953-BA95-2A5BC1CDBDBB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcn9012_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"61F34DD2-9DC0-49E5-BC85-1543EA199477"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcn9012:-:*:*:*:*:*:*:*","matchCriteriaId":"1A06879F-6FE9-448A-8186-8347D76F872B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs2290_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"93CDB7BC-89F2-4482-B8E3-9DDBD918C851"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs2290:-:*:*:*:*:*:*:*","matchCriteriaId":"76E03AE9-2485-449B-BCFD-3E452BB01FC6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs4290_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"06789CB9-E6FA-400D-90B6-C2DB6C8EF153"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs4290:-:*:*:*:*:*:*:*","matchCriteriaId":"FFCB9F22-57F2-4327-95B9-B2342A02E45E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs4490_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3336CDD7-9E7B-4FFB-A5CE-594B19B63A6C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs4490:-:*:*:*:*:*:*:*","matchCriteriaId":"1197E229-1E27-4CA3-A386-B77FAE5DFE1A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs6690_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F8AD50C4-E725-48B8-8291-A62EF153D50A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs6690:-:*:*:*:*:*:*:*","matchCriteriaId":"4B5A7BC1-E4B1-486C-A433-D206A42A1356"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs8550_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FFF23DDB-98A0-4343-ADD3-5AB9C2383E7E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs8550:-:*:*:*:*:*:*:*","matchCriteriaId":"5ACB8AFB-5B91-4AA1-BA3A-1AF0B3503080"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qln1083bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FD70F234-1EE7-4362-97F6-5AEDB7078D03"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qln1083bd:-:*:*:*:*:*:*:*","matchCriteriaId":"C569A848-B70C-42EF-B6D5-4A86547586EE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qln1086bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F218DF06-C40A-4738-ABB5-A3FA2243EF84"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qln1086bd:-:*:*:*:*:*:*:*","matchCriteriaId":"2E2A0CD0-66FA-45D6-BBC7-03641203EC73"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qmp1000_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5298473D-8B34-42E6-BC32-69A3800972B4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qmp1000:-:*:*:*:*:*:*:*","matchCriteriaId":"2A1CF44E-FFC2-4DCB-8DC2-46422D912448"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qmp2001_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0B53AF78-37B0-4D64-A7D3-1729D0248D61"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qmp2001:-:*:*:*:*:*:*:*","matchCriteriaId":"560E36D2-27DB-4590-A879-C2071ED72641"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qna715_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7B3FD468-BE2F-4C80-843B-7EC3845F6923"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qna715:-:*:*:*:*:*:*:*","matchCriteriaId":"342A6C3B-5128-40C5-BB3B-151D5B6C7BDA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qpa1083bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B0208F7B-A959-485E-B004-A34CB7C7C4C9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qpa1083bd:-:*:*:*:*:*:*:*","matchCriteriaId":"FBDAC812-4603-4D24-A861-23825E32D44E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qpa1086bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7F6DEF72-A8FF-4B67-AA6C-5CB4AA7B35E1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qpa1086bd:-:*:*:*:*:*:*:*","matchCriteriaId":"00EF6875-B088-40BD-A526-C962789CDC5A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_8800_mobile_connectivity_system_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"28C65092-164F-40B7-8DCF-0F72F19C1CC3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_8800_mobile_connectivity_system:-:*:*:*:*:*:*:*","matchCriteriaId":"C3813BD8-2228-414D-BB2B-E3C00210404A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:video_collaboration_vc1_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C3607443-848D-4334-B5E4-0DC27F28509B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:video_collaboration_vc1_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"2E8F00DD-C894-4236-8932-7F7FCD15D2A5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:video_collaboration_vc3_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DD4946C6-778F-4542-AB77-C9B86AF25C05"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:video_collaboration_vc3_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"6F1D604A-4530-42B3-80A0-58A82D658DDD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:video_collaboration_vc5_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"87CF9AD4-6E1B-47E8-B441-022A03858875"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:video_collaboration_vc5_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"791C1E60-162D-4881-80D5-895658FEC47E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1083_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0CE74B89-5E3F-428E-8000-E3452B8B6953"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1083:-:*:*:*:*:*:*:*","matchCriteriaId":"DC11B7A6-E621-463D-B861-6B203EADFA57"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1086_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E48759CC-B751-4466-87DF-2D0AB220C0FB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1086:-:*:*:*:*:*:*:*","matchCriteriaId":"E7F1C9D2-6616-4F74-85C2-1850B5C3F6BC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1093_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9A46B609-BD06-4BB7-B055-1F71C555E93D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1093:-:*:*:*:*:*:*:*","matchCriteriaId":"59598462-1E53-4F6D-BAB5-06ACEDF6CD9F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1094_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8F30D66E-2802-4394-BC39-5E04711234FF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1094:-:*:*:*:*:*:*:*","matchCriteriaId":"078EC383-784F-4468-B94C-AE7CC9808419"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1095_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B7B67C93-0453-4696-8F3D-0AD664922C44"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1095:-:*:*:*:*:*:*:*","matchCriteriaId":"D61C46AA-9130-46A8-BD04-8B4235118B81"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1096_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2E2D5E44-48F6-41E8-A38B-A2E070E16AA9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1096:-:*:*:*:*:*:*:*","matchCriteriaId":"9BD0372F-5140-4966-9A27-6B5A606C0665"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:robotics_rb2_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"76F5D880-7BBD-4B33-AC47-9B5C4AA49A36"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:robotics_rb2_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"3D0194E5-328D-4E53-A1F2-1CFE333217F4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa7255p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2B651F0A-34DA-400F-A376-B499BFDF8E86"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa7255p:-:*:*:*:*:*:*:*","matchCriteriaId":"4CFF093D-98C8-470F-8330-E5126E06343A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa7775p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6C32CA38-5D48-4108-9858-FD66E20CAF2F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa7775p:-:*:*:*:*:*:*:*","matchCriteriaId":"E1997F8B-17B8-4DE3-BCF7-726928720592"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8255p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EC6E268D-C4AF-4950-9223-39EA36D538A8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8255p:-:*:*:*:*:*:*:*","matchCriteriaId":"073C1A81-D02B-4F2F-9378-CD1B2DCE0E5B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8620p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6ACE6D64-A498-482F-8270-718F4884CFFD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8620p:-:*:*:*:*:*:*:*","matchCriteriaId":"B6E016D6-1B83-4261-A27E-1F9873F81E14"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8770p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"781CCC31-C08F-499B-BE73-6C7DB70437AF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8770p:-:*:*:*:*:*:*:*","matchCriteriaId":"75AFAA21-0589-4C6A-9418-34EE8A61BBAD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa9000p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A024AB04-B213-4018-A4C1-FA467C7BA775"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa9000p:-:*:*:*:*:*:*:*","matchCriteriaId":"A2A8AB7C-5D34-4794-8C06-2193075B323F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sar1165p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D97CD52-4CB0-4F57-9C24-530B326B8D9D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sar1165p:-:*:*:*:*:*:*:*","matchCriteriaId":"582EE932-DDE5-4BE5-837C-523FE3EFBA5D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sar2130p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"95696696-D2AE-4358-AF5D-3ED14F969964"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sar2130p:-:*:*:*:*:*:*:*","matchCriteriaId":"1A6FC469-463F-4EC1-B4EF-010BDB9BAA05"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_480_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA3F11F3-C9F4-460D-BD77-1BFBCC1F0592"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_480_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"25673A10-D99C-4F67-BDA7-9C2E4A70EF9C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_480\\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"50906EF2-01F7-4E97-9F49-F892DF41CB29"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_480\\+_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"B23A89FF-9C94-40C6-B9B7-3E8354777916"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_6_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EBB3BC1B-2EBC-457C-AE91-6BD408EB7D5F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_6_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"0870CC30-07F8-4FFF-85B4-FBACE947CC14"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_6_gen_3_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D69E4203-EA20-4D6F-BD1C-C8E550588F87"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_6_gen_3_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"C1225010-5A08-4D13-A3E2-4C57C4265605"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_6_gen_4_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"20ABA235-1380-4D76-A248-36A6E905AEB2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_6_gen_4_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"923775B3-1916-4E60-A888-574AB3F3E282"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_680_4g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8D0ED00F-1345-43AD-83C6-E979890B84AB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_680_4g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"92C28019-B57D-4487-B551-F7B53395C6E5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_685_4g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C174F07D-0E33-43FD-9BAD-6C6D8B51B6A6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_685_4g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"47311B68-A07F-448B-99D5-9C92C8127A81"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_695_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A9A2DA11-5E4E-4E36-923C-A2D3CC2F2751"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_695_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"BE7DFAD4-1D21-4A3A-9E8C-10F00AD7C403"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"677D5A3F-2A0D-48F0-A1C5-B067BADFD11A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"CB79B015-A401-4FAD-8818-1475653C2B12"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7_gen_4_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"48BB1413-6719-4026-9154-0AF3BA32C26B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7_gen_4_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"97851334-202F-4695-A4B2-6D0B221D6E23"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7\\+_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C8E41CBD-D6AD-41CF-A469-92A7E228BBB6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7\\+_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"57E0BA08-3BF4-4E84-BBA9-B48F84197F9D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_778g_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"87ECCB82-B880-412D-A635-CA6F0B035F2B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_778g_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"424743C4-CE74-4A02-835A-023C9DA0CFAC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_778g\\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14EA48BF-BD65-43B2-8DC1-D97F75AD6FE5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_778g\\+_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"B86E317F-12BF-42F6-879B-88A85F7E3F81"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_782g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"194A4BD4-0DDF-49E5-AA89-40A5BFB71933"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_782g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"72FF9732-40D8-4C12-8259-BAA16FAB5A56"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7c\\+_gen_3_compute_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C4A050CA-8514-400A-A6B3-F513CC93CA14"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7c\\+_gen_3_compute:-:*:*:*:*:*:*:*","matchCriteriaId":"BD850305-1E76-4952-A3FB-F6229CBF7FE9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7s_gen_3_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BBD338C6-F731-4B5D-9DE1-32259A23FBC2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7s_gen_3_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"3AB83DA5-30ED-44E8-8517-1988B2D1EC6B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_elite_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EA50192-07B0-4404-93D4-EC4F3B1918B7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_elite:-:*:*:*:*:*:*:*","matchCriteriaId":"26C7FC48-08CB-4E50-B8D3-8AF30549FDF8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_elite_gen_5_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"41070BDB-15E4-4DD7-A132-A14AA24978E5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_elite_gen_5:-:*:*:*:*:*:*:*","matchCriteriaId":"102460A6-9637-4883-9230-2CC888D5D74E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EB8FA32F-4690-4C5B-8968-474DA32FD0A4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"59BD8BEA-725A-4158-84BE-4AFD476ED03D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"60F5899C-BA8D-4B6B-BC61-F77B1EB64739"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"D39AD7CE-A017-4D74-A348-9E4B08363799"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen_3_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0FAB6D60-1C03-4F85-B874-FF169402ED09"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen_3_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"C89A8D93-46DA-4547-A9F1-076FC0D5119D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen_5_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4D8D8AD-B291-4AEC-8817-D7C99E79FF49"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen_5:-:*:*:*:*:*:*:*","matchCriteriaId":"8CA08EA8-A47E-4797-8644-0A48D509939C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8\\+_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"59CB6F2F-7C95-498B-9F9E-728930FD24A7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8\\+_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"284E62AF-2E4D-4E82-AC9A-F27DA71735EF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8\\+_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1FEDF458-DEA7-42A1-A56D-E11250139545"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8\\+_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"D5693438-0F20-47BB-BA32-7175C3152368"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_888_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22A78236-5965-4F65-9001-3FE7FF6D27E8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_888_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"414C5C1D-A5DA-47C7-B6C9-3564DD4DD911"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_888\\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"01CBD543-635C-4C57-87B7-55DD3BA3C1A2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_888\\+_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"6A7272B6-AADB-4CCD-B041-66170C313C76"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_ar1_gen_1_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"53E5BBDA-C07D-42E2-9A34-EC1F6454CAA4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_ar1_gen_1_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"0BB2408F-C768-4DD2-B834-B62E188D6CC2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_ar1\\+_gen_1_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BE30A5E0-10D5-4679-ACA6-4ED991335A6F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_ar1\\+_gen_1_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"CFA75B74-D20D-4C8B-BFA2-5DE4848410CD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_ride_elite_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4E50C2D-229B-4B78-8567-CD603DE2A767"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_ride_elite:-:*:*:*:*:*:*:*","matchCriteriaId":"6C5ECF68-EB2E-46B5-AEC3-0744D4C9215A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_x53_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4F80E77B-B207-4E49-99EF-A1F9ECFAAC99"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_x53_5g_modem-rf_system:-:*:*:*:*:*:*:*","matchCriteriaId":"9A12A6DC-63A2-4B52-971A-C014E40C1E6D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_xr2_5g_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1A129620-8241-4A47-AAC8-CC7E10A09C9C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_xr2_5g_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"4CEDD78E-124C-4216-9B57-3B7B53463659"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_xr2\\+_gen_1_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BF9740EB-F82E-42EA-993E-A393B05CC6BB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_xr2\\+_gen_1_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"022A5532-03F7-4FB8-BA0D-4221178C9486"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_cockpit_elite_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D4E05762-315D-46A9-93DB-435DB78FEE71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_cockpit_elite:-:*:*:*:*:*:*:*","matchCriteriaId":"5028FDF9-6852-4C88-97D8-CE6392960A55"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_reality_elite_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"08ACBE23-DBE3-4AE0-B9EA-F3A73290D5F0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_reality_elite_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"3F82A885-4CAB-44F2-85FA-3D581283A936"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_wear_elite_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"21C295D3-AC5D-4DFC-A0B1-3B5F7C08DC46"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_wear_elite_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"A32D44E3-02FC-47AA-B6FF-E87F5866E453"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:srv1h_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0CD199F5-DA68-4BEB-AA99-11572DA26B4F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:srv1h:-:*:*:*:*:*:*:*","matchCriteriaId":"8ACA2D4D-FC77-4C1A-8278-1C27B3EA3303"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:srv1m_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4B29E7F-8BFE-466A-B357-63F8A2160C4E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:srv1m:-:*:*:*:*:*:*:*","matchCriteriaId":"6D55CC7D-2E65-4CA9-9892-B6FBCC087E6F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sw5100_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AA1BF9BB-AF11-46A7-A71C-F7D289E76E3F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sw5100:-:*:*:*:*:*:*:*","matchCriteriaId":"7B8455D6-287D-4934-8E4D-F4127A9C0449"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sw5100p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DB599A9F-0305-4FE4-8623-0F86630FEDCB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sw5100p:-:*:*:*:*:*:*:*","matchCriteriaId":"EEB883BF-68B2-4C25-84DC-5DA953BFAA2F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sxr2230p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD6444F6-A477-4B4C-8A09-C22C47CCE45B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sxr2230p:-:*:*:*:*:*:*:*","matchCriteriaId":"F3E20681-4FC4-46E2-AF77-BCF03BC8E77E"}]}]}],"references":[{"url":"https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2026-bulletin.html","source":"product-security@qualcomm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-25272","sourceIdentifier":"product-security@qualcomm.com","published":"2026-10-06T07:16:57.490","lastModified":"2026-10-09T14:11:05.773","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Memory Corruption when processing camera CRE driver operations with improper handling of buffer limits during hardware update preparation."}],"affected":[{"source":"product-security@qualcomm.com","affectedData":[{"vendor":"Qualcomm, Inc.","product":"Snapdragon","defaultStatus":"unaffected","platforms":["Snapdragon Auto","Snapdragon CCW","Snapdragon Compute","Snapdragon Consumer IOT","Snapdragon Industrial IOT","Snapdragon Mobile","Snapdragon WBC"],"versions":[{"version":"Cologne","status":"affected"},{"version":"CQ7790","status":"affected"},{"version":"CQ8725S","status":"affected"},{"version":"CQ8750M","status":"affected"},{"version":"FastConnect 6700","status":"affected"},{"version":"FastConnect 6900","status":"affected"},{"version":"FastConnect 7800","status":"affected"},{"version":"IQ10 Series","status":"affected"},{"version":"IQ6 Series Platform","status":"affected"},{"version":"IQ8 Series Platform","status":"affected"},{"version":"IQ9 Series Platform","status":"affected"},{"version":"LeMans_AU_LGIT","status":"affected"},{"version":"LeMansAU","status":"affected"},{"version":"MBM415","status":"affected"},{"version":"MBM715","status":"affected"},{"version":"Milos","status":"affected"},{"version":"Monaco_IOT","status":"affected"},{"version":"Orne","status":"affected"},{"version":"Palawan25","status":"affected"},{"version":"Pandeiro","status":"affected"},{"version":"QAM8255P","status":"affected"},{"version":"QAMSRV1H","status":"affected"},{"version":"QAMSRV1M","status":"affected"},{"version":"QCA6391","status":"affected"},{"version":"QCA6595","status":"affected"},{"version":"QCA6595AU","status":"affected"},{"version":"QCA6678AQ","status":"affected"},{"version":"QCA6698AQ","status":"affected"},{"version":"QCA6698AU","status":"affected"},{"version":"QCA6797AQ","status":"affected"},{"version":"QCA8695AU","status":"affected"},{"version":"QCM5430","status":"affected"},{"version":"QCM6490","status":"affected"},{"version":"QCM8550","status":"affected"},{"version":"QCM8838","status":"affected"},{"version":"QCN9011","status":"affected"},{"version":"QCN9012","status":"affected"},{"version":"QCN9274","status":"affected"},{"version":"QCS8550","status":"affected"},{"version":"QLN1083BD","status":"affected"},{"version":"QLN1086BD","status":"affected"},{"version":"QMP1000","status":"affected"},{"version":"QPA1083BD","status":"affected"},{"version":"QPA1086BD","status":"affected"},{"version":"Qualcomm Dragonwing Q-6690","status":"affected"},{"version":"Qualcomm Dragonwing Q-7790","status":"affected"},{"version":"Qualcomm Dragonwing Q-8845","status":"affected"},{"version":"Qualcomm Dragonwing QCM4490","status":"affected"},{"version":"Qualcomm Video Collaboration VC3 Platform","status":"affected"},{"version":"QXM1083","status":"affected"},{"version":"QXM1086","status":"affected"},{"version":"QXM1093","status":"affected"},{"version":"QXM1094","status":"affected"},{"version":"QXM1095","status":"affected"},{"version":"QXM1096","status":"affected"},{"version":"SA7255P","status":"affected"},{"version":"SA7775P","status":"affected"},{"version":"SA8255P","status":"affected"},{"version":"SA8620P","status":"affected"},{"version":"SA8770P","status":"affected"},{"version":"SA9000P","status":"affected"},{"version":"SAR1165P","status":"affected"},{"version":"SAR2130P","status":"affected"},{"version":"SC8380XP","status":"affected"},{"version":"SD 8 Gen1 5G","status":"affected"},{"version":"SD865 5G","status":"affected"},{"version":"SDR753","status":"affected"},{"version":"SM6650P","status":"affected"},{"version":"SM7635P","status":"affected"},{"version":"SM7675","status":"affected"},{"version":"SM7675P","status":"affected"},{"version":"SM8550P","status":"affected"},{"version":"SM8635","status":"affected"},{"version":"SM8635P","status":"affected"},{"version":"SM8650Q","status":"affected"},{"version":"SM8750P","status":"affected"},{"version":"Snapdragon 4 Gen 2 Mobile Platform","status":"affected"},{"version":"Snapdragon 6 Gen 4 Mobile Platform","status":"affected"},{"version":"Snapdragon 7 Gen 4 Mobile Platform","status":"affected"},{"version":"Snapdragon 7s Gen 3 Mobile Platform","status":"affected"},{"version":"Snapdragon 8 Elite","status":"affected"},{"version":"Snapdragon 8 Elite Gen 5","status":"affected"},{"version":"Snapdragon 8 Gen 1 Mobile Platform","status":"affected"},{"version":"Snapdragon 8 Gen 2 Mobile Platform","status":"affected"},{"version":"Snapdragon 8 Gen 3 Mobile Platform","status":"affected"},{"version":"Snapdragon 8+ Gen 1 Mobile Platform","status":"affected"},{"version":"Snapdragon 8+ Gen 2 Mobile Platform","status":"affected"},{"version":"Snapdragon AR1 Gen 1 Platform","status":"affected"},{"version":"Snapdragon AR1+ Gen 1 Platform","status":"affected"},{"version":"Snapdragon Ride Elite","status":"affected"},{"version":"Snapdragon XR2 5G Platform","status":"affected"},{"version":"Snapdragon XR2+ Gen 1 Platform","status":"affected"},{"version":"Snapdragon Cockpit Elite","status":"affected"},{"version":"Snapdragon Reality Elite Platform","status":"affected"},{"version":"SRV1H","status":"affected"},{"version":"SRV1M","status":"affected"},{"version":"SW-only","status":"affected"},{"version":"SXR2230P","status":"affected"},{"version":"SXR2250P","status":"affected"},{"version":"TalynPlus","status":"affected"},{"version":"WCD9370","status":"affected"},{"version":"WCD9375","status":"affected"},{"version":"WCD9378","status":"affected"},{"version":"WCD9380","status":"affected"},{"version":"WCD9385","status":"affected"},{"version":"WCD9390","status":"affected"},{"version":"WCD9395","status":"affected"},{"version":"WCN3950","status":"affected"},{"version":"WCN3988","status":"affected"},{"version":"WCN6450","status":"affected"},{"version":"WCN6650","status":"affected"},{"version":"WCN6755","status":"affected"},{"version":"WCN7860","status":"affected"},{"version":"WCN7861","status":"affected"},{"version":"WCN7880","status":"affected"},{"version":"WCN7881","status":"affected"},{"version":"WSA8810","status":"affected"},{"version":"WSA8815","status":"affected"},{"version":"WSA8830","status":"affected"},{"version":"WSA8832","status":"affected"},{"version":"WSA8835","status":"affected"},{"version":"WSA8840","status":"affected"},{"version":"WSA8845","status":"affected"},{"version":"WSA8845H","status":"affected"},{"version":"X1E80100","status":"affected"},{"version":"XRV7209","status":"affected"},{"version":"XRV9209","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"product-security@qualcomm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T12:30:23.264246Z","id":"CVE-2026-25272","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"product-security@qualcomm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_g1_gen_2_gaming_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"905C9267-C1B5-4A77-BC33-118986A907C7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_g1_gen_2_gaming_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"671C9107-7E54-4FBC-B03D-1EB4DCD8597E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cologne_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8FF959C0-5AAB-4DC5-AE8F-4EFA21A00B5E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cologne:-:*:*:*:*:*:*:*","matchCriteriaId":"E31E0C48-FB61-47C8-B28B-3A701E85E126"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq2390m_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8DAB4A10-45A2-47B2-AAED-46DCC9740396"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq2390m:-:*:*:*:*:*:*:*","matchCriteriaId":"F793F65B-324E-416A-B9CD-0496F5E9CB8C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq2390s_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B0928CC-C507-4437-946B-B2AD400E9B3E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq2390s:-:*:*:*:*:*:*:*","matchCriteriaId":"E6FAF059-0D17-40DD-B0DA-A708081F6062"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq8750m_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23301B23-E3B8-4FFA-BC7A-33FDDEEDC425"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq8750m:-:*:*:*:*:*:*:*","matchCriteriaId":"F05B2437-B6C0-41C4-818E-12AFE616D790"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7675_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"012C20A8-3F48-48DD-9A77-65C9CB1F6C30"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7675:-:*:*:*:*:*:*:*","matchCriteriaId":"EE992A86-36BC-40E3-8E96-6542560BE8EC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7675p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3B46F132-4049-40D0-8351-C1C6FD2B47A0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7675p:-:*:*:*:*:*:*:*","matchCriteriaId":"1846514C-1F95-4568-98DE-C57214401841"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7750p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B8A511E-B43B-4617-A3B3-03F4EE80CA1D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7750p:-:*:*:*:*:*:*:*","matchCriteriaId":"BAE215A4-3860-45B1-BDFC-B614692F7905"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8475p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8DBF6AE8-605B-4E72-BD3B-0B6C390FCE32"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8475p:-:*:*:*:*:*:*:*","matchCriteriaId":"26AAE148-96B6-4FDE-BABD-48F607464A38"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8550p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C4CDD6A2-5A3C-4572-8CE1-2F102333BB79"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8550p:-:*:*:*:*:*:*:*","matchCriteriaId":"699E5D17-6144-4F0A-8D52-1E8C83990E52"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8635_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"65865EE9-59C0-498F-A4C5-EC00D4642603"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8635:-:*:*:*:*:*:*:*","matchCriteriaId":"CE02AB51-6FB6-4727-999B-A7466CEDC534"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8635p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"88F63D90-4BFC-4EFA-8B74-7A5027A7052D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8635p:-:*:*:*:*:*:*:*","matchCriteriaId":"20EB529B-6B9F-464F-A98B-A8ABE0F01ADB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8650q_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1CAA8D9D-0238-4223-8F7B-134ECBB6FA05"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8650q:-:*:*:*:*:*:*:*","matchCriteriaId":"D8A722B8-E1E4-43B4-8882-591CE8C5C166"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8735p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B24D04FB-6823-452C-8F0D-0088E9B402EC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8735p:-:*:*:*:*:*:*:*","matchCriteriaId":"B9CCD62E-F9D1-4CF9-9595-3BF28DED89AC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8750p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4D8ABDBF-BABC-4219-8A18-BDFC8C826B1F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8750p:-:*:*:*:*:*:*:*","matchCriteriaId":"685D81D0-7E95-4DBA-A05B-7C708A5DFDF0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8845p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A205320E-6C60-4F6A-90D5-06CABAF0FDEA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8845p:-:*:*:*:*:*:*:*","matchCriteriaId":"0FB8CE86-605E-4B3D-82E5-A55093ABCE5F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_4_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"55AECCCF-0761-46B6-B669-E73096679AFB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_4_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"7DE87CA2-160A-43BF-AC18-DA788501B5B4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_6_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EBB3BC1B-2EBC-457C-AE91-6BD408EB7D5F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_6_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"0870CC30-07F8-4FFF-85B4-FBACE947CC14"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_6_gen_3_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D69E4203-EA20-4D6F-BD1C-C8E550588F87"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_6_gen_3_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"C1225010-5A08-4D13-A3E2-4C57C4265605"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_6_gen_4_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"20ABA235-1380-4D76-A248-36A6E905AEB2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_6_gen_4_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"923775B3-1916-4E60-A888-574AB3F3E282"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"677D5A3F-2A0D-48F0-A1C5-B067BADFD11A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"CB79B015-A401-4FAD-8818-1475653C2B12"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7_gen_4_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"48BB1413-6719-4026-9154-0AF3BA32C26B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7_gen_4_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"97851334-202F-4695-A4B2-6D0B221D6E23"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7\\+_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C8E41CBD-D6AD-41CF-A469-92A7E228BBB6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7\\+_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"57E0BA08-3BF4-4E84-BBA9-B48F84197F9D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7s_gen_3_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BBD338C6-F731-4B5D-9DE1-32259A23FBC2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7s_gen_3_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"3AB83DA5-30ED-44E8-8517-1988B2D1EC6B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_elite_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EA50192-07B0-4404-93D4-EC4F3B1918B7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_elite:-:*:*:*:*:*:*:*","matchCriteriaId":"26C7FC48-08CB-4E50-B8D3-8AF30549FDF8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_elite_gen_5_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"41070BDB-15E4-4DD7-A132-A14AA24978E5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_elite_gen_5:-:*:*:*:*:*:*:*","matchCriteriaId":"102460A6-9637-4883-9230-2CC888D5D74E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EB8FA32F-4690-4C5B-8968-474DA32FD0A4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"59BD8BEA-725A-4158-84BE-4AFD476ED03D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"60F5899C-BA8D-4B6B-BC61-F77B1EB64739"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"D39AD7CE-A017-4D74-A348-9E4B08363799"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen_3_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0FAB6D60-1C03-4F85-B874-FF169402ED09"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen_3_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"C89A8D93-46DA-4547-A9F1-076FC0D5119D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen_5_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4D8D8AD-B291-4AEC-8817-D7C99E79FF49"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen_5:-:*:*:*:*:*:*:*","matchCriteriaId":"8CA08EA8-A47E-4797-8644-0A48D509939C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8\\+_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"59CB6F2F-7C95-498B-9F9E-728930FD24A7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8\\+_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"284E62AF-2E4D-4E82-AC9A-F27DA71735EF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8\\+_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1FEDF458-DEA7-42A1-A56D-E11250139545"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8\\+_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"D5693438-0F20-47BB-BA32-7175C3152368"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_ar1_gen_1_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"53E5BBDA-C07D-42E2-9A34-EC1F6454CAA4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_ar1_gen_1_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"0BB2408F-C768-4DD2-B834-B62E188D6CC2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_ar1\\+_gen_1_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BE30A5E0-10D5-4679-ACA6-4ED991335A6F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_ar1\\+_gen_1_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"CFA75B74-D20D-4C8B-BFA2-5DE4848410CD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_ride_elite_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4E50C2D-229B-4B78-8567-CD603DE2A767"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_ride_elite:-:*:*:*:*:*:*:*","matchCriteriaId":"6C5ECF68-EB2E-46B5-AEC3-0744D4C9215A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_xr2_5g_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1A129620-8241-4A47-AAC8-CC7E10A09C9C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_xr2_5g_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"4CEDD78E-124C-4216-9B57-3B7B53463659"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_xr2\\+_gen_1_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BF9740EB-F82E-42EA-993E-A393B05CC6BB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_xr2\\+_gen_1_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"022A5532-03F7-4FB8-BA0D-4221178C9486"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_cockpit_elite_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D4E05762-315D-46A9-93DB-435DB78FEE71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_cockpit_elite:-:*:*:*:*:*:*:*","matchCriteriaId":"5028FDF9-6852-4C88-97D8-CE6392960A55"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_reality_elite_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"08ACBE23-DBE3-4AE0-B9EA-F3A73290D5F0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_reality_elite_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"3F82A885-4CAB-44F2-85FA-3D581283A936"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:srv1h_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0CD199F5-DA68-4BEB-AA99-11572DA26B4F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:srv1h:-:*:*:*:*:*:*:*","matchCriteriaId":"8ACA2D4D-FC77-4C1A-8278-1C27B3EA3303"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:srv1m_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4B29E7F-8BFE-466A-B357-63F8A2160C4E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:srv1m:-:*:*:*:*:*:*:*","matchCriteriaId":"6D55CC7D-2E65-4CA9-9892-B6FBCC087E6F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sxr2230p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD6444F6-A477-4B4C-8A09-C22C47CCE45B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sxr2230p:-:*:*:*:*:*:*:*","matchCriteriaId":"F3E20681-4FC4-46E2-AF77-BCF03BC8E77E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sxr2250p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"68A93ED1-F509-439E-AE7B-F0EC87AE759F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sxr2250p:-:*:*:*:*:*:*:*","matchCriteriaId":"FB5E2A98-EDD0-4298-911D-EC7527D5A424"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9370_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1295D869-F4DD-4766-B4AA-3513752F43B4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9370:-:*:*:*:*:*:*:*","matchCriteriaId":"B98784DC-3143-4D38-AD28-DBBDCCAB4272"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9371_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2503805B-B2A6-4AEE-8AB1-2B8A040702BD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9371:-:*:*:*:*:*:*:*","matchCriteriaId":"D3AD370C-2ED0-43CF-83D9-50DC92A01CA5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq8845s_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4FB1D261-4C1B-4D43-B8ED-975E526A2FF5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq8845s:-:*:*:*:*:*:*:*","matchCriteriaId":"54AC5C16-88A9-4C16-B7AF-835E53D7DFA4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq8850ns_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"867A0C11-FBA0-46F1-871F-1800A7A75BB3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq8850ns:-:*:*:*:*:*:*:*","matchCriteriaId":"9885533F-4021-429D-917F-0A2733725B43"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6200_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CDE1CBDE-3D28-463C-B215-AA7DF373EF09"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6200:-:*:*:*:*:*:*:*","matchCriteriaId":"66BD3B88-7CF9-482D-A2DD-67F6ACF4CC57"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6700_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"82B82E87-F3F4-466F-A76B-C8809121FF6F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6700:-:*:*:*:*:*:*:*","matchCriteriaId":"419A132E-E42C-4395-B74B-788A39DF1D13"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6900_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E670F500-9B71-4BBE-B5DA-221D35803C89"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6900:-:*:*:*:*:*:*:*","matchCriteriaId":"9ADEB5C5-B79A-4F45-B7D3-75945B38DB6C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_7800_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B3053D68-C5D8-4D47-A4F0-9F3AF2289E1D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_7800:-:*:*:*:*:*:*:*","matchCriteriaId":"638DBC7F-456F-487D-BED2-2214DFF8BEE2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:g2_gen_1_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"924DFF0F-E8B2-4B94-9B98-E0C2D6313C87"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:g2_gen_1:-:*:*:*:*:*:*:*","matchCriteriaId":"2A5E644B-D05F-4241-8E20-4A6DA1A56695"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:g3x_gen_2_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C167BE19-999E-4538-A23E-01F9C287A6C7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:g3x_gen_2:-:*:*:*:*:*:*:*","matchCriteriaId":"1026CB5F-E30A-42DE-8432-74412CC8BA00"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iq-615_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D2B2D5D-0213-4979-ACBF-BEF843166047"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iq-615:-:*:*:*:*:*:*:*","matchCriteriaId":"CE575B0C-DDE4-4E5A-9FE8-03305C804558"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iq-8275_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"253BF0D2-D24D-4EE3-A157-9853BBB368F2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iq-8275:-:*:*:*:*:*:*:*","matchCriteriaId":"78C6B840-62E9-4DDD-9376-2F7A8FB9D589"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iq-9075_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"08431A88-C176-48BB-918C-DF3FEABE78D4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iq-9075:-:*:*:*:*:*:*:*","matchCriteriaId":"3C50A35E-023A-404D-BFBC-FFCD1F30E872"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:lemans_au_lgit_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5767FE95-737F-4C20-A5AB-EC641A68D906"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:lemans_au_lgit:-:*:*:*:*:*:*:*","matchCriteriaId":"33323A49-9267-421B-96E1-80C5FA709EBC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:lemansau_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2DF0ED3F-C98B-458E-ADCC-C922402BB185"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:lemansau:-:*:*:*:*:*:*:*","matchCriteriaId":"102A4B5E-1739-4C31-A626-ABF6B02FEE29"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:mbm415_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"06917C11-6ABA-4972-A4A5-AEA69A5E73FE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:mbm415:-:*:*:*:*:*:*:*","matchCriteriaId":"9B1C6B87-2B59-4220-BC0D-7CE30F514728"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:mbm715_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F9E2ED64-0268-4C88-9553-D6EF646C3BA1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:mbm715:-:*:*:*:*:*:*:*","matchCriteriaId":"861D5B95-47E1-4374-9EF6-157516FF5171"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:milos_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22EFC07D-16C3-4CCC-A928-EA5EA69CAB65"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:milos:-:*:*:*:*:*:*:*","matchCriteriaId":"0D3491C1-A427-4CEC-B8BD-6A1930E6827F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:milos_iot_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"18471E2B-412C-4D07-9997-C8663902D7B5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:milos_iot:-:*:*:*:*:*:*:*","matchCriteriaId":"0284E269-A212-4474-AE46-255D5245096F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:monaco_iot_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D071BA3E-36AE-40E5-88FB-04012ABECBD2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:monaco_iot:-:*:*:*:*:*:*:*","matchCriteriaId":"F9FB6B54-7F16-497D-B211-327744F35ECB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:netrani_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9C52A53B-1182-47F3-9800-D8C58F954277"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:netrani:-:*:*:*:*:*:*:*","matchCriteriaId":"BEC1F084-78C8-4413-940A-47E9554CB6D0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:orne_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"19FB8345-BBFC-4E18-A4E6-64A159D7F65B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:orne:-:*:*:*:*:*:*:*","matchCriteriaId":"FFDA4056-3F1B-4F3A-BE59-1908BD3DE5E9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:palawan25_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C18C3535-3074-41DE-B40F-F3055BAFF686"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:palawan25:-:*:*:*:*:*:*:*","matchCriteriaId":"7B590B1E-06D1-4C99-BDDF-4A086BEBB4C7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:pandeiro_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F8EF0C-BB48-47E1-A045-254D79388F75"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:pandeiro:-:*:*:*:*:*:*:*","matchCriteriaId":"058950FC-ED72-4E91-AE13-87E738ADC083"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qam8255p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3723C7B1-A7E2-401F-8D6D-189350F6BCA5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qam8255p:-:*:*:*:*:*:*:*","matchCriteriaId":"B12B89EF-7B12-481E-BCBC-F12B9D16321A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qamsrv1h_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F8673334-5E11-4E95-B33D-3029499F71DF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qamsrv1h:-:*:*:*:*:*:*:*","matchCriteriaId":"EC0B32F6-5EF0-4591-99D7-D0E9B09DEC5A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qamsrv1m_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CE03AB2A-3ED9-4489-8E5B-4FCF8BAA8559"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qamsrv1m:-:*:*:*:*:*:*:*","matchCriteriaId":"9E646738-6A87-4470-9640-6A5A1DF3AF78"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6391_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"83B53119-1B2F-4978-B7F5-33B84BE73B68"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6391:-:*:*:*:*:*:*:*","matchCriteriaId":"6FEBC0C5-CAA1-475C-96C2-B8D24B2E4536"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6595_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"643EC76D-2836-48E6-81DA-78C4883C33CA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6595:-:*:*:*:*:*:*:*","matchCriteriaId":"477F6529-4CE1-44FC-B6EE-D24D44C71AE7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6595au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"288F637F-22F8-47CF-B67F-C798A730A1BD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6595au:-:*:*:*:*:*:*:*","matchCriteriaId":"D0996EA3-1C92-4933-BE34-9CF625E59FE7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6678aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D001127D-8160-42F0-B8B9-2FAA2976B530"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6678aq:-:*:*:*:*:*:*:*","matchCriteriaId":"C9EB615F-FD4C-450B-AB25-E936FD9816C4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6698aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5FA1F8F4-EAF2-4704-A8A6-19AD3CA1B577"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6698aq:-:*:*:*:*:*:*:*","matchCriteriaId":"B3F7853D-09EE-476F-B48D-BB30AEB4A67D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6698au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3ACA09C0-84A5-493A-A9BD-EF95A8330D54"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6698au:-:*:*:*:*:*:*:*","matchCriteriaId":"3A2397BD-431C-4730-92E3-17A5C2445A65"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6797aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"797295C2-535C-46A9-A725-E1A5405F0436"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6797aq:-:*:*:*:*:*:*:*","matchCriteriaId":"8BFC575E-594E-4711-94B1-2DC8D03B9AC4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca8695au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"55A21DB0-4722-4421-8E97-B0E31B93E53B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca8695au:-:*:*:*:*:*:*:*","matchCriteriaId":"797B8944-61F0-4522-97FE-3C172369F477"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm4490_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DA506489-4338-44DF-8F92-12E60AF0048C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm4490:-:*:*:*:*:*:*:*","matchCriteriaId":"A8718C37-A82A-4A08-A887-3F22B37601A9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm5430_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4EC5F81B-AA24-4E3C-9FC8-53E010AC977E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm5430:-:*:*:*:*:*:*:*","matchCriteriaId":"B5C66DAD-0D85-46B8-92D7-6D68B9429E9A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm6490_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"ADD6D51E-5787-42A6-8A02-4EBBAFFF9C94"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm6490:-:*:*:*:*:*:*:*","matchCriteriaId":"99AA0291-B822-4CAD-BA17-81B632FC3FEF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm8838_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7C6535AE-8680-4AB9-ABF6-82DAE1795531"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm8838:-:*:*:*:*:*:*:*","matchCriteriaId":"9C3FEACB-1AE1-4BF2-9552-C31A32DCCA9B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcn9011_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9306C34D-47E4-40CF-89F4-BA5263655D13"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcn9011:-:*:*:*:*:*:*:*","matchCriteriaId":"02BA009F-24E1-4953-BA95-2A5BC1CDBDBB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcn9012_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"61F34DD2-9DC0-49E5-BC85-1543EA199477"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcn9012:-:*:*:*:*:*:*:*","matchCriteriaId":"1A06879F-6FE9-448A-8186-8347D76F872B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs4490_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3336CDD7-9E7B-4FFB-A5CE-594B19B63A6C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs4490:-:*:*:*:*:*:*:*","matchCriteriaId":"1197E229-1E27-4CA3-A386-B77FAE5DFE1A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs6690_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F8AD50C4-E725-48B8-8291-A62EF153D50A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs6690:-:*:*:*:*:*:*:*","matchCriteriaId":"4B5A7BC1-E4B1-486C-A433-D206A42A1356"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs8550_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FFF23DDB-98A0-4343-ADD3-5AB9C2383E7E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs8550:-:*:*:*:*:*:*:*","matchCriteriaId":"5ACB8AFB-5B91-4AA1-BA3A-1AF0B3503080"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qln1083bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FD70F234-1EE7-4362-97F6-5AEDB7078D03"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qln1083bd:-:*:*:*:*:*:*:*","matchCriteriaId":"C569A848-B70C-42EF-B6D5-4A86547586EE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qln1086bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F218DF06-C40A-4738-ABB5-A3FA2243EF84"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qln1086bd:-:*:*:*:*:*:*:*","matchCriteriaId":"2E2A0CD0-66FA-45D6-BBC7-03641203EC73"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qmp1000_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5298473D-8B34-42E6-BC32-69A3800972B4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qmp1000:-:*:*:*:*:*:*:*","matchCriteriaId":"2A1CF44E-FFC2-4DCB-8DC2-46422D912448"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qmp2001_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0B53AF78-37B0-4D64-A7D3-1729D0248D61"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qmp2001:-:*:*:*:*:*:*:*","matchCriteriaId":"560E36D2-27DB-4590-A879-C2071ED72641"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qna715_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7B3FD468-BE2F-4C80-843B-7EC3845F6923"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qna715:-:*:*:*:*:*:*:*","matchCriteriaId":"342A6C3B-5128-40C5-BB3B-151D5B6C7BDA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qpa1083bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B0208F7B-A959-485E-B004-A34CB7C7C4C9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qpa1083bd:-:*:*:*:*:*:*:*","matchCriteriaId":"FBDAC812-4603-4D24-A861-23825E32D44E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qpa1086bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7F6DEF72-A8FF-4B67-AA6C-5CB4AA7B35E1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qpa1086bd:-:*:*:*:*:*:*:*","matchCriteriaId":"00EF6875-B088-40BD-A526-C962789CDC5A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:video_collaboration_vc3_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DD4946C6-778F-4542-AB77-C9B86AF25C05"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:video_collaboration_vc3_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"6F1D604A-4530-42B3-80A0-58A82D658DDD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1083_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0CE74B89-5E3F-428E-8000-E3452B8B6953"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1083:-:*:*:*:*:*:*:*","matchCriteriaId":"DC11B7A6-E621-463D-B861-6B203EADFA57"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1086_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E48759CC-B751-4466-87DF-2D0AB220C0FB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1086:-:*:*:*:*:*:*:*","matchCriteriaId":"E7F1C9D2-6616-4F74-85C2-1850B5C3F6BC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1093_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9A46B609-BD06-4BB7-B055-1F71C555E93D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1093:-:*:*:*:*:*:*:*","matchCriteriaId":"59598462-1E53-4F6D-BAB5-06ACEDF6CD9F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1094_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8F30D66E-2802-4394-BC39-5E04711234FF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1094:-:*:*:*:*:*:*:*","matchCriteriaId":"078EC383-784F-4468-B94C-AE7CC9808419"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1095_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B7B67C93-0453-4696-8F3D-0AD664922C44"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1095:-:*:*:*:*:*:*:*","matchCriteriaId":"D61C46AA-9130-46A8-BD04-8B4235118B81"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1096_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2E2D5E44-48F6-41E8-A38B-A2E070E16AA9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1096:-:*:*:*:*:*:*:*","matchCriteriaId":"9BD0372F-5140-4966-9A27-6B5A606C0665"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa7255p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2B651F0A-34DA-400F-A376-B499BFDF8E86"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa7255p:-:*:*:*:*:*:*:*","matchCriteriaId":"4CFF093D-98C8-470F-8330-E5126E06343A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa7775p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6C32CA38-5D48-4108-9858-FD66E20CAF2F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa7775p:-:*:*:*:*:*:*:*","matchCriteriaId":"E1997F8B-17B8-4DE3-BCF7-726928720592"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8255p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EC6E268D-C4AF-4950-9223-39EA36D538A8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8255p:-:*:*:*:*:*:*:*","matchCriteriaId":"073C1A81-D02B-4F2F-9378-CD1B2DCE0E5B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8620p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6ACE6D64-A498-482F-8270-718F4884CFFD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8620p:-:*:*:*:*:*:*:*","matchCriteriaId":"B6E016D6-1B83-4261-A27E-1F9873F81E14"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8770p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"781CCC31-C08F-499B-BE73-6C7DB70437AF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8770p:-:*:*:*:*:*:*:*","matchCriteriaId":"75AFAA21-0589-4C6A-9418-34EE8A61BBAD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa9000p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A024AB04-B213-4018-A4C1-FA467C7BA775"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa9000p:-:*:*:*:*:*:*:*","matchCriteriaId":"A2A8AB7C-5D34-4794-8C06-2193075B323F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sar1165p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D97CD52-4CB0-4F57-9C24-530B326B8D9D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sar1165p:-:*:*:*:*:*:*:*","matchCriteriaId":"582EE932-DDE5-4BE5-837C-523FE3EFBA5D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sar2130p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"95696696-D2AE-4358-AF5D-3ED14F969964"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sar2130p:-:*:*:*:*:*:*:*","matchCriteriaId":"1A6FC469-463F-4EC1-B4EF-010BDB9BAA05"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sc8380xp_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14E3FE58-7F1C-4F5C-B62D-0CF124E14AB2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sc8380xp:-:*:*:*:*:*:*:*","matchCriteriaId":"FFCB0BBA-3F81-4FCA-B3DE-190C46DA50DB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen1_5g_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D0567B3-D81A-4EEE-868B-4DC2214C159D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen1_5g:-:*:*:*:*:*:*:*","matchCriteriaId":"76236C11-4903-4AD4-9134-3EDD3451EE43"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_865_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6C9F4285-1F09-40CD-B1AA-84B406FD6A71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_865_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"8623DD44-DFDD-442D-9789-11A527A450A4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sdr753_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A49B142B-E8DC-4A79-B969-2C2FBE2E009A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sdr753:-:*:*:*:*:*:*:*","matchCriteriaId":"8A1A6C7D-EAB0-4D8D-9A3E-DA066F4ACF7D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm4875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E21AC0DB-36FF-4B36-9CA9-809949B0CA53"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm4875:-:*:*:*:*:*:*:*","matchCriteriaId":"471434D6-35A1-4F4E-85C5-0180383BD315"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6450p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEE752CE-2121-477E-A1C9-6A05DF36DFA9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6450p:-:*:*:*:*:*:*:*","matchCriteriaId":"DCA019DB-C24E-4C2B-B4E4-95F61E038FEA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6475p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E32FAA6A-E882-4978-B748-5617BE33F347"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6475p:-:*:*:*:*:*:*:*","matchCriteriaId":"FFFCBBD0-3F52-446F-9A6B-2D138463AB80"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6475q_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03B375DA-4A46-4BC6-B873-99538D53DFBD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6475q:-:*:*:*:*:*:*:*","matchCriteriaId":"ACEA2D75-14DB-4F87-8F3C-A6E9436ECA97"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6650p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"09020F3F-C869-42DF-BD9C-E78056CC8123"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6650p:-:*:*:*:*:*:*:*","matchCriteriaId":"E8272228-2D68-45F2-A670-B5D6E90D9C14"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6850_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DE09FF94-7751-4EED-B269-C7BB056CA90C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6850:-:*:*:*:*:*:*:*","matchCriteriaId":"02B1463D-EE74-42DC-95D5-D0F66260CB32"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7435_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F7A95A9E-617A-4D3A-9A4E-0C0A29B3C8B5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7435:-:*:*:*:*:*:*:*","matchCriteriaId":"3559292E-B5A6-4F88-BC20-F6AA85F07C97"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7435p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"55C65D26-71D7-4840-B8B1-7C5EC69EB320"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7435p:-:*:*:*:*:*:*:*","matchCriteriaId":"B322FB35-2415-45EA-A350-746AFF734ACD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7525_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2410FF59-E0C0-4920-9656-C398DB06DEAE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7525:-:*:*:*:*:*:*:*","matchCriteriaId":"7D2B800C-4DBC-4028-875D-667C87D75247"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7550_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EEA5CE41-0596-4D38-9891-D1DF711EA7E9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7550:-:*:*:*:*:*:*:*","matchCriteriaId":"E1A901C6-FB73-4361-B391-4A4AF8C70029"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7550p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5C5D7E2C-0955-4B6E-96E4-CFA06D937492"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7550p:-:*:*:*:*:*:*:*","matchCriteriaId":"9D1D0F33-AD5A-4826-9A06-EAD2A8709974"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7635p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3A72DAA5-E10F-40A0-A8CC-541594A3279F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7635p:-:*:*:*:*:*:*:*","matchCriteriaId":"15CC657A-7623-4F37-AC52-8AF5C83D5BDA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9375_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"34143ABA-7D09-429F-A65C-3A33438BF62C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9375:-:*:*:*:*:*:*:*","matchCriteriaId":"9D56DFE3-5EF1-4B23-BBD5-0203FBF9CCEC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9378_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4CFDBB5B-0A4F-4032-874F-D2A7EF933FB0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9378:-:*:*:*:*:*:*:*","matchCriteriaId":"D28A12D6-CC60-4BE9-ADEE-FAB58B05440F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"70292B01-617F-44AD-AF77-1AFC1450523D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9380:-:*:*:*:*:*:*:*","matchCriteriaId":"FA94C6D6-85DB-4031-AAF4-C399019AE16D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"92B17201-8185-47F1-9720-5AB4ECD11B22"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9385:-:*:*:*:*:*:*:*","matchCriteriaId":"E1FA2EB9-416F-4D69-8786-386CC73978AE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9390_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"896F1C04-9957-440F-BF01-C3772CC3B3DF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9390:-:*:*:*:*:*:*:*","matchCriteriaId":"A90555EB-47A7-4717-92D5-35B561825F06"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9395_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"699056F6-1517-4F25-AE07-4FFCF6923B9F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9395:-:*:*:*:*:*:*:*","matchCriteriaId":"E4C023D2-6FF5-4FFC-B9F2-895979166580"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3950_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3FEF2DB6-00F5-4B07-953B-EF58B31267F1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3950:-:*:*:*:*:*:*:*","matchCriteriaId":"120E8F0F-EBEB-4565-9927-2D473F783EF7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4BFB25F-013B-48E3-99FF-3E8687F94423"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3988:-:*:*:*:*:*:*:*","matchCriteriaId":"BF676C5B-838B-446C-A689-6A25AB8A87E2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn6450_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1FAFC9FA-E6EF-44C5-BD50-2824C7711541"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn6450:-:*:*:*:*:*:*:*","matchCriteriaId":"6F895CDD-F9BB-45AD-AE60-71F4549114A4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn6650_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"93398092-AF7C-4F04-874C-7E5B4CF7AB00"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn6650:-:*:*:*:*:*:*:*","matchCriteriaId":"7D242084-5844-4E43-8D7F-D2F8E3521F0C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn6755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2BC386D9-3D2B-40FA-A2D9-199BB138F46A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn6755:-:*:*:*:*:*:*:*","matchCriteriaId":"133FFD9F-FA09-4801-939B-AD1D507BE5FE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7760_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"506C6CE1-6BDF-4542-82C1-820D10D8181A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7760:-:*:*:*:*:*:*:*","matchCriteriaId":"72F8CE3B-2BDC-40B1-BB04-A3A7E25B8096"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7860_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2EB8794F-7998-424E-AF68-E4A4F9310F65"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7860:-:*:*:*:*:*:*:*","matchCriteriaId":"799D69CE-3FCC-4B19-8B00-9AF38111D983"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7861_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"57608D47-894C-4895-B4B3-4733D55D57DB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7861:-:*:*:*:*:*:*:*","matchCriteriaId":"2FFD2C38-1A61-4BED-ABFA-DAE0C4B78620"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7880_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"63735D33-9F09-4841-9FE0-0D9AB604BECF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7880:-:*:*:*:*:*:*:*","matchCriteriaId":"E826F765-4C2E-4319-BBC4-DEB02AAD783F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D765C392-5F38-4E6A-9E88-59629E7A6911"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7881:-:*:*:*:*:*:*:*","matchCriteriaId":"FAE8F4F9-F692-4EC0-A3FE-2CDD681DCBFD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8810_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"15307882-7039-43E9-9BA3-035045988B99"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8810:-:*:*:*:*:*:*:*","matchCriteriaId":"AA85B322-E593-4499-829A-CC6D70BAE884"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E839A0B9-64C3-4C7A-82B7-D2AAF65928F8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8815:-:*:*:*:*:*:*:*","matchCriteriaId":"7E870D82-DE3B-4199-A730-C8FB545BAA98"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8830_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"11B69595-E488-4590-A150-CE5BE08B5E13"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8830:-:*:*:*:*:*:*:*","matchCriteriaId":"BF680174-5FA6-47D9-8EAB-CC2A37A7BD42"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8832_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7ACAD26E-B79E-4659-91A5-D301281F7D36"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8832:-:*:*:*:*:*:*:*","matchCriteriaId":"F0E46DA6-9494-4D92-A4AE-A272AF6ACCCC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F80BC68E-7476-4A40-9F48-53722FE9A5BF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8835:-:*:*:*:*:*:*:*","matchCriteriaId":"6B36F4B2-BAA3-45AD-9967-0EB482C99708"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8840_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA33DE15-C177-43B3-AD50-FF797753D12E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8840:-:*:*:*:*:*:*:*","matchCriteriaId":"AE1A5841-5BCB-4033-ACB9-23F3FCA65309"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8845_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5B47BF35-3AA0-4667-842E-19B0FE30BF3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8845:-:*:*:*:*:*:*:*","matchCriteriaId":"8A071672-9405-4418-9141-35CEADBB65AF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8845h_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB7CF473-8B25-4851-91F2-1BD693CCDC85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8845h:-:*:*:*:*:*:*:*","matchCriteriaId":"91E591F2-8F72-4A5A-9264-2742EB2DABDA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8850_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FA243934-7BFA-47AA-B78C-CCB25377E471"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8850:-:*:*:*:*:*:*:*","matchCriteriaId":"2FD65035-4D20-48D5-874E-47CD9C7A985C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8850w_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22707187-A56D-48AD-800F-A438FD844546"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8850w:-:*:*:*:*:*:*:*","matchCriteriaId":"F526A54A-F974-4D0A-A1A6-FABBB6711CD0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8855c_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"671E0B82-5D58-4644-8806-7F4CAFFB6641"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8855c:-:*:*:*:*:*:*:*","matchCriteriaId":"CC066321-B3CC-4E88-BFA9-414B8D095207"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:x1e80100_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42F453E4-02CC-4E48-A25B-F1394069F524"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:x1e80100:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6671AE-3490-4D85-A20C-3DA26F7D7AEB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:xrv7209_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CC6C6243-E092-4903-BC20-E3B0CECBC790"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:xrv7209:-:*:*:*:*:*:*:*","matchCriteriaId":"AAA33761-D61C-4A81-B233-5E2D50F3596F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:xrv9209_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D693483-72F9-42B1-8EDA-8DABD537F428"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:xrv9209:-:*:*:*:*:*:*:*","matchCriteriaId":"43F4A7D9-055D-475B-BFE4-61A86C7397F8"}]}]}],"references":[{"url":"https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2026-bulletin.html","source":"product-security@qualcomm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-25273","sourceIdentifier":"product-security@qualcomm.com","published":"2026-10-06T07:16:57.647","lastModified":"2026-10-09T14:11:13.757","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Memory Corruption when processing camera operations due to out-of-bounds write during driver updates."}],"affected":[{"source":"product-security@qualcomm.com","affectedData":[{"vendor":"Qualcomm, Inc.","product":"Snapdragon","defaultStatus":"unaffected","platforms":["Snapdragon Auto","Snapdragon Compute","Snapdragon Mobile"],"versions":[{"version":"FastConnect 6900","status":"affected"},{"version":"FastConnect 7800","status":"affected"},{"version":"Pandeiro","status":"affected"},{"version":"QCM8838","status":"affected"},{"version":"SD865 5G","status":"affected"},{"version":"SDR753","status":"affected"},{"version":"Snapdragon 8 Elite Gen 5","status":"affected"},{"version":"Snapdragon XR2 5G Platform","status":"affected"},{"version":"Snapdragon XR2+ Gen 1 Platform","status":"affected"},{"version":"WCD9380","status":"affected"},{"version":"WCD9395","status":"affected"},{"version":"WCN7860","status":"affected"},{"version":"WCN7861","status":"affected"},{"version":"WCN7880","status":"affected"},{"version":"WCN7881","status":"affected"},{"version":"WSA8810","status":"affected"},{"version":"WSA8815","status":"affected"},{"version":"WSA8840","status":"affected"},{"version":"WSA8845","status":"affected"},{"version":"WSA8845H","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"product-security@qualcomm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T12:26:28.230789Z","id":"CVE-2026-25273","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"product-security@qualcomm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:congo_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4DA1D059-7672-40F5-BB2E-3072475666A0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:congo:-:*:*:*:*:*:*:*","matchCriteriaId":"48C84939-F83F-4E79-902C-32B77C4A4BBB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq8845s_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4FB1D261-4C1B-4D43-B8ED-975E526A2FF5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq8845s:-:*:*:*:*:*:*:*","matchCriteriaId":"54AC5C16-88A9-4C16-B7AF-835E53D7DFA4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq8850ns_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"867A0C11-FBA0-46F1-871F-1800A7A75BB3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq8850ns:-:*:*:*:*:*:*:*","matchCriteriaId":"9885533F-4021-429D-917F-0A2733725B43"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6200_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CDE1CBDE-3D28-463C-B215-AA7DF373EF09"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6200:-:*:*:*:*:*:*:*","matchCriteriaId":"66BD3B88-7CF9-482D-A2DD-67F6ACF4CC57"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6900_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E670F500-9B71-4BBE-B5DA-221D35803C89"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6900:-:*:*:*:*:*:*:*","matchCriteriaId":"9ADEB5C5-B79A-4F45-B7D3-75945B38DB6C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_7800_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B3053D68-C5D8-4D47-A4F0-9F3AF2289E1D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_7800:-:*:*:*:*:*:*:*","matchCriteriaId":"638DBC7F-456F-487D-BED2-2214DFF8BEE2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:orne_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"19FB8345-BBFC-4E18-A4E6-64A159D7F65B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:orne:-:*:*:*:*:*:*:*","matchCriteriaId":"FFDA4056-3F1B-4F3A-BE59-1908BD3DE5E9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:pandeiro_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F8EF0C-BB48-47E1-A045-254D79388F75"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:pandeiro:-:*:*:*:*:*:*:*","matchCriteriaId":"058950FC-ED72-4E91-AE13-87E738ADC083"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qmp1000_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5298473D-8B34-42E6-BC32-69A3800972B4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qmp1000:-:*:*:*:*:*:*:*","matchCriteriaId":"2A1CF44E-FFC2-4DCB-8DC2-46422D912448"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qmp2001_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0B53AF78-37B0-4D64-A7D3-1729D0248D61"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qmp2001:-:*:*:*:*:*:*:*","matchCriteriaId":"560E36D2-27DB-4590-A879-C2071ED72641"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_8800_mobile_connectivity_system_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"28C65092-164F-40B7-8DCF-0F72F19C1CC3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_8800_mobile_connectivity_system:-:*:*:*:*:*:*:*","matchCriteriaId":"C3813BD8-2228-414D-BB2B-E3C00210404A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_865_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6C9F4285-1F09-40CD-B1AA-84B406FD6A71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_865_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"8623DD44-DFDD-442D-9789-11A527A450A4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm4875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E21AC0DB-36FF-4B36-9CA9-809949B0CA53"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm4875:-:*:*:*:*:*:*:*","matchCriteriaId":"471434D6-35A1-4F4E-85C5-0180383BD315"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6850_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DE09FF94-7751-4EED-B269-C7BB056CA90C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6850:-:*:*:*:*:*:*:*","matchCriteriaId":"02B1463D-EE74-42DC-95D5-D0F66260CB32"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8845p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A205320E-6C60-4F6A-90D5-06CABAF0FDEA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8845p:-:*:*:*:*:*:*:*","matchCriteriaId":"0FB8CE86-605E-4B3D-82E5-A55093ABCE5F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8950_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"09662E75-32BB-4D24-8A81-B743FF0DE323"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8950:-:*:*:*:*:*:*:*","matchCriteriaId":"8D44C02D-3FCA-4885-A1B5-7C2836B1233B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8950p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D5350DB-39BD-4BF4-87AB-5FD6DECB25D3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8950p:-:*:*:*:*:*:*:*","matchCriteriaId":"0AE6E7D9-E7E8-490E-B801-D97F522CA0FA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8975_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42D47A7D-A79C-4EA0-AEDF-533F4F9933B9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8975:-:*:*:*:*:*:*:*","matchCriteriaId":"1CC31B0D-3890-442E-87BE-47E58A0F6537"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8975p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"73D04C5D-A3A8-45A3-A83E-03DF5EF400C2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8975p:-:*:*:*:*:*:*:*","matchCriteriaId":"A67DF502-A50C-4E7E-B457-F46B7149B85C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_460_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"390D7CAF-6C0B-4438-AA7D-AEEE127F4D3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_460_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"5BB1FC5E-CF6F-4E54-B78D-C01AFD034903"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_662_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"37DF4D73-3ACC-41B3-8CA4-20DAECE6BFB7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_662_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"FE08D23A-2D0D-4472-8847-27B955F55165"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_elite_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EA50192-07B0-4404-93D4-EC4F3B1918B7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_elite:-:*:*:*:*:*:*:*","matchCriteriaId":"26C7FC48-08CB-4E50-B8D3-8AF30549FDF8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_elite_gen_5_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"41070BDB-15E4-4DD7-A132-A14AA24978E5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_elite_gen_5:-:*:*:*:*:*:*:*","matchCriteriaId":"102460A6-9637-4883-9230-2CC888D5D74E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen_5_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4D8D8AD-B291-4AEC-8817-D7C99E79FF49"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen_5:-:*:*:*:*:*:*:*","matchCriteriaId":"8CA08EA8-A47E-4797-8644-0A48D509939C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_xr2_5g_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1A129620-8241-4A47-AAC8-CC7E10A09C9C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_xr2_5g_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"4CEDD78E-124C-4216-9B57-3B7B53463659"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_xr2\\+_gen_1_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BF9740EB-F82E-42EA-993E-A393B05CC6BB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_xr2\\+_gen_1_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"022A5532-03F7-4FB8-BA0D-4221178C9486"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9370_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1295D869-F4DD-4766-B4AA-3513752F43B4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9370:-:*:*:*:*:*:*:*","matchCriteriaId":"B98784DC-3143-4D38-AD28-DBBDCCAB4272"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9375_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"34143ABA-7D09-429F-A65C-3A33438BF62C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9375:-:*:*:*:*:*:*:*","matchCriteriaId":"9D56DFE3-5EF1-4B23-BBD5-0203FBF9CCEC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9378_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4CFDBB5B-0A4F-4032-874F-D2A7EF933FB0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9378:-:*:*:*:*:*:*:*","matchCriteriaId":"D28A12D6-CC60-4BE9-ADEE-FAB58B05440F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"70292B01-617F-44AD-AF77-1AFC1450523D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9380:-:*:*:*:*:*:*:*","matchCriteriaId":"FA94C6D6-85DB-4031-AAF4-C399019AE16D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9395_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"699056F6-1517-4F25-AE07-4FFCF6923B9F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9395:-:*:*:*:*:*:*:*","matchCriteriaId":"E4C023D2-6FF5-4FFC-B9F2-895979166580"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3950_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3FEF2DB6-00F5-4B07-953B-EF58B31267F1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3950:-:*:*:*:*:*:*:*","matchCriteriaId":"120E8F0F-EBEB-4565-9927-2D473F783EF7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4BFB25F-013B-48E3-99FF-3E8687F94423"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3988:-:*:*:*:*:*:*:*","matchCriteriaId":"BF676C5B-838B-446C-A689-6A25AB8A87E2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn6450_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1FAFC9FA-E6EF-44C5-BD50-2824C7711541"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn6450:-:*:*:*:*:*:*:*","matchCriteriaId":"6F895CDD-F9BB-45AD-AE60-71F4549114A4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7760_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"506C6CE1-6BDF-4542-82C1-820D10D8181A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7760:-:*:*:*:*:*:*:*","matchCriteriaId":"72F8CE3B-2BDC-40B1-BB04-A3A7E25B8096"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7860_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2EB8794F-7998-424E-AF68-E4A4F9310F65"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7860:-:*:*:*:*:*:*:*","matchCriteriaId":"799D69CE-3FCC-4B19-8B00-9AF38111D983"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7861_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"57608D47-894C-4895-B4B3-4733D55D57DB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7861:-:*:*:*:*:*:*:*","matchCriteriaId":"2FFD2C38-1A61-4BED-ABFA-DAE0C4B78620"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7880_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"63735D33-9F09-4841-9FE0-0D9AB604BECF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7880:-:*:*:*:*:*:*:*","matchCriteriaId":"E826F765-4C2E-4319-BBC4-DEB02AAD783F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D765C392-5F38-4E6A-9E88-59629E7A6911"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7881:-:*:*:*:*:*:*:*","matchCriteriaId":"FAE8F4F9-F692-4EC0-A3FE-2CDD681DCBFD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn8841_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C7A02129-BB8C-43F1-BFC1-3632BA299AB6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn8841:-:*:*:*:*:*:*:*","matchCriteriaId":"4082B1D2-9CBD-48FE-93EF-C069A4B6A466"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8810_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"15307882-7039-43E9-9BA3-035045988B99"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8810:-:*:*:*:*:*:*:*","matchCriteriaId":"AA85B322-E593-4499-829A-CC6D70BAE884"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E839A0B9-64C3-4C7A-82B7-D2AAF65928F8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8815:-:*:*:*:*:*:*:*","matchCriteriaId":"7E870D82-DE3B-4199-A730-C8FB545BAA98"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8830_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"11B69595-E488-4590-A150-CE5BE08B5E13"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8830:-:*:*:*:*:*:*:*","matchCriteriaId":"BF680174-5FA6-47D9-8EAB-CC2A37A7BD42"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8832_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7ACAD26E-B79E-4659-91A5-D301281F7D36"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8832:-:*:*:*:*:*:*:*","matchCriteriaId":"F0E46DA6-9494-4D92-A4AE-A272AF6ACCCC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F80BC68E-7476-4A40-9F48-53722FE9A5BF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8835:-:*:*:*:*:*:*:*","matchCriteriaId":"6B36F4B2-BAA3-45AD-9967-0EB482C99708"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8840_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA33DE15-C177-43B3-AD50-FF797753D12E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8840:-:*:*:*:*:*:*:*","matchCriteriaId":"AE1A5841-5BCB-4033-ACB9-23F3FCA65309"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8845_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5B47BF35-3AA0-4667-842E-19B0FE30BF3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8845:-:*:*:*:*:*:*:*","matchCriteriaId":"8A071672-9405-4418-9141-35CEADBB65AF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8845h_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB7CF473-8B25-4851-91F2-1BD693CCDC85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8845h:-:*:*:*:*:*:*:*","matchCriteriaId":"91E591F2-8F72-4A5A-9264-2742EB2DABDA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8850_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FA243934-7BFA-47AA-B78C-CCB25377E471"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8850:-:*:*:*:*:*:*:*","matchCriteriaId":"2FD65035-4D20-48D5-874E-47CD9C7A985C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8850w_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22707187-A56D-48AD-800F-A438FD844546"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8850w:-:*:*:*:*:*:*:*","matchCriteriaId":"F526A54A-F974-4D0A-A1A6-FABBB6711CD0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8855c_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"671E0B82-5D58-4644-8806-7F4CAFFB6641"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8855c:-:*:*:*:*:*:*:*","matchCriteriaId":"CC066321-B3CC-4E88-BFA9-414B8D095207"}]}]}],"references":[{"url":"https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2026-bulletin.html","source":"product-security@qualcomm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-25274","sourceIdentifier":"product-security@qualcomm.com","published":"2026-10-06T07:16:57.770","lastModified":"2026-10-09T14:11:29.653","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization."}],"affected":[{"source":"product-security@qualcomm.com","affectedData":[{"vendor":"Qualcomm, Inc.","product":"Snapdragon","defaultStatus":"unaffected","platforms":["Snapdragon Compute","Snapdragon Connectivity","Snapdragon Consumer Electronics Connectivity","Snapdragon Industrial IOT","Snapdragon MC"],"versions":[{"version":"AQT1000","status":"affected"},{"version":"Cologne","status":"affected"},{"version":"Congo","status":"affected"},{"version":"FastConnect 6200","status":"affected"},{"version":"FastConnect 6700","status":"affected"},{"version":"FastConnect 6800","status":"affected"},{"version":"FastConnect 6900","status":"affected"},{"version":"FastConnect 7800","status":"affected"},{"version":"IQX5121","status":"affected"},{"version":"QCA0000","status":"affected"},{"version":"QCA2062","status":"affected"},{"version":"QCA2064","status":"affected"},{"version":"QCA2065","status":"affected"},{"version":"QCA2066","status":"affected"},{"version":"QCA6391","status":"affected"},{"version":"QCA6420","status":"affected"},{"version":"QCA6430","status":"affected"},{"version":"QCC2073","status":"affected"},{"version":"QCC2076","status":"affected"},{"version":"QCM5430","status":"affected"},{"version":"QCM6490","status":"affected"},{"version":"Qualcomm Dragonwing IQ-X","status":"affected"},{"version":"Qualcomm FastConnect 8800 Mobile Connectivity System","status":"affected"},{"version":"Qualcomm Video Collaboration VC3 Platform","status":"affected"},{"version":"SC8380XP","status":"affected"},{"version":"Snapdragon 7c+ Gen 3 Compute","status":"affected"},{"version":"Snapdragon 8c Compute Platform \"Poipu Lite\"","status":"affected"},{"version":"Snapdragon 8cx Compute Platform","status":"affected"},{"version":"Snapdragon 8cx Gen 2 5G Compute Platform \"Poipu Pro\"","status":"affected"},{"version":"Snapdragon 8cx Gen 3 Compute Platform","status":"affected"},{"version":"Snapdragon X2 Elite","status":"affected"},{"version":"WCD9340","status":"affected"},{"version":"WCD9341","status":"affected"},{"version":"WCD9370","status":"affected"},{"version":"WCD9375","status":"affected"},{"version":"WCD9378C","status":"affected"},{"version":"WCD9380","status":"affected"},{"version":"WCD9385","status":"affected"},{"version":"WSA8810","status":"affected"},{"version":"WSA8815","status":"affected"},{"version":"WSA8830","status":"affected"},{"version":"WSA8835","status":"affected"},{"version":"WSA8840","status":"affected"},{"version":"WSA8845","status":"affected"},{"version":"WSA8845H","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"product-security@qualcomm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T12:20:19.775299Z","id":"CVE-2026-25274","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"product-security@qualcomm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:aqt1000_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EC6FCE91-BF38-49ED-8FFB-429BAFEE7832"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:aqt1000:-:*:*:*:*:*:*:*","matchCriteriaId":"715A9F94-5F9E-45E5-B07B-699410C01478"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cologne_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8FF959C0-5AAB-4DC5-AE8F-4EFA21A00B5E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cologne:-:*:*:*:*:*:*:*","matchCriteriaId":"E31E0C48-FB61-47C8-B28B-3A701E85E126"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:congo_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4DA1D059-7672-40F5-BB2E-3072475666A0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:congo:-:*:*:*:*:*:*:*","matchCriteriaId":"48C84939-F83F-4E79-902C-32B77C4A4BBB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6200_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CDE1CBDE-3D28-463C-B215-AA7DF373EF09"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6200:-:*:*:*:*:*:*:*","matchCriteriaId":"66BD3B88-7CF9-482D-A2DD-67F6ACF4CC57"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6700_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"82B82E87-F3F4-466F-A76B-C8809121FF6F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6700:-:*:*:*:*:*:*:*","matchCriteriaId":"419A132E-E42C-4395-B74B-788A39DF1D13"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6800_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D89F035A-2388-48FC-AEBB-8429C6880F4A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6800:-:*:*:*:*:*:*:*","matchCriteriaId":"CA13EF4E-AAE6-45F4-9E41-78310E37CE81"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6900_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E670F500-9B71-4BBE-B5DA-221D35803C89"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6900:-:*:*:*:*:*:*:*","matchCriteriaId":"9ADEB5C5-B79A-4F45-B7D3-75945B38DB6C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_7800_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B3053D68-C5D8-4D47-A4F0-9F3AF2289E1D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_7800:-:*:*:*:*:*:*:*","matchCriteriaId":"638DBC7F-456F-487D-BED2-2214DFF8BEE2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iqx5121_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"499A2520-436C-4B12-849D-98B94088CCDE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iqx5121:-:*:*:*:*:*:*:*","matchCriteriaId":"4C34A825-C928-4F8F-B076-19F8787A3440"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iqx7181_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F58C10B5-2BB1-4A8F-AF4B-2EC791C9FBBE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iqx7181:-:*:*:*:*:*:*:*","matchCriteriaId":"9EE22328-BBF8-473C-8F89-58AEF8CC9D75"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca0000_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CC941093-1A7C-47B2-AB3B-05AE4AE2FBE4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca0000:-:*:*:*:*:*:*:*","matchCriteriaId":"7A2AA834-C17C-4E0E-A510-795818041E47"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca2062_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"54C350AB-526B-4681-9C37-DD508EFFB143"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca2062:-:*:*:*:*:*:*:*","matchCriteriaId":"1ACBDBFC-796A-428E-9570-77E488FA1CB3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca2064_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E73670B4-1055-4C65-AD34-EB978ABB19A6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca2064:-:*:*:*:*:*:*:*","matchCriteriaId":"C774D66F-60C9-46B8-BE1D-B8D61EE5E844"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca2065_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8C68AE99-4C8C-43AE-94AA-82632FD2BBE4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca2065:-:*:*:*:*:*:*:*","matchCriteriaId":"E255A21F-EC50-436F-81D9-8B2AC56D9BCE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca2066_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6366F2ED-C6B7-4579-B304-C5B6DF951EB4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca2066:-:*:*:*:*:*:*:*","matchCriteriaId":"09B688AF-E1A4-496C-924C-D6B725CBBE26"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6391_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"83B53119-1B2F-4978-B7F5-33B84BE73B68"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6391:-:*:*:*:*:*:*:*","matchCriteriaId":"6FEBC0C5-CAA1-475C-96C2-B8D24B2E4536"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6420_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7E16994A-6DBA-426C-ADD2-B1E8B49FEDBF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6420:-:*:*:*:*:*:*:*","matchCriteriaId":"47E674DE-55AB-44E5-8E00-C804FC9D4DC0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6430_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"95AFC483-1468-43FC-96FA-A56165C290E0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6430:-:*:*:*:*:*:*:*","matchCriteriaId":"0A963FDF-6FF4-4F48-834E-2A14D241716D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm5430_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4EC5F81B-AA24-4E3C-9FC8-53E010AC977E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm5430:-:*:*:*:*:*:*:*","matchCriteriaId":"B5C66DAD-0D85-46B8-92D7-6D68B9429E9A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm6490_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"ADD6D51E-5787-42A6-8A02-4EBBAFFF9C94"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm6490:-:*:*:*:*:*:*:*","matchCriteriaId":"99AA0291-B822-4CAD-BA17-81B632FC3FEF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_8800_mobile_connectivity_system_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"28C65092-164F-40B7-8DCF-0F72F19C1CC3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_8800_mobile_connectivity_system:-:*:*:*:*:*:*:*","matchCriteriaId":"C3813BD8-2228-414D-BB2B-E3C00210404A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:video_collaboration_vc3_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DD4946C6-778F-4542-AB77-C9B86AF25C05"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:video_collaboration_vc3_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"6F1D604A-4530-42B3-80A0-58A82D658DDD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sc8380xp_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14E3FE58-7F1C-4F5C-B62D-0CF124E14AB2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sc8380xp:-:*:*:*:*:*:*:*","matchCriteriaId":"FFCB0BBA-3F81-4FCA-B3DE-190C46DA50DB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7c\\+_gen_3_compute_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C4A050CA-8514-400A-A6B3-F513CC93CA14"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7c\\+_gen_3_compute:-:*:*:*:*:*:*:*","matchCriteriaId":"BD850305-1E76-4952-A3FB-F6229CBF7FE9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8c_compute_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DC63E59F-CB68-435C-B1A4-7DA5D722142F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8c_compute_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"088D62A3-1FE5-42D6-9231-41DDE4DA37EF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8cx_compute_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"36903AF3-4E2D-4990-B021-A1D980229077"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8cx_compute_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"472928D4-90F4-402D-B1F2-0CE358326A10"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8cx_gen_2_5g_compute_platform_\\\"poipu_pro\\\"_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"969BA39F-1068-49F3-8EF2-A5F64C5A57DA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8cx_gen_2_5g_compute_platform_\\\"poipu_pro\\\":-:*:*:*:*:*:*:*","matchCriteriaId":"A7A57DE6-615E-45C5-9CCD-2A12905EC368"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8cx_gen_3_compute_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7C155F86-467F-4B57-950E-12FAAB570B01"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8cx_gen_3_compute_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"71E06B94-9463-49A6-B816-E8A82BEA8545"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_x2_elite_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7FEA3409-34AF-4FFB-AB58-ABE600FBA9FC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_x2_elite:-:*:*:*:*:*:*:*","matchCriteriaId":"025C1550-D3DC-434A-91E4-EBFE004F3628"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9340_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8BA28CC6-C8BB-4F50-BFE3-A59F664A4F54"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9340:-:*:*:*:*:*:*:*","matchCriteriaId":"94D2BDF1-764C-48BA-8944-3275E8768078"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9341_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CE852339-1CAE-4983-9757-8F00EDEF1141"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9341:-:*:*:*:*:*:*:*","matchCriteriaId":"4D9E96B3-F1BB-46F8-B715-7DF90180F1E1"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9370_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1295D869-F4DD-4766-B4AA-3513752F43B4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9370:-:*:*:*:*:*:*:*","matchCriteriaId":"B98784DC-3143-4D38-AD28-DBBDCCAB4272"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9375_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"34143ABA-7D09-429F-A65C-3A33438BF62C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9375:-:*:*:*:*:*:*:*","matchCriteriaId":"9D56DFE3-5EF1-4B23-BBD5-0203FBF9CCEC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9378c_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"95D79E3A-1978-4B23-B60B-2BD47FEDF5C2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9378c:-:*:*:*:*:*:*:*","matchCriteriaId":"91B32C89-3238-4FDF-BB3F-F6BAE829769B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"70292B01-617F-44AD-AF77-1AFC1450523D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9380:-:*:*:*:*:*:*:*","matchCriteriaId":"FA94C6D6-85DB-4031-AAF4-C399019AE16D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"92B17201-8185-47F1-9720-5AB4ECD11B22"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9385:-:*:*:*:*:*:*:*","matchCriteriaId":"E1FA2EB9-416F-4D69-8786-386CC73978AE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7861_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"57608D47-894C-4895-B4B3-4733D55D57DB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7861:-:*:*:*:*:*:*:*","matchCriteriaId":"2FFD2C38-1A61-4BED-ABFA-DAE0C4B78620"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7880_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"63735D33-9F09-4841-9FE0-0D9AB604BECF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7880:-:*:*:*:*:*:*:*","matchCriteriaId":"E826F765-4C2E-4319-BBC4-DEB02AAD783F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8810_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"15307882-7039-43E9-9BA3-035045988B99"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8810:-:*:*:*:*:*:*:*","matchCriteriaId":"AA85B322-E593-4499-829A-CC6D70BAE884"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E839A0B9-64C3-4C7A-82B7-D2AAF65928F8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8815:-:*:*:*:*:*:*:*","matchCriteriaId":"7E870D82-DE3B-4199-A730-C8FB545BAA98"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8830_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"11B69595-E488-4590-A150-CE5BE08B5E13"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8830:-:*:*:*:*:*:*:*","matchCriteriaId":"BF680174-5FA6-47D9-8EAB-CC2A37A7BD42"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F80BC68E-7476-4A40-9F48-53722FE9A5BF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8835:-:*:*:*:*:*:*:*","matchCriteriaId":"6B36F4B2-BAA3-45AD-9967-0EB482C99708"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8840_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA33DE15-C177-43B3-AD50-FF797753D12E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8840:-:*:*:*:*:*:*:*","matchCriteriaId":"AE1A5841-5BCB-4033-ACB9-23F3FCA65309"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8845_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5B47BF35-3AA0-4667-842E-19B0FE30BF3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8845:-:*:*:*:*:*:*:*","matchCriteriaId":"8A071672-9405-4418-9141-35CEADBB65AF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8845h_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB7CF473-8B25-4851-91F2-1BD693CCDC85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8845h:-:*:*:*:*:*:*:*","matchCriteriaId":"91E591F2-8F72-4A5A-9264-2742EB2DABDA"}]}]}],"references":[{"url":"https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2026-bulletin.html","source":"product-security@qualcomm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-25291","sourceIdentifier":"product-security@qualcomm.com","published":"2026-10-06T07:16:57.893","lastModified":"2026-10-09T14:11:39.610","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms."}],"affected":[{"source":"product-security@qualcomm.com","affectedData":[{"vendor":"Qualcomm, Inc.","product":"Snapdragon","defaultStatus":"unaffected","platforms":["Snapdragon Auto","Snapdragon Compute","Snapdragon Industrial IOT","Snapdragon Mobile","Snapdragon Wearables"],"versions":[{"version":"FastConnect 6700","status":"affected"},{"version":"FastConnect 6900","status":"affected"},{"version":"FastConnect 7800","status":"affected"},{"version":"LeMans_AU_LGIT","status":"affected"},{"version":"LeMansAU","status":"affected"},{"version":"Orne","status":"affected"},{"version":"Pandeiro","status":"affected"},{"version":"QAM8255P","status":"affected"},{"version":"QAM8295P","status":"affected"},{"version":"QAMSRV1H","status":"affected"},{"version":"QAMSRV1M","status":"affected"},{"version":"QCA6391","status":"affected"},{"version":"QCA6574AU","status":"affected"},{"version":"QCA6595","status":"affected"},{"version":"QCA6696","status":"affected"},{"version":"QCA6698AQ","status":"affected"},{"version":"QCA6797AQ","status":"affected"},{"version":"QCM4290","status":"affected"},{"version":"QCM5430","status":"affected"},{"version":"QCM6490","status":"affected"},{"version":"QCM8838","status":"affected"},{"version":"QCS4290","status":"affected"},{"version":"QLN1083BD","status":"affected"},{"version":"QLN1086BD","status":"affected"},{"version":"QPA1083BD","status":"affected"},{"version":"QPA1086BD","status":"affected"},{"version":"Qualcomm Dragonwing Q-8845","status":"affected"},{"version":"Qualcomm Video Collaboration VC3 Platform","status":"affected"},{"version":"QXM1083","status":"affected"},{"version":"QXM1086","status":"affected"},{"version":"QXM1093","status":"affected"},{"version":"QXM1094","status":"affected"},{"version":"QXM1095","status":"affected"},{"version":"QXM1096","status":"affected"},{"version":"SA7255P","status":"affected"},{"version":"SA7775P","status":"affected"},{"version":"SA8155P","status":"affected"},{"version":"SA8255P","status":"affected"},{"version":"SA8295P","status":"affected"},{"version":"SA8620P","status":"affected"},{"version":"SA8770P","status":"affected"},{"version":"SA9000P","status":"affected"},{"version":"SAR1165P","status":"affected"},{"version":"SC8380XP","status":"affected"},{"version":"SD662","status":"affected"},{"version":"SDR753","status":"affected"},{"version":"SM6225P","status":"affected"},{"version":"SM7325P","status":"affected"},{"version":"Snapdragon 460 Mobile Platform","status":"affected"},{"version":"Snapdragon 662 Mobile Platform","status":"affected"},{"version":"Snapdragon 680 4G Mobile Platform","status":"affected"},{"version":"Snapdragon 685 4G Mobile Platform","status":"affected"},{"version":"Snapdragon 778G 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 778G+ 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 782G Mobile Platform","status":"affected"},{"version":"Snapdragon 7c+ Gen 3 Compute","status":"affected"},{"version":"Snapdragon 8 Elite Gen 5","status":"affected"},{"version":"Snapdragon 888 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 888+ 5G Mobile Platform","status":"affected"},{"version":"Snapdragon AR1 Gen 1 Platform","status":"affected"},{"version":"Snapdragon AR1+ Gen 1 Platform","status":"affected"},{"version":"Snapdragon W5+ Gen 1 Wearable Platform","status":"affected"},{"version":"Snapdragon X53 5G Modem-RF System","status":"affected"},{"version":"Snapdragon Reality Elite Platform","status":"affected"},{"version":"Snapdragon Wear Elite platform","status":"affected"},{"version":"SRV1H","status":"affected"},{"version":"SRV1M","status":"affected"},{"version":"SW5100","status":"affected"},{"version":"SW5100P","status":"affected"},{"version":"Themisto","status":"affected"},{"version":"WCD9370","status":"affected"},{"version":"WCD9375","status":"affected"},{"version":"WCD9378","status":"affected"},{"version":"WCD9380","status":"affected"},{"version":"WCD9385","status":"affected"},{"version":"WCD9395","status":"affected"},{"version":"WCN3950","status":"affected"},{"version":"WCN3988","status":"affected"},{"version":"WCN7860","status":"affected"},{"version":"WCN7861","status":"affected"},{"version":"WSA8810","status":"affected"},{"version":"WSA8830","status":"affected"},{"version":"WSA8832","status":"affected"},{"version":"WSA8835","status":"affected"},{"version":"WSA8840","status":"affected"},{"version":"WSA8845","status":"affected"},{"version":"WSA8845H","status":"affected"},{"version":"X1E80100","status":"affected"},{"version":"XRV7209","status":"affected"},{"version":"XRV9209","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"product-security@qualcomm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T12:14:22.584394Z","id":"CVE-2026-25291","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"product-security@qualcomm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sar1165p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D97CD52-4CB0-4F57-9C24-530B326B8D9D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sar1165p:-:*:*:*:*:*:*:*","matchCriteriaId":"582EE932-DDE5-4BE5-837C-523FE3EFBA5D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sc8380xp_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14E3FE58-7F1C-4F5C-B62D-0CF124E14AB2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sc8380xp:-:*:*:*:*:*:*:*","matchCriteriaId":"FFCB0BBA-3F81-4FCA-B3DE-190C46DA50DB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_662_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"37DF4D73-3ACC-41B3-8CA4-20DAECE6BFB7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_662_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"FE08D23A-2D0D-4472-8847-27B955F55165"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm4875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E21AC0DB-36FF-4B36-9CA9-809949B0CA53"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm4875:-:*:*:*:*:*:*:*","matchCriteriaId":"471434D6-35A1-4F4E-85C5-0180383BD315"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6225p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8D2B7D93-4218-4FFF-B1C0-F50EC0B2B934"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6225p:-:*:*:*:*:*:*:*","matchCriteriaId":"00D9DCE1-B3CD-4F45-97DD-637AA27572DD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6850_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DE09FF94-7751-4EED-B269-C7BB056CA90C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6850:-:*:*:*:*:*:*:*","matchCriteriaId":"02B1463D-EE74-42DC-95D5-D0F66260CB32"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7325p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4BEC725F-19B1-4078-B13D-CE624BE23344"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7325p:-:*:*:*:*:*:*:*","matchCriteriaId":"4EA43E38-A12D-49C3-B05C-A2AF07ED2710"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7435_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F7A95A9E-617A-4D3A-9A4E-0C0A29B3C8B5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7435:-:*:*:*:*:*:*:*","matchCriteriaId":"3559292E-B5A6-4F88-BC20-F6AA85F07C97"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8845p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A205320E-6C60-4F6A-90D5-06CABAF0FDEA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8845p:-:*:*:*:*:*:*:*","matchCriteriaId":"0FB8CE86-605E-4B3D-82E5-A55093ABCE5F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_4_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2CCBF666-CB4E-44E1-9676-6891EDC73578"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_4_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"C767AB6A-1A8C-406C-A600-96A816F44E2F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_460_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"390D7CAF-6C0B-4438-AA7D-AEEE127F4D3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_460_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"5BB1FC5E-CF6F-4E54-B78D-C01AFD034903"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_480_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA3F11F3-C9F4-460D-BD77-1BFBCC1F0592"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_480_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"25673A10-D99C-4F67-BDA7-9C2E4A70EF9C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_480\\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"50906EF2-01F7-4E97-9F49-F892DF41CB29"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_480\\+_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"B23A89FF-9C94-40C6-B9B7-3E8354777916"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_6_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EBB3BC1B-2EBC-457C-AE91-6BD408EB7D5F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_6_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"0870CC30-07F8-4FFF-85B4-FBACE947CC14"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_6_gen_3_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D69E4203-EA20-4D6F-BD1C-C8E550588F87"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_6_gen_3_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"C1225010-5A08-4D13-A3E2-4C57C4265605"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_680_4g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8D0ED00F-1345-43AD-83C6-E979890B84AB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_680_4g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"92C28019-B57D-4487-B551-F7B53395C6E5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_685_4g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C174F07D-0E33-43FD-9BAD-6C6D8B51B6A6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_685_4g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"47311B68-A07F-448B-99D5-9C92C8127A81"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_695_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A9A2DA11-5E4E-4E36-923C-A2D3CC2F2751"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_695_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"BE7DFAD4-1D21-4A3A-9E8C-10F00AD7C403"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_778g_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"87ECCB82-B880-412D-A635-CA6F0B035F2B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_778g_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"424743C4-CE74-4A02-835A-023C9DA0CFAC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_778g\\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14EA48BF-BD65-43B2-8DC1-D97F75AD6FE5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_778g\\+_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"B86E317F-12BF-42F6-879B-88A85F7E3F81"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_782g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"194A4BD4-0DDF-49E5-AA89-40A5BFB71933"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_782g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"72FF9732-40D8-4C12-8259-BAA16FAB5A56"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7c\\+_gen_3_compute_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C4A050CA-8514-400A-A6B3-F513CC93CA14"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7c\\+_gen_3_compute:-:*:*:*:*:*:*:*","matchCriteriaId":"BD850305-1E76-4952-A3FB-F6229CBF7FE9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_elite_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EA50192-07B0-4404-93D4-EC4F3B1918B7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_elite:-:*:*:*:*:*:*:*","matchCriteriaId":"26C7FC48-08CB-4E50-B8D3-8AF30549FDF8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_elite_gen_5_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"41070BDB-15E4-4DD7-A132-A14AA24978E5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_elite_gen_5:-:*:*:*:*:*:*:*","matchCriteriaId":"102460A6-9637-4883-9230-2CC888D5D74E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen_5_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4D8D8AD-B291-4AEC-8817-D7C99E79FF49"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen_5:-:*:*:*:*:*:*:*","matchCriteriaId":"8CA08EA8-A47E-4797-8644-0A48D509939C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_888_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22A78236-5965-4F65-9001-3FE7FF6D27E8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_888_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"414C5C1D-A5DA-47C7-B6C9-3564DD4DD911"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_888\\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"01CBD543-635C-4C57-87B7-55DD3BA3C1A2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_888\\+_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"6A7272B6-AADB-4CCD-B041-66170C313C76"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_ar1_gen_1_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"53E5BBDA-C07D-42E2-9A34-EC1F6454CAA4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_ar1_gen_1_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"0BB2408F-C768-4DD2-B834-B62E188D6CC2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_ar1\\+_gen_1_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BE30A5E0-10D5-4679-ACA6-4ED991335A6F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_ar1\\+_gen_1_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"CFA75B74-D20D-4C8B-BFA2-5DE4848410CD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_w5\\+_gen_1_wearable_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0C455E7D-D256-4240-BE72-2A93273D685A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_w5\\+_gen_1_wearable_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"423E21A1-8F52-46DA-9AC2-77159FEB6001"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_x53_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4F80E77B-B207-4E49-99EF-A1F9ECFAAC99"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_x53_5g_modem-rf_system:-:*:*:*:*:*:*:*","matchCriteriaId":"9A12A6DC-63A2-4B52-971A-C014E40C1E6D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_reality_elite_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"08ACBE23-DBE3-4AE0-B9EA-F3A73290D5F0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_reality_elite_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"3F82A885-4CAB-44F2-85FA-3D581283A936"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_wear_elite_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"21C295D3-AC5D-4DFC-A0B1-3B5F7C08DC46"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_wear_elite_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"A32D44E3-02FC-47AA-B6FF-E87F5866E453"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:srv1h_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0CD199F5-DA68-4BEB-AA99-11572DA26B4F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:srv1h:-:*:*:*:*:*:*:*","matchCriteriaId":"8ACA2D4D-FC77-4C1A-8278-1C27B3EA3303"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:srv1m_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4B29E7F-8BFE-466A-B357-63F8A2160C4E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:srv1m:-:*:*:*:*:*:*:*","matchCriteriaId":"6D55CC7D-2E65-4CA9-9892-B6FBCC087E6F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sw5100_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AA1BF9BB-AF11-46A7-A71C-F7D289E76E3F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sw5100:-:*:*:*:*:*:*:*","matchCriteriaId":"7B8455D6-287D-4934-8E4D-F4127A9C0449"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sw5100p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DB599A9F-0305-4FE4-8623-0F86630FEDCB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sw5100p:-:*:*:*:*:*:*:*","matchCriteriaId":"EEB883BF-68B2-4C25-84DC-5DA953BFAA2F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:themisto_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"55DE7B27-56A2-4046-9E03-8215587C8827"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:themisto:-:*:*:*:*:*:*:*","matchCriteriaId":"0853EA22-4EFD-4037-8B83-CB7C18417D23"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9370_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1295D869-F4DD-4766-B4AA-3513752F43B4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9370:-:*:*:*:*:*:*:*","matchCriteriaId":"B98784DC-3143-4D38-AD28-DBBDCCAB4272"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9375_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"34143ABA-7D09-429F-A65C-3A33438BF62C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9375:-:*:*:*:*:*:*:*","matchCriteriaId":"9D56DFE3-5EF1-4B23-BBD5-0203FBF9CCEC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq8845s_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4FB1D261-4C1B-4D43-B8ED-975E526A2FF5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq8845s:-:*:*:*:*:*:*:*","matchCriteriaId":"54AC5C16-88A9-4C16-B7AF-835E53D7DFA4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq8850ns_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"867A0C11-FBA0-46F1-871F-1800A7A75BB3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq8850ns:-:*:*:*:*:*:*:*","matchCriteriaId":"9885533F-4021-429D-917F-0A2733725B43"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6200_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CDE1CBDE-3D28-463C-B215-AA7DF373EF09"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6200:-:*:*:*:*:*:*:*","matchCriteriaId":"66BD3B88-7CF9-482D-A2DD-67F6ACF4CC57"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6700_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"82B82E87-F3F4-466F-A76B-C8809121FF6F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6700:-:*:*:*:*:*:*:*","matchCriteriaId":"419A132E-E42C-4395-B74B-788A39DF1D13"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6900_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E670F500-9B71-4BBE-B5DA-221D35803C89"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6900:-:*:*:*:*:*:*:*","matchCriteriaId":"9ADEB5C5-B79A-4F45-B7D3-75945B38DB6C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_7800_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B3053D68-C5D8-4D47-A4F0-9F3AF2289E1D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_7800:-:*:*:*:*:*:*:*","matchCriteriaId":"638DBC7F-456F-487D-BED2-2214DFF8BEE2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iq-9075_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"08431A88-C176-48BB-918C-DF3FEABE78D4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iq-9075:-:*:*:*:*:*:*:*","matchCriteriaId":"3C50A35E-023A-404D-BFBC-FFCD1F30E872"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:lemans_au_lgit_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5767FE95-737F-4C20-A5AB-EC641A68D906"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:lemans_au_lgit:-:*:*:*:*:*:*:*","matchCriteriaId":"33323A49-9267-421B-96E1-80C5FA709EBC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:lemansau_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2DF0ED3F-C98B-458E-ADCC-C922402BB185"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:lemansau:-:*:*:*:*:*:*:*","matchCriteriaId":"102A4B5E-1739-4C31-A626-ABF6B02FEE29"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:milos_iot_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"18471E2B-412C-4D07-9997-C8663902D7B5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:milos_iot:-:*:*:*:*:*:*:*","matchCriteriaId":"0284E269-A212-4474-AE46-255D5245096F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:netrani_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9C52A53B-1182-47F3-9800-D8C58F954277"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:netrani:-:*:*:*:*:*:*:*","matchCriteriaId":"BEC1F084-78C8-4413-940A-47E9554CB6D0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:orne_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"19FB8345-BBFC-4E18-A4E6-64A159D7F65B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:orne:-:*:*:*:*:*:*:*","matchCriteriaId":"FFDA4056-3F1B-4F3A-BE59-1908BD3DE5E9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:pandeiro_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F8EF0C-BB48-47E1-A045-254D79388F75"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:pandeiro:-:*:*:*:*:*:*:*","matchCriteriaId":"058950FC-ED72-4E91-AE13-87E738ADC083"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qam8255p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3723C7B1-A7E2-401F-8D6D-189350F6BCA5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qam8255p:-:*:*:*:*:*:*:*","matchCriteriaId":"B12B89EF-7B12-481E-BCBC-F12B9D16321A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qamsrv1h_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F8673334-5E11-4E95-B33D-3029499F71DF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qamsrv1h:-:*:*:*:*:*:*:*","matchCriteriaId":"EC0B32F6-5EF0-4591-99D7-D0E9B09DEC5A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qamsrv1m_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CE03AB2A-3ED9-4489-8E5B-4FCF8BAA8559"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qamsrv1m:-:*:*:*:*:*:*:*","matchCriteriaId":"9E646738-6A87-4470-9640-6A5A1DF3AF78"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6391_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"83B53119-1B2F-4978-B7F5-33B84BE73B68"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6391:-:*:*:*:*:*:*:*","matchCriteriaId":"6FEBC0C5-CAA1-475C-96C2-B8D24B2E4536"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6595_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"643EC76D-2836-48E6-81DA-78C4883C33CA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6595:-:*:*:*:*:*:*:*","matchCriteriaId":"477F6529-4CE1-44FC-B6EE-D24D44C71AE7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6698aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5FA1F8F4-EAF2-4704-A8A6-19AD3CA1B577"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6698aq:-:*:*:*:*:*:*:*","matchCriteriaId":"B3F7853D-09EE-476F-B48D-BB30AEB4A67D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6797aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"797295C2-535C-46A9-A725-E1A5405F0436"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6797aq:-:*:*:*:*:*:*:*","matchCriteriaId":"8BFC575E-594E-4711-94B1-2DC8D03B9AC4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm4290_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3C7FFB96-53E7-41A2-BC99-7ACD853214A8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm4290:-:*:*:*:*:*:*:*","matchCriteriaId":"74EBA77E-69A5-4145-9BEC-CD39BA132309"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm5430_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4EC5F81B-AA24-4E3C-9FC8-53E010AC977E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm5430:-:*:*:*:*:*:*:*","matchCriteriaId":"B5C66DAD-0D85-46B8-92D7-6D68B9429E9A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm6490_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"ADD6D51E-5787-42A6-8A02-4EBBAFFF9C94"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm6490:-:*:*:*:*:*:*:*","matchCriteriaId":"99AA0291-B822-4CAD-BA17-81B632FC3FEF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs4290_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"06789CB9-E6FA-400D-90B6-C2DB6C8EF153"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs4290:-:*:*:*:*:*:*:*","matchCriteriaId":"FFCB9F22-57F2-4327-95B9-B2342A02E45E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qln1083bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FD70F234-1EE7-4362-97F6-5AEDB7078D03"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qln1083bd:-:*:*:*:*:*:*:*","matchCriteriaId":"C569A848-B70C-42EF-B6D5-4A86547586EE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qln1086bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F218DF06-C40A-4738-ABB5-A3FA2243EF84"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qln1086bd:-:*:*:*:*:*:*:*","matchCriteriaId":"2E2A0CD0-66FA-45D6-BBC7-03641203EC73"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qmp1000_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5298473D-8B34-42E6-BC32-69A3800972B4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qmp1000:-:*:*:*:*:*:*:*","matchCriteriaId":"2A1CF44E-FFC2-4DCB-8DC2-46422D912448"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qmp2001_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0B53AF78-37B0-4D64-A7D3-1729D0248D61"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qmp2001:-:*:*:*:*:*:*:*","matchCriteriaId":"560E36D2-27DB-4590-A879-C2071ED72641"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qpa1083bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B0208F7B-A959-485E-B004-A34CB7C7C4C9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qpa1083bd:-:*:*:*:*:*:*:*","matchCriteriaId":"FBDAC812-4603-4D24-A861-23825E32D44E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qpa1086bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7F6DEF72-A8FF-4B67-AA6C-5CB4AA7B35E1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qpa1086bd:-:*:*:*:*:*:*:*","matchCriteriaId":"00EF6875-B088-40BD-A526-C962789CDC5A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:video_collaboration_vc1_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C3607443-848D-4334-B5E4-0DC27F28509B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:video_collaboration_vc1_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"2E8F00DD-C894-4236-8932-7F7FCD15D2A5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:video_collaboration_vc3_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DD4946C6-778F-4542-AB77-C9B86AF25C05"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:video_collaboration_vc3_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"6F1D604A-4530-42B3-80A0-58A82D658DDD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1083_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0CE74B89-5E3F-428E-8000-E3452B8B6953"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1083:-:*:*:*:*:*:*:*","matchCriteriaId":"DC11B7A6-E621-463D-B861-6B203EADFA57"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1086_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E48759CC-B751-4466-87DF-2D0AB220C0FB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1086:-:*:*:*:*:*:*:*","matchCriteriaId":"E7F1C9D2-6616-4F74-85C2-1850B5C3F6BC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1093_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9A46B609-BD06-4BB7-B055-1F71C555E93D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1093:-:*:*:*:*:*:*:*","matchCriteriaId":"59598462-1E53-4F6D-BAB5-06ACEDF6CD9F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1094_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8F30D66E-2802-4394-BC39-5E04711234FF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1094:-:*:*:*:*:*:*:*","matchCriteriaId":"078EC383-784F-4468-B94C-AE7CC9808419"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1095_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B7B67C93-0453-4696-8F3D-0AD664922C44"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1095:-:*:*:*:*:*:*:*","matchCriteriaId":"D61C46AA-9130-46A8-BD04-8B4235118B81"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1096_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2E2D5E44-48F6-41E8-A38B-A2E070E16AA9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1096:-:*:*:*:*:*:*:*","matchCriteriaId":"9BD0372F-5140-4966-9A27-6B5A606C0665"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa7255p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2B651F0A-34DA-400F-A376-B499BFDF8E86"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa7255p:-:*:*:*:*:*:*:*","matchCriteriaId":"4CFF093D-98C8-470F-8330-E5126E06343A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa7775p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6C32CA38-5D48-4108-9858-FD66E20CAF2F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa7775p:-:*:*:*:*:*:*:*","matchCriteriaId":"E1997F8B-17B8-4DE3-BCF7-726928720592"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8155p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C8648B38-2597-401A-8F53-D582FA911569"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8155p:-:*:*:*:*:*:*:*","matchCriteriaId":"A01CD59B-8F21-4CD6-8A1A-7B37547A8715"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8255p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EC6E268D-C4AF-4950-9223-39EA36D538A8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8255p:-:*:*:*:*:*:*:*","matchCriteriaId":"073C1A81-D02B-4F2F-9378-CD1B2DCE0E5B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8620p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6ACE6D64-A498-482F-8270-718F4884CFFD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8620p:-:*:*:*:*:*:*:*","matchCriteriaId":"B6E016D6-1B83-4261-A27E-1F9873F81E14"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8770p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"781CCC31-C08F-499B-BE73-6C7DB70437AF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8770p:-:*:*:*:*:*:*:*","matchCriteriaId":"75AFAA21-0589-4C6A-9418-34EE8A61BBAD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa9000p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A024AB04-B213-4018-A4C1-FA467C7BA775"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa9000p:-:*:*:*:*:*:*:*","matchCriteriaId":"A2A8AB7C-5D34-4794-8C06-2193075B323F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9378_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4CFDBB5B-0A4F-4032-874F-D2A7EF933FB0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9378:-:*:*:*:*:*:*:*","matchCriteriaId":"D28A12D6-CC60-4BE9-ADEE-FAB58B05440F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"70292B01-617F-44AD-AF77-1AFC1450523D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9380:-:*:*:*:*:*:*:*","matchCriteriaId":"FA94C6D6-85DB-4031-AAF4-C399019AE16D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"92B17201-8185-47F1-9720-5AB4ECD11B22"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9385:-:*:*:*:*:*:*:*","matchCriteriaId":"E1FA2EB9-416F-4D69-8786-386CC73978AE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9395_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"699056F6-1517-4F25-AE07-4FFCF6923B9F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9395:-:*:*:*:*:*:*:*","matchCriteriaId":"E4C023D2-6FF5-4FFC-B9F2-895979166580"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3950_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3FEF2DB6-00F5-4B07-953B-EF58B31267F1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3950:-:*:*:*:*:*:*:*","matchCriteriaId":"120E8F0F-EBEB-4565-9927-2D473F783EF7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3980_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9C6E9038-9B18-4958-BE1E-215901C9B4B2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3980:-:*:*:*:*:*:*:*","matchCriteriaId":"B36D3274-F8D0-49C5-A6D5-95F5DC6D1950"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4BFB25F-013B-48E3-99FF-3E8687F94423"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3988:-:*:*:*:*:*:*:*","matchCriteriaId":"BF676C5B-838B-446C-A689-6A25AB8A87E2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn6450_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1FAFC9FA-E6EF-44C5-BD50-2824C7711541"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn6450:-:*:*:*:*:*:*:*","matchCriteriaId":"6F895CDD-F9BB-45AD-AE60-71F4549114A4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn6755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2BC386D9-3D2B-40FA-A2D9-199BB138F46A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn6755:-:*:*:*:*:*:*:*","matchCriteriaId":"133FFD9F-FA09-4801-939B-AD1D507BE5FE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7760_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"506C6CE1-6BDF-4542-82C1-820D10D8181A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7760:-:*:*:*:*:*:*:*","matchCriteriaId":"72F8CE3B-2BDC-40B1-BB04-A3A7E25B8096"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7860_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2EB8794F-7998-424E-AF68-E4A4F9310F65"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7860:-:*:*:*:*:*:*:*","matchCriteriaId":"799D69CE-3FCC-4B19-8B00-9AF38111D983"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7861_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"57608D47-894C-4895-B4B3-4733D55D57DB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7861:-:*:*:*:*:*:*:*","matchCriteriaId":"2FFD2C38-1A61-4BED-ABFA-DAE0C4B78620"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7880_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"63735D33-9F09-4841-9FE0-0D9AB604BECF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7880:-:*:*:*:*:*:*:*","matchCriteriaId":"E826F765-4C2E-4319-BBC4-DEB02AAD783F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D765C392-5F38-4E6A-9E88-59629E7A6911"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7881:-:*:*:*:*:*:*:*","matchCriteriaId":"FAE8F4F9-F692-4EC0-A3FE-2CDD681DCBFD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8810_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"15307882-7039-43E9-9BA3-035045988B99"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8810:-:*:*:*:*:*:*:*","matchCriteriaId":"AA85B322-E593-4499-829A-CC6D70BAE884"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E839A0B9-64C3-4C7A-82B7-D2AAF65928F8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8815:-:*:*:*:*:*:*:*","matchCriteriaId":"7E870D82-DE3B-4199-A730-C8FB545BAA98"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8830_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"11B69595-E488-4590-A150-CE5BE08B5E13"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8830:-:*:*:*:*:*:*:*","matchCriteriaId":"BF680174-5FA6-47D9-8EAB-CC2A37A7BD42"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8832_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7ACAD26E-B79E-4659-91A5-D301281F7D36"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8832:-:*:*:*:*:*:*:*","matchCriteriaId":"F0E46DA6-9494-4D92-A4AE-A272AF6ACCCC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F80BC68E-7476-4A40-9F48-53722FE9A5BF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8835:-:*:*:*:*:*:*:*","matchCriteriaId":"6B36F4B2-BAA3-45AD-9967-0EB482C99708"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8840_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA33DE15-C177-43B3-AD50-FF797753D12E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8840:-:*:*:*:*:*:*:*","matchCriteriaId":"AE1A5841-5BCB-4033-ACB9-23F3FCA65309"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8845_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5B47BF35-3AA0-4667-842E-19B0FE30BF3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8845:-:*:*:*:*:*:*:*","matchCriteriaId":"8A071672-9405-4418-9141-35CEADBB65AF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8845h_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB7CF473-8B25-4851-91F2-1BD693CCDC85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8845h:-:*:*:*:*:*:*:*","matchCriteriaId":"91E591F2-8F72-4A5A-9264-2742EB2DABDA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8850_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FA243934-7BFA-47AA-B78C-CCB25377E471"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8850:-:*:*:*:*:*:*:*","matchCriteriaId":"2FD65035-4D20-48D5-874E-47CD9C7A985C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8850w_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22707187-A56D-48AD-800F-A438FD844546"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8850w:-:*:*:*:*:*:*:*","matchCriteriaId":"F526A54A-F974-4D0A-A1A6-FABBB6711CD0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8855c_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"671E0B82-5D58-4644-8806-7F4CAFFB6641"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8855c:-:*:*:*:*:*:*:*","matchCriteriaId":"CC066321-B3CC-4E88-BFA9-414B8D095207"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:x1e80100_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42F453E4-02CC-4E48-A25B-F1394069F524"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:x1e80100:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6671AE-3490-4D85-A20C-3DA26F7D7AEB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:xrv7209_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CC6C6243-E092-4903-BC20-E3B0CECBC790"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:xrv7209:-:*:*:*:*:*:*:*","matchCriteriaId":"AAA33761-D61C-4A81-B233-5E2D50F3596F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:xrv9209_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D693483-72F9-42B1-8EDA-8DABD537F428"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:xrv9209:-:*:*:*:*:*:*:*","matchCriteriaId":"43F4A7D9-055D-475B-BFE4-61A86C7397F8"}]}]}],"references":[{"url":"https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2026-bulletin.html","source":"product-security@qualcomm.com","tags":["Vendor Advisory","Patch"]}]}},{"cve":{"id":"CVE-2026-25302","sourceIdentifier":"product-security@qualcomm.com","published":"2026-10-06T07:16:58.040","lastModified":"2026-10-09T14:11:52.460","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed."}],"affected":[{"source":"product-security@qualcomm.com","affectedData":[{"vendor":"Qualcomm, Inc.","product":"Snapdragon","defaultStatus":"unaffected","platforms":["Snapdragon Auto","Snapdragon CCW","Snapdragon Compute","Snapdragon Connectivity","Snapdragon Consumer IOT","Snapdragon Edge Cloud AI","Snapdragon Industrial IOT","Snapdragon MDM","Snapdragon Mobile","Snapdragon Technology","Snapdragon WBC","Snapdragon Wearables","Snapdragon Wired Infrastructure and Networking"],"versions":[{"version":"5G Fixed Wireless Access Platform","status":"affected"},{"version":"AR8035","status":"affected"},{"version":"Cologne","status":"affected"},{"version":"CQ7790","status":"affected"},{"version":"CQ8725S","status":"affected"},{"version":"CQ8750M","status":"affected"},{"version":"CSRA6620","status":"affected"},{"version":"CSRA6640","status":"affected"},{"version":"FastConnect 6200","status":"affected"},{"version":"FastConnect 6700","status":"affected"},{"version":"FastConnect 6800","status":"affected"},{"version":"FastConnect 6900","status":"affected"},{"version":"FastConnect 7800","status":"affected"},{"version":"FWA Gen 3 Ultra Platform","status":"affected"},{"version":"FWA Gen 5 Elite Platform","status":"affected"},{"version":"G1 Gen 1","status":"affected"},{"version":"G2 Gen 1","status":"affected"},{"version":"G3x Gen 2","status":"affected"},{"version":"IPQ9048","status":"affected"},{"version":"IPQ9570","status":"affected"},{"version":"IPQ9574","status":"affected"},{"version":"IQ10 Series","status":"affected"},{"version":"IQ6 Series Platform","status":"affected"},{"version":"IQ8 Series Platform","status":"affected"},{"version":"IQ9 Series Platform","status":"affected"},{"version":"IQX5121","status":"affected"},{"version":"Kalpeni","status":"affected"},{"version":"Kobuk","status":"affected"},{"version":"LeMans_AU_LGIT","status":"affected"},{"version":"LeMansAU","status":"affected"},{"version":"Marina","status":"affected"},{"version":"MBM415","status":"affected"},{"version":"MBM715","status":"affected"},{"version":"Milos","status":"affected"},{"version":"Monaco_IOT","status":"affected"},{"version":"NPro A8 Elite Platform","status":"affected"},{"version":"Orne","status":"affected"},{"version":"Palawan25","status":"affected"},{"version":"Pandeiro","status":"affected"},{"version":"Q-2390","status":"affected"},{"version":"Q-4390","status":"affected"},{"version":"QAM8255P","status":"affected"},{"version":"QAM8295P","status":"affected"},{"version":"QAM8620P","status":"affected"},{"version":"QAMSRV1H","status":"affected"},{"version":"QAMSRV1M","status":"affected"},{"version":"QCA0000","status":"affected"},{"version":"QCA6174A","status":"affected"},{"version":"QCA6391","status":"affected"},{"version":"QCA6421","status":"affected"},{"version":"QCA6426","status":"affected"},{"version":"QCA6431","status":"affected"},{"version":"QCA6436","status":"affected"},{"version":"QCA6564AU","status":"affected"},{"version":"QCA6574A","status":"affected"},{"version":"QCA6574AU","status":"affected"},{"version":"QCA6584AU","status":"affected"},{"version":"QCA6595","status":"affected"},{"version":"QCA6595AU","status":"affected"},{"version":"QCA6678AQ","status":"affected"},{"version":"QCA6688AQ","status":"affected"},{"version":"QCA6696","status":"affected"},{"version":"QCA6698AQ","status":"affected"},{"version":"QCA6698AU","status":"affected"},{"version":"QCA6797AQ","status":"affected"},{"version":"QCA8075","status":"affected"},{"version":"QCA8080","status":"affected"},{"version":"QCA8081","status":"affected"},{"version":"QCA8082","status":"affected"},{"version":"QCA8084","status":"affected"},{"version":"QCA8085","status":"affected"},{"version":"QCA8101","status":"affected"},{"version":"QCA8102","status":"affected"},{"version":"QCA8111","status":"affected"},{"version":"QCA8112","status":"affected"},{"version":"QCA8337","status":"affected"},{"version":"QCA8384","status":"affected"},{"version":"QCA8385","status":"affected"},{"version":"QCA8386","status":"affected"},{"version":"QCA8695AU","status":"affected"},{"version":"QCC2070","status":"affected"},{"version":"QCC6705","status":"affected"},{"version":"QCC710","status":"affected"},{"version":"QCF8001","status":"affected"},{"version":"QCM2290","status":"affected"},{"version":"QCM4290","status":"affected"},{"version":"QCM4325","status":"affected"},{"version":"QCM5430","status":"affected"},{"version":"QCM6490","status":"affected"},{"version":"QCM6650","status":"affected"},{"version":"QCM8550","status":"affected"},{"version":"QCM8838","status":"affected"},{"version":"QCN5124","status":"affected"},{"version":"QCN5224","status":"affected"},{"version":"QCN6024","status":"affected"},{"version":"QCN6224","status":"affected"},{"version":"QCN6274","status":"affected"},{"version":"QCN7606","status":"affected"},{"version":"QCN9011","status":"affected"},{"version":"QCN9012","status":"affected"},{"version":"QCN9024","status":"affected"},{"version":"QCN9274","status":"affected"},{"version":"QCS2290","status":"affected"},{"version":"QCS4290","status":"affected"},{"version":"QCS8550","status":"affected"},{"version":"QDU1000","status":"affected"},{"version":"QDU1110","status":"affected"},{"version":"QDU1210","status":"affected"},{"version":"QDX1010","status":"affected"},{"version":"QDX1011","status":"affected"},{"version":"QEP8111","status":"affected"},{"version":"QFW7114","status":"affected"},{"version":"QFW7124","status":"affected"},{"version":"QFW7224","status":"affected"},{"version":"QLN1083BD","status":"affected"},{"version":"QLN1086BD","status":"affected"},{"version":"QMP1000","status":"affected"},{"version":"QMX82L","status":"affected"},{"version":"QMX85L","status":"affected"},{"version":"QPA1083BD","status":"affected"},{"version":"QPA1086BD","status":"affected"},{"version":"QRB5165N","status":"affected"},{"version":"QRU1032","status":"affected"},{"version":"QSM8250","status":"affected"},{"version":"QSM8350","status":"affected"},{"version":"Qualcomm Dragonwing IQ-X","status":"affected"},{"version":"Qualcomm Dragonwing Q-6690","status":"affected"},{"version":"Qualcomm Dragonwing Q-7790","status":"affected"},{"version":"Qualcomm Dragonwing Q-8845","status":"affected"},{"version":"Qualcomm Dragonwing QCM4490","status":"affected"},{"version":"Qualcomm Dragonwing QRB5165","status":"affected"},{"version":"Qualcomm Dragonwing QRU100 Platform","status":"affected"},{"version":"Qualcomm Dragonwing X100 Accelerator Card","status":"affected"},{"version":"Qualcomm Video Collaboration VC3 Platform","status":"affected"},{"version":"Qualcomm Video Collaboration VC5 Platform","status":"affected"},{"version":"QXM1083","status":"affected"},{"version":"QXM1086","status":"affected"},{"version":"QXM1093","status":"affected"},{"version":"QXM1094","status":"affected"},{"version":"QXM1095","status":"affected"},{"version":"QXM1096","status":"affected"},{"version":"Robotics RB2 Platform","status":"affected"},{"version":"Robotics RB5 Platform","status":"affected"},{"version":"SA510M","status":"affected"},{"version":"SA7255P","status":"affected"},{"version":"SA7775P","status":"affected"},{"version":"SA8255P","status":"affected"},{"version":"SA8295P","status":"affected"},{"version":"SA8530P","status":"affected"},{"version":"SA8540P","status":"affected"},{"version":"SA8620P","status":"affected"},{"version":"SA8770P","status":"affected"},{"version":"SA9000P","status":"affected"},{"version":"SAR1165P","status":"affected"},{"version":"SAR2130P","status":"affected"},{"version":"SC8380XP","status":"affected"},{"version":"SD 8 Gen1 5G","status":"affected"},{"version":"SD460","status":"affected"},{"version":"SD662","status":"affected"},{"version":"SD865 5G","status":"affected"},{"version":"SD888","status":"affected"},{"version":"SDR753","status":"affected"},{"version":"SDX61","status":"affected"},{"version":"SDX71M","status":"affected"},{"version":"SDX81","status":"affected"},{"version":"SM4125","status":"affected"},{"version":"SM6225P","status":"affected"},{"version":"SM6370","status":"affected"},{"version":"SM6650P","status":"affected"},{"version":"SM7250P","status":"affected"},{"version":"SM7315","status":"affected"},{"version":"SM7325P","status":"affected"},{"version":"SM7635P","status":"affected"},{"version":"SM7675","status":"affected"},{"version":"SM7675P","status":"affected"},{"version":"SM8550P","status":"affected"},{"version":"SM8635","status":"affected"},{"version":"SM8635P","status":"affected"},{"version":"SM8650Q","status":"affected"},{"version":"SM8750P","status":"affected"},{"version":"Smart Audio 400 Platform","status":"affected"},{"version":"Snapdragon 4 Gen 1 Mobile Platform","status":"affected"},{"version":"Snapdragon 4 Gen 2 Mobile Platform","status":"affected"},{"version":"Snapdragon 460 Mobile Platform","status":"affected"},{"version":"Snapdragon 480 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 480+ 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 6 Gen 4 Mobile Platform","status":"affected"},{"version":"Snapdragon 662 Mobile Platform","status":"affected"},{"version":"Snapdragon 680 4G Mobile Platform","status":"affected"},{"version":"Snapdragon 685 4G Mobile Platform","status":"affected"},{"version":"Snapdragon 690 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 695 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 7 Gen 4 Mobile Platform","status":"affected"},{"version":"Snapdragon 750G 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 765 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 765G 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 768G 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 778G 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 778G+ 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 780G 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 782G Mobile Platform","status":"affected"},{"version":"Snapdragon 7c+ Gen 3 Compute","status":"affected"},{"version":"Snapdragon 7s Gen 3 Mobile Platform","status":"affected"},{"version":"Snapdragon 8 Elite","status":"affected"},{"version":"Snapdragon 8 Elite Gen 5","status":"affected"},{"version":"Snapdragon 8 Gen 1 Mobile Platform","status":"affected"},{"version":"Snapdragon 8 Gen 2 Mobile Platform","status":"affected"},{"version":"Snapdragon 8 Gen 3 Mobile Platform","status":"affected"},{"version":"Snapdragon 8+ Gen 1 Mobile Platform","status":"affected"},{"version":"Snapdragon 8+ Gen 2 Mobile Platform","status":"affected"},{"version":"Snapdragon 865 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 865+ 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 870 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 888 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 888+ 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 8cx Gen 3 Compute Platform","status":"affected"},{"version":"Snapdragon AR1 Gen 1 Platform","status":"affected"},{"version":"Snapdragon AR1+ Gen 1 Platform","status":"affected"},{"version":"Snapdragon Auto 5G Modem-RF Gen 2","status":"affected"},{"version":"Snapdragon C Platform","status":"affected"},{"version":"Snapdragon Ride Elite","status":"affected"},{"version":"Snapdragon W5+ Gen 1 Wearable Platform","status":"affected"},{"version":"Snapdragon X2 Elite","status":"affected"},{"version":"Snapdragon X32 5G Modem-RF System","status":"affected"},{"version":"Snapdragon X35 5G Modem-RF System","status":"affected"},{"version":"Snapdragon X53 5G Modem-RF System","status":"affected"},{"version":"Snapdragon X55 5G Modem-RF System","status":"affected"},{"version":"Snapdragon X62 5G Modem-RF System","status":"affected"},{"version":"Snapdragon X65 5G Modem-RF System","status":"affected"},{"version":"Snapdragon X70 Modem-RF System","status":"affected"},{"version":"Snapdragon X72 5G Modem-RF System","status":"affected"},{"version":"Snapdragon X75 5G Modem-RF System","status":"affected"},{"version":"Snapdragon X80 5G Modem-RF System","status":"affected"},{"version":"Snapdragon XR2 5G Platform","status":"affected"},{"version":"Snapdragon XR2+ Gen 1 Platform","status":"affected"},{"version":"Snapdragon Cockpit Elite","status":"affected"},{"version":"Snapdragon Reality Elite Platform","status":"affected"},{"version":"Snapdragon Wear Elite platform","status":"affected"},{"version":"SRV1H","status":"affected"},{"version":"SRV1L","status":"affected"},{"version":"SRV1M","status":"affected"},{"version":"SSG2115P","status":"affected"},{"version":"SSG2125P","status":"affected"},{"version":"SW5100","status":"affected"},{"version":"SW5100P","status":"affected"},{"version":"SW-only","status":"affected"},{"version":"SXR1230P","status":"affected"},{"version":"SXR2130","status":"affected"},{"version":"SXR2230P","status":"affected"},{"version":"SXR2250P","status":"affected"},{"version":"TalynPlus","status":"affected"},{"version":"Themisto","status":"affected"},{"version":"Trestles","status":"affected"},{"version":"WCD9335","status":"affected"},{"version":"WCD9340","status":"affected"},{"version":"WCD9370","status":"affected"},{"version":"WCD9375","status":"affected"},{"version":"WCD9378","status":"affected"},{"version":"WCD9378C","status":"affected"},{"version":"WCD9380","status":"affected"},{"version":"WCD9385","status":"affected"},{"version":"WCD9390","status":"affected"},{"version":"WCD9395","status":"affected"},{"version":"WCN3910","status":"affected"},{"version":"WCN3950","status":"affected"},{"version":"WCN3980","status":"affected"},{"version":"WCN3988","status":"affected"},{"version":"WCN6450","status":"affected"},{"version":"WCN6650","status":"affected"},{"version":"WCN6740","status":"affected"},{"version":"WCN6755","status":"affected"},{"version":"WCN7860","status":"affected"},{"version":"WCN7861","status":"affected"},{"version":"WCN7880","status":"affected"},{"version":"WCN7881","status":"affected"},{"version":"WSA8810","status":"affected"},{"version":"WSA8815","status":"affected"},{"version":"WSA8830","status":"affected"},{"version":"WSA8832","status":"affected"},{"version":"WSA8835","status":"affected"},{"version":"WSA8840","status":"affected"},{"version":"WSA8845","status":"affected"},{"version":"WSA8845H","status":"affected"},{"version":"X1E80100","status":"affected"},{"version":"XRV7209","status":"affected"},{"version":"XRV9209","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"product-security@qualcomm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T12:08:31.949796Z","id":"CVE-2026-25302","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"product-security@qualcomm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-347"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:xrv9209_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D693483-72F9-42B1-8EDA-8DABD537F428"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:xrv9209:-:*:*:*:*:*:*:*","matchCriteriaId":"43F4A7D9-055D-475B-BFE4-61A86C7397F8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_g1_gen_2_gaming_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"905C9267-C1B5-4A77-BC33-118986A907C7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_g1_gen_2_gaming_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"671C9107-7E54-4FBC-B03D-1EB4DCD8597E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:ar8035_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C88B9C86-2E8E-4DCE-A30C-02977CC00F00"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:ar8035:-:*:*:*:*:*:*:*","matchCriteriaId":"EE473A5A-5CFC-4F08-A173-30717F8BD0D7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cologne_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8FF959C0-5AAB-4DC5-AE8F-4EFA21A00B5E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cologne:-:*:*:*:*:*:*:*","matchCriteriaId":"E31E0C48-FB61-47C8-B28B-3A701E85E126"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq2390m_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8DAB4A10-45A2-47B2-AAED-46DCC9740396"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq2390m:-:*:*:*:*:*:*:*","matchCriteriaId":"F793F65B-324E-416A-B9CD-0496F5E9CB8C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qmp2001_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0B53AF78-37B0-4D64-A7D3-1729D0248D61"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qmp2001:-:*:*:*:*:*:*:*","matchCriteriaId":"560E36D2-27DB-4590-A879-C2071ED72641"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qmx82l_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4AB9E3D9-5E23-43A6-818E-A919AEB05ADC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qmx82l:-:*:*:*:*:*:*:*","matchCriteriaId":"D07B2A4C-3CFC-4F8B-A38A-C75C13F3F46F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qmx85l_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E75672CA-A1DC-437B-8DAE-279A1BFEEF20"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qmx85l:-:*:*:*:*:*:*:*","matchCriteriaId":"685536A8-AF25-409E-B501-B2AC05D22A75"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qna715_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7B3FD468-BE2F-4C80-843B-7EC3845F6923"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qna715:-:*:*:*:*:*:*:*","matchCriteriaId":"342A6C3B-5128-40C5-BB3B-151D5B6C7BDA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qpa1083bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B0208F7B-A959-485E-B004-A34CB7C7C4C9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qpa1083bd:-:*:*:*:*:*:*:*","matchCriteriaId":"FBDAC812-4603-4D24-A861-23825E32D44E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qpa1086bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7F6DEF72-A8FF-4B67-AA6C-5CB4AA7B35E1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qpa1086bd:-:*:*:*:*:*:*:*","matchCriteriaId":"00EF6875-B088-40BD-A526-C962789CDC5A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qru1032_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8ECC6966-23CF-4189-81B3-477A97E38B05"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qru1032:-:*:*:*:*:*:*:*","matchCriteriaId":"01490429-D26C-4F80-83A4-8DC257142B86"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qualcomm_dragonwing_qru100_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7A4CF522-1781-4FA1-9584-6FACAF4E2A93"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qualcomm_dragonwing_qru100_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"E8242199-4435-40F8-847F-57096494430A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qualcomm_dragonwing_x100_accelerator_card_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2B607855-6EEC-42E8-AA0E-AC76CB86EBEF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qualcomm_dragonwing_x100_accelerator_card:-:*:*:*:*:*:*:*","matchCriteriaId":"D7533B93-3804-4E35-9FEE-840517D5B1F9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:video_collaboration_vc3_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DD4946C6-778F-4542-AB77-C9B86AF25C05"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:video_collaboration_vc3_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"6F1D604A-4530-42B3-80A0-58A82D658DDD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:video_collaboration_vc5_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"87CF9AD4-6E1B-47E8-B441-022A03858875"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:video_collaboration_vc5_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"791C1E60-162D-4881-80D5-895658FEC47E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1083_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0CE74B89-5E3F-428E-8000-E3452B8B6953"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1083:-:*:*:*:*:*:*:*","matchCriteriaId":"DC11B7A6-E621-463D-B861-6B203EADFA57"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1086_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E48759CC-B751-4466-87DF-2D0AB220C0FB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1086:-:*:*:*:*:*:*:*","matchCriteriaId":"E7F1C9D2-6616-4F74-85C2-1850B5C3F6BC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1093_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9A46B609-BD06-4BB7-B055-1F71C555E93D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1093:-:*:*:*:*:*:*:*","matchCriteriaId":"59598462-1E53-4F6D-BAB5-06ACEDF6CD9F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1094_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8F30D66E-2802-4394-BC39-5E04711234FF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1094:-:*:*:*:*:*:*:*","matchCriteriaId":"078EC383-784F-4468-B94C-AE7CC9808419"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1095_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B7B67C93-0453-4696-8F3D-0AD664922C44"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1095:-:*:*:*:*:*:*:*","matchCriteriaId":"D61C46AA-9130-46A8-BD04-8B4235118B81"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1096_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2E2D5E44-48F6-41E8-A38B-A2E070E16AA9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1096:-:*:*:*:*:*:*:*","matchCriteriaId":"9BD0372F-5140-4966-9A27-6B5A606C0665"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:robotics_rb2_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"76F5D880-7BBD-4B33-AC47-9B5C4AA49A36"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:robotics_rb2_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"3D0194E5-328D-4E53-A1F2-1CFE333217F4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:robotics_rb5_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FCA73E75-F339-49BA-B1F6-619E4630DE92"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:robotics_rb5_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"5DA6E940-1059-4EA2-8225-0F754FE9F50F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa510m_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5D1DD78C-B02F-43DC-A897-3F1FA722FBB2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa510m:-:*:*:*:*:*:*:*","matchCriteriaId":"2E3E455C-CE5C-4319-B83A-D4CBFE195BF8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa7255p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2B651F0A-34DA-400F-A376-B499BFDF8E86"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa7255p:-:*:*:*:*:*:*:*","matchCriteriaId":"4CFF093D-98C8-470F-8330-E5126E06343A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa7775p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6C32CA38-5D48-4108-9858-FD66E20CAF2F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa7775p:-:*:*:*:*:*:*:*","matchCriteriaId":"E1997F8B-17B8-4DE3-BCF7-726928720592"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8255p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EC6E268D-C4AF-4950-9223-39EA36D538A8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8255p:-:*:*:*:*:*:*:*","matchCriteriaId":"073C1A81-D02B-4F2F-9378-CD1B2DCE0E5B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8295p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2A19659B-A0C3-44B7-8D54-BA21729873A4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8295p:-:*:*:*:*:*:*:*","matchCriteriaId":"F978041A-CE28-4BDF-A7DB-F0360F1A5F14"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8540p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8FE8B62D-83B4-4326-8A53-FED5947D5FFE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8540p:-:*:*:*:*:*:*:*","matchCriteriaId":"2D6F8899-136A-4A57-9F02-BD428E1663DA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8620p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6ACE6D64-A498-482F-8270-718F4884CFFD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8620p:-:*:*:*:*:*:*:*","matchCriteriaId":"B6E016D6-1B83-4261-A27E-1F9873F81E14"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8770p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"781CCC31-C08F-499B-BE73-6C7DB70437AF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8770p:-:*:*:*:*:*:*:*","matchCriteriaId":"75AFAA21-0589-4C6A-9418-34EE8A61BBAD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa9000p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A024AB04-B213-4018-A4C1-FA467C7BA775"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa9000p:-:*:*:*:*:*:*:*","matchCriteriaId":"A2A8AB7C-5D34-4794-8C06-2193075B323F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sar1165p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D97CD52-4CB0-4F57-9C24-530B326B8D9D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sar1165p:-:*:*:*:*:*:*:*","matchCriteriaId":"582EE932-DDE5-4BE5-837C-523FE3EFBA5D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sar2130p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"95696696-D2AE-4358-AF5D-3ED14F969964"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sar2130p:-:*:*:*:*:*:*:*","matchCriteriaId":"1A6FC469-463F-4EC1-B4EF-010BDB9BAA05"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sc8380xp_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14E3FE58-7F1C-4F5C-B62D-0CF124E14AB2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sc8380xp:-:*:*:*:*:*:*:*","matchCriteriaId":"FFCB0BBA-3F81-4FCA-B3DE-190C46DA50DB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen1_5g_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D0567B3-D81A-4EEE-868B-4DC2214C159D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen1_5g:-:*:*:*:*:*:*:*","matchCriteriaId":"76236C11-4903-4AD4-9134-3EDD3451EE43"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_662_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"37DF4D73-3ACC-41B3-8CA4-20DAECE6BFB7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_662_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"FE08D23A-2D0D-4472-8847-27B955F55165"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_865_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6C9F4285-1F09-40CD-B1AA-84B406FD6A71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_865_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"8623DD44-DFDD-442D-9789-11A527A450A4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sdr753_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A49B142B-E8DC-4A79-B969-2C2FBE2E009A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sdr753:-:*:*:*:*:*:*:*","matchCriteriaId":"8A1A6C7D-EAB0-4D8D-9A3E-DA066F4ACF7D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sdx61_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3125FCBA-94BA-415A-A005-CDC5B2CDBE39"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sdx61:-:*:*:*:*:*:*:*","matchCriteriaId":"BCB09831-632C-4043-B7BE-C02ADA70AACA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sdx71m_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"44B3A95E-7D1B-4EAA-8FFF-E416EFB265D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sdx71m:-:*:*:*:*:*:*:*","matchCriteriaId":"D1B66DAB-37B1-40E2-B7E1-4BDCEBFA6F88"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sdx81_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"71088DA4-A018-4D69-8D26-CD52639DB015"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sdx81:-:*:*:*:*:*:*:*","matchCriteriaId":"79806BCE-5AE0-4840-AE0F-DED768FCB6AE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm4850_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E7D1CC27-76AE-42A7-98BD-38ED7E63B733"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm4850:-:*:*:*:*:*:*:*","matchCriteriaId":"BD6059A3-2B16-4EE7-B4C5-4376F875A5CC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm4850p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E58014BF-A65B-4DA3-86AB-57FB93B21A4D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm4850p:-:*:*:*:*:*:*:*","matchCriteriaId":"221FC5B4-6059-4F7E-AFDE-7D6A8DB91A4A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8845_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5B47BF35-3AA0-4667-842E-19B0FE30BF3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8845:-:*:*:*:*:*:*:*","matchCriteriaId":"8A071672-9405-4418-9141-35CEADBB65AF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8845h_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB7CF473-8B25-4851-91F2-1BD693CCDC85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8845h:-:*:*:*:*:*:*:*","matchCriteriaId":"91E591F2-8F72-4A5A-9264-2742EB2DABDA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8850_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FA243934-7BFA-47AA-B78C-CCB25377E471"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8850:-:*:*:*:*:*:*:*","matchCriteriaId":"2FD65035-4D20-48D5-874E-47CD9C7A985C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8850w_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22707187-A56D-48AD-800F-A438FD844546"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8850w:-:*:*:*:*:*:*:*","matchCriteriaId":"F526A54A-F974-4D0A-A1A6-FABBB6711CD0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8855c_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"671E0B82-5D58-4644-8806-7F4CAFFB6641"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8855c:-:*:*:*:*:*:*:*","matchCriteriaId":"CC066321-B3CC-4E88-BFA9-414B8D095207"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:x1e80100_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42F453E4-02CC-4E48-A25B-F1394069F524"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:x1e80100:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6671AE-3490-4D85-A20C-3DA26F7D7AEB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:xrv7209_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CC6C6243-E092-4903-BC20-E3B0CECBC790"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:xrv7209:-:*:*:*:*:*:*:*","matchCriteriaId":"AAA33761-D61C-4A81-B233-5E2D50F3596F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq2390s_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B0928CC-C507-4437-946B-B2AD400E9B3E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq2390s:-:*:*:*:*:*:*:*","matchCriteriaId":"E6FAF059-0D17-40DD-B0DA-A708081F6062"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq7790_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9FEBA60-92CC-4660-B410-74A9D0AEB7B9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq7790:-:*:*:*:*:*:*:*","matchCriteriaId":"25B3F423-6AF3-472A-A178-21776C708A88"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq7790m_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1FE23E54-0845-43ED-ADFD-B36A039503A6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq7790m:-:*:*:*:*:*:*:*","matchCriteriaId":"88BAAE9C-4B48-4CEF-BBC9-42A21DF1ABB2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq8725s_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C6143A36-BA18-432C-A6BB-2F33B1509C44"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq8725s:-:*:*:*:*:*:*:*","matchCriteriaId":"09EE5F30-46A6-423B-94AF-E7F4DAB532CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq8750m_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23301B23-E3B8-4FFA-BC7A-33FDDEEDC425"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq8750m:-:*:*:*:*:*:*:*","matchCriteriaId":"F05B2437-B6C0-41C4-818E-12AFE616D790"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq8845s_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4FB1D261-4C1B-4D43-B8ED-975E526A2FF5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq8845s:-:*:*:*:*:*:*:*","matchCriteriaId":"54AC5C16-88A9-4C16-B7AF-835E53D7DFA4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq8850ns_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"867A0C11-FBA0-46F1-871F-1800A7A75BB3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq8850ns:-:*:*:*:*:*:*:*","matchCriteriaId":"9885533F-4021-429D-917F-0A2733725B43"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:csra6620_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FA42F2EA-5D00-42B8-B020-C27675B72915"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:csra6620:-:*:*:*:*:*:*:*","matchCriteriaId":"BFCF207D-B8C8-4860-89C7-673C821F0237"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:csra6640_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A8A35ECF-B12E-42DE-A74B-2C3BE03639A4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:csra6640:-:*:*:*:*:*:*:*","matchCriteriaId":"65B283D6-B2D2-49B6-98A8-08EDB54C1F15"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6200_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CDE1CBDE-3D28-463C-B215-AA7DF373EF09"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6200:-:*:*:*:*:*:*:*","matchCriteriaId":"66BD3B88-7CF9-482D-A2DD-67F6ACF4CC57"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6700_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"82B82E87-F3F4-466F-A76B-C8809121FF6F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6700:-:*:*:*:*:*:*:*","matchCriteriaId":"419A132E-E42C-4395-B74B-788A39DF1D13"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6800_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D89F035A-2388-48FC-AEBB-8429C6880F4A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6800:-:*:*:*:*:*:*:*","matchCriteriaId":"CA13EF4E-AAE6-45F4-9E41-78310E37CE81"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6900_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E670F500-9B71-4BBE-B5DA-221D35803C89"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6900:-:*:*:*:*:*:*:*","matchCriteriaId":"9ADEB5C5-B79A-4F45-B7D3-75945B38DB6C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_7800_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B3053D68-C5D8-4D47-A4F0-9F3AF2289E1D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_7800:-:*:*:*:*:*:*:*","matchCriteriaId":"638DBC7F-456F-487D-BED2-2214DFF8BEE2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:flight_rb5_5g_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AD36089F-92DF-49EC-9C6F-4300E4903CB2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:flight_rb5_5g_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"D19A754C-6900-4436-916D-F5361E0BC324"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fsm200_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E1D84557-FE28-4226-8688-200BB928E661"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fsm200_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"7A7BCB26-A55B-4652-A42F-BE5800E74FBE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fsm20055_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"873C7C42-9770-410A-A4CA-ABDC16F075A7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fsm20055:-:*:*:*:*:*:*:*","matchCriteriaId":"12F2BB71-754E-4E33-AAF6-A4A8DC075107"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fwa_gen_3_ultra_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AEB6D1A6-2CB2-4425-A5A0-EE9A9434C08C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fwa_gen_3_ultra:-:*:*:*:*:*:*:*","matchCriteriaId":"02675702-6F51-4AF0-A62B-3A1658E45094"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fwa_gen_5_elite_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"04CD5DD2-E4CA-437A-8F33-2F7DA09B685C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fwa_gen_5_elite:-:*:*:*:*:*:*:*","matchCriteriaId":"1821A2C8-671A-4D41-9470-1F2DBB967FE3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:g1_gen_1_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0556CCE6-B61B-4DE7-AD4B-333414280DF8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:g1_gen_1:-:*:*:*:*:*:*:*","matchCriteriaId":"CC734495-D935-40CC-9644-477E921F3EE0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:g2_gen_1_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"924DFF0F-E8B2-4B94-9B98-E0C2D6313C87"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:g2_gen_1:-:*:*:*:*:*:*:*","matchCriteriaId":"2A5E644B-D05F-4241-8E20-4A6DA1A56695"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:g3x_gen_2_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C167BE19-999E-4538-A23E-01F9C287A6C7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:g3x_gen_2:-:*:*:*:*:*:*:*","matchCriteriaId":"1026CB5F-E30A-42DE-8432-74412CC8BA00"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:ipq9048_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C736654C-1E52-4CE7-8B11-0F0028BF8568"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:ipq9048:-:*:*:*:*:*:*:*","matchCriteriaId":"0EED451A-FD6F-4190-9BAE-39BD4030A11A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:ipq9570_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1A6182C0-AAE7-45A9-8ECB-F198B55181AB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:ipq9570:-:*:*:*:*:*:*:*","matchCriteriaId":"61FC3830-8AAF-4836-89C3-2C6355CC0272"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:ipq9574_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0327D8C9-DD6B-4831-BBD4-2EE57A351493"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:ipq9574:-:*:*:*:*:*:*:*","matchCriteriaId":"0C866E83-23ED-495C-AA5A-0B01973674BF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iq10_series_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5E069B27-5E13-4C0D-B5ED-A3422FDF1671"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iq10_series:-:*:*:*:*:*:*:*","matchCriteriaId":"07A4FC28-D982-4A92-9E2E-A6EF2CA6578B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iq-615_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D2B2D5D-0213-4979-ACBF-BEF843166047"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iq-615:-:*:*:*:*:*:*:*","matchCriteriaId":"CE575B0C-DDE4-4E5A-9FE8-03305C804558"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iq-8275_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"253BF0D2-D24D-4EE3-A157-9853BBB368F2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iq-8275:-:*:*:*:*:*:*:*","matchCriteriaId":"78C6B840-62E9-4DDD-9376-2F7A8FB9D589"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iq-9075_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"08431A88-C176-48BB-918C-DF3FEABE78D4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iq-9075:-:*:*:*:*:*:*:*","matchCriteriaId":"3C50A35E-023A-404D-BFBC-FFCD1F30E872"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iqx5121_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"499A2520-436C-4B12-849D-98B94088CCDE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iqx5121:-:*:*:*:*:*:*:*","matchCriteriaId":"4C34A825-C928-4F8F-B076-19F8787A3440"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iqx7181_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F58C10B5-2BB1-4A8F-AF4B-2EC791C9FBBE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iqx7181:-:*:*:*:*:*:*:*","matchCriteriaId":"9EE22328-BBF8-473C-8F89-58AEF8CC9D75"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:kalpeni_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5A2D4C45-005F-4A02-BFD7-84893FF1A0E8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:kalpeni:-:*:*:*:*:*:*:*","matchCriteriaId":"B3178A79-485F-40DB-A71D-B29BD3875A7D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:kobuk_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"91D75BEA-6B49-4F12-98DF-50DB4244D26F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:kobuk:-:*:*:*:*:*:*:*","matchCriteriaId":"BA886E96-9ED5-412F-BCD6-60EC3DB04E60"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:lemans_au_lgit_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5767FE95-737F-4C20-A5AB-EC641A68D906"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:lemans_au_lgit:-:*:*:*:*:*:*:*","matchCriteriaId":"33323A49-9267-421B-96E1-80C5FA709EBC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:lemansau_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2DF0ED3F-C98B-458E-ADCC-C922402BB185"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:lemansau:-:*:*:*:*:*:*:*","matchCriteriaId":"102A4B5E-1739-4C31-A626-ABF6B02FEE29"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:marina_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3713FF4B-1938-4370-A5DB-F6385B1FEC69"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:marina:-:*:*:*:*:*:*:*","matchCriteriaId":"7F6E1693-366B-4BAE-AA84-AC08CE2442FA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:mbm415_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"06917C11-6ABA-4972-A4A5-AEA69A5E73FE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:mbm415:-:*:*:*:*:*:*:*","matchCriteriaId":"9B1C6B87-2B59-4220-BC0D-7CE30F514728"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:mbm715_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F9E2ED64-0268-4C88-9553-D6EF646C3BA1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:mbm715:-:*:*:*:*:*:*:*","matchCriteriaId":"861D5B95-47E1-4374-9EF6-157516FF5171"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:milos_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22EFC07D-16C3-4CCC-A928-EA5EA69CAB65"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:milos:-:*:*:*:*:*:*:*","matchCriteriaId":"0D3491C1-A427-4CEC-B8BD-6A1930E6827F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:milos_iot_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"18471E2B-412C-4D07-9997-C8663902D7B5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:milos_iot:-:*:*:*:*:*:*:*","matchCriteriaId":"0284E269-A212-4474-AE46-255D5245096F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm4875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E21AC0DB-36FF-4B36-9CA9-809949B0CA53"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm4875:-:*:*:*:*:*:*:*","matchCriteriaId":"471434D6-35A1-4F4E-85C5-0180383BD315"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6225p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8D2B7D93-4218-4FFF-B1C0-F50EC0B2B934"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6225p:-:*:*:*:*:*:*:*","matchCriteriaId":"00D9DCE1-B3CD-4F45-97DD-637AA27572DD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6450p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEE752CE-2121-477E-A1C9-6A05DF36DFA9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6450p:-:*:*:*:*:*:*:*","matchCriteriaId":"DCA019DB-C24E-4C2B-B4E4-95F61E038FEA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6475p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E32FAA6A-E882-4978-B748-5617BE33F347"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6475p:-:*:*:*:*:*:*:*","matchCriteriaId":"FFFCBBD0-3F52-446F-9A6B-2D138463AB80"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6475q_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03B375DA-4A46-4BC6-B873-99538D53DFBD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6475q:-:*:*:*:*:*:*:*","matchCriteriaId":"ACEA2D75-14DB-4F87-8F3C-A6E9436ECA97"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6650p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"09020F3F-C869-42DF-BD9C-E78056CC8123"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6650p:-:*:*:*:*:*:*:*","matchCriteriaId":"E8272228-2D68-45F2-A670-B5D6E90D9C14"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6850_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DE09FF94-7751-4EED-B269-C7BB056CA90C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6850:-:*:*:*:*:*:*:*","matchCriteriaId":"02B1463D-EE74-42DC-95D5-D0F66260CB32"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7325p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4BEC725F-19B1-4078-B13D-CE624BE23344"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7325p:-:*:*:*:*:*:*:*","matchCriteriaId":"4EA43E38-A12D-49C3-B05C-A2AF07ED2710"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7435_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F7A95A9E-617A-4D3A-9A4E-0C0A29B3C8B5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7435:-:*:*:*:*:*:*:*","matchCriteriaId":"3559292E-B5A6-4F88-BC20-F6AA85F07C97"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7435p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"55C65D26-71D7-4840-B8B1-7C5EC69EB320"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7435p:-:*:*:*:*:*:*:*","matchCriteriaId":"B322FB35-2415-45EA-A350-746AFF734ACD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7525_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2410FF59-E0C0-4920-9656-C398DB06DEAE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7525:-:*:*:*:*:*:*:*","matchCriteriaId":"7D2B800C-4DBC-4028-875D-667C87D75247"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7550_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EEA5CE41-0596-4D38-9891-D1DF711EA7E9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7550:-:*:*:*:*:*:*:*","matchCriteriaId":"E1A901C6-FB73-4361-B391-4A4AF8C70029"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7550p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5C5D7E2C-0955-4B6E-96E4-CFA06D937492"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7550p:-:*:*:*:*:*:*:*","matchCriteriaId":"9D1D0F33-AD5A-4826-9A06-EAD2A8709974"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7635p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3A72DAA5-E10F-40A0-A8CC-541594A3279F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7635p:-:*:*:*:*:*:*:*","matchCriteriaId":"15CC657A-7623-4F37-AC52-8AF5C83D5BDA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7675_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"012C20A8-3F48-48DD-9A77-65C9CB1F6C30"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7675:-:*:*:*:*:*:*:*","matchCriteriaId":"EE992A86-36BC-40E3-8E96-6542560BE8EC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7675p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3B46F132-4049-40D0-8351-C1C6FD2B47A0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7675p:-:*:*:*:*:*:*:*","matchCriteriaId":"1846514C-1F95-4568-98DE-C57214401841"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7750p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B8A511E-B43B-4617-A3B3-03F4EE80CA1D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7750p:-:*:*:*:*:*:*:*","matchCriteriaId":"BAE215A4-3860-45B1-BDFC-B614692F7905"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8475p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8DBF6AE8-605B-4E72-BD3B-0B6C390FCE32"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8475p:-:*:*:*:*:*:*:*","matchCriteriaId":"26AAE148-96B6-4FDE-BABD-48F607464A38"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8550p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C4CDD6A2-5A3C-4572-8CE1-2F102333BB79"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8550p:-:*:*:*:*:*:*:*","matchCriteriaId":"699E5D17-6144-4F0A-8D52-1E8C83990E52"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8635_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"65865EE9-59C0-498F-A4C5-EC00D4642603"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8635:-:*:*:*:*:*:*:*","matchCriteriaId":"CE02AB51-6FB6-4727-999B-A7466CEDC534"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8635p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"88F63D90-4BFC-4EFA-8B74-7A5027A7052D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8635p:-:*:*:*:*:*:*:*","matchCriteriaId":"20EB529B-6B9F-464F-A98B-A8ABE0F01ADB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8650q_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1CAA8D9D-0238-4223-8F7B-134ECBB6FA05"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8650q:-:*:*:*:*:*:*:*","matchCriteriaId":"D8A722B8-E1E4-43B4-8882-591CE8C5C166"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8735p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B24D04FB-6823-452C-8F0D-0088E9B402EC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8735p:-:*:*:*:*:*:*:*","matchCriteriaId":"B9CCD62E-F9D1-4CF9-9595-3BF28DED89AC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8750p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4D8ABDBF-BABC-4219-8A18-BDFC8C826B1F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8750p:-:*:*:*:*:*:*:*","matchCriteriaId":"685D81D0-7E95-4DBA-A05B-7C708A5DFDF0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8845p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A205320E-6C60-4F6A-90D5-06CABAF0FDEA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8845p:-:*:*:*:*:*:*:*","matchCriteriaId":"0FB8CE86-605E-4B3D-82E5-A55093ABCE5F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:smart_audio_400_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"57B0086F-5F2C-4F89-AC53-D8429D6506CD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:smart_audio_400_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"FB8145C8-D978-4047-9203-602E854E7290"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_4_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2CCBF666-CB4E-44E1-9676-6891EDC73578"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_4_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"C767AB6A-1A8C-406C-A600-96A816F44E2F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_4_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"55AECCCF-0761-46B6-B669-E73096679AFB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_4_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"7DE87CA2-160A-43BF-AC18-DA788501B5B4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_460_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"390D7CAF-6C0B-4438-AA7D-AEEE127F4D3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_460_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"5BB1FC5E-CF6F-4E54-B78D-C01AFD034903"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_480_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA3F11F3-C9F4-460D-BD77-1BFBCC1F0592"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_480_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"25673A10-D99C-4F67-BDA7-9C2E4A70EF9C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_480\\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"50906EF2-01F7-4E97-9F49-F892DF41CB29"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_480\\+_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"B23A89FF-9C94-40C6-B9B7-3E8354777916"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_6_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EBB3BC1B-2EBC-457C-AE91-6BD408EB7D5F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_6_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"0870CC30-07F8-4FFF-85B4-FBACE947CC14"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_6_gen_3_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D69E4203-EA20-4D6F-BD1C-C8E550588F87"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_6_gen_3_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"C1225010-5A08-4D13-A3E2-4C57C4265605"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_6_gen_4_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"20ABA235-1380-4D76-A248-36A6E905AEB2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_6_gen_4_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"923775B3-1916-4E60-A888-574AB3F3E282"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_680_4g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8D0ED00F-1345-43AD-83C6-E979890B84AB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_680_4g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"92C28019-B57D-4487-B551-F7B53395C6E5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_685_4g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C174F07D-0E33-43FD-9BAD-6C6D8B51B6A6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_685_4g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"47311B68-A07F-448B-99D5-9C92C8127A81"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_690_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A930E317-7F22-4605-A85F-144921EEBA0C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_690_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"BAF50FDA-47FA-491B-BEAE-76CC38C18F52"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_695_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A9A2DA11-5E4E-4E36-923C-A2D3CC2F2751"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_695_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"BE7DFAD4-1D21-4A3A-9E8C-10F00AD7C403"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"677D5A3F-2A0D-48F0-A1C5-B067BADFD11A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"CB79B015-A401-4FAD-8818-1475653C2B12"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7_gen_4_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"48BB1413-6719-4026-9154-0AF3BA32C26B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7_gen_4_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"97851334-202F-4695-A4B2-6D0B221D6E23"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:monaco_iot_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D071BA3E-36AE-40E5-88FB-04012ABECBD2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:monaco_iot:-:*:*:*:*:*:*:*","matchCriteriaId":"F9FB6B54-7F16-497D-B211-327744F35ECB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:netrani_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9C52A53B-1182-47F3-9800-D8C58F954277"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:netrani:-:*:*:*:*:*:*:*","matchCriteriaId":"BEC1F084-78C8-4413-940A-47E9554CB6D0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:npro_a8_elite_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0A0EBD90-9CE5-4F3A-A204-57C5BDE19091"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:npro_a8_elite_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"C5FECE35-A77B-4FD4-890C-2A230B5A93A6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:orne_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"19FB8345-BBFC-4E18-A4E6-64A159D7F65B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:orne:-:*:*:*:*:*:*:*","matchCriteriaId":"FFDA4056-3F1B-4F3A-BE59-1908BD3DE5E9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:palawan25_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C18C3535-3074-41DE-B40F-F3055BAFF686"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:palawan25:-:*:*:*:*:*:*:*","matchCriteriaId":"7B590B1E-06D1-4C99-BDDF-4A086BEBB4C7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:pandeiro_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F8EF0C-BB48-47E1-A045-254D79388F75"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:pandeiro:-:*:*:*:*:*:*:*","matchCriteriaId":"058950FC-ED72-4E91-AE13-87E738ADC083"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:q-4390_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F534D99F-9B90-457A-B2EE-8E2E05ECC9A2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:q-4390:-:*:*:*:*:*:*:*","matchCriteriaId":"3733BE8F-DF77-49E9-866F-B426194148B3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:q-7790_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3FF5B1C3-B3D9-4ADF-B31E-CDB65DE83EB1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:q-7790:-:*:*:*:*:*:*:*","matchCriteriaId":"67FD545B-CF5E-46F4-A955-4A66DFABBFEC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qam8255p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3723C7B1-A7E2-401F-8D6D-189350F6BCA5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qam8255p:-:*:*:*:*:*:*:*","matchCriteriaId":"B12B89EF-7B12-481E-BCBC-F12B9D16321A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qam8295p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C2D9E281-B382-41AC-84CB-5B1063E5AC51"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qam8295p:-:*:*:*:*:*:*:*","matchCriteriaId":"44EBEBD5-98C3-493B-A108-FD4DE6FFBE97"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qam8620p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DBAC2260-52E3-49DE-97EA-F80DBD837FD3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qam8620p:-:*:*:*:*:*:*:*","matchCriteriaId":"17599B8D-5753-4408-B4CD-AAA65C826922"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qamsrv1h_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F8673334-5E11-4E95-B33D-3029499F71DF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qamsrv1h:-:*:*:*:*:*:*:*","matchCriteriaId":"EC0B32F6-5EF0-4591-99D7-D0E9B09DEC5A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qamsrv1m_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CE03AB2A-3ED9-4489-8E5B-4FCF8BAA8559"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qamsrv1m:-:*:*:*:*:*:*:*","matchCriteriaId":"9E646738-6A87-4470-9640-6A5A1DF3AF78"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca0000_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CC941093-1A7C-47B2-AB3B-05AE4AE2FBE4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca0000:-:*:*:*:*:*:*:*","matchCriteriaId":"7A2AA834-C17C-4E0E-A510-795818041E47"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6174a_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4FF653D0-15CF-4A10-8D8E-BE56F4DAB890"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6174a:-:*:*:*:*:*:*:*","matchCriteriaId":"C31FA74C-6659-4457-BC32-257624F43C66"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6391_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"83B53119-1B2F-4978-B7F5-33B84BE73B68"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6391:-:*:*:*:*:*:*:*","matchCriteriaId":"6FEBC0C5-CAA1-475C-96C2-B8D24B2E4536"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6564au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B59672A0-2FA6-46CC-B75A-C599B842AFB9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6564au:-:*:*:*:*:*:*:*","matchCriteriaId":"3847F4A5-90A5-4C84-B43F-0DDD81BD79CE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6574a_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"828CFB37-76A6-4927-9D00-AF9A1C432DD6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6574a:-:*:*:*:*:*:*:*","matchCriteriaId":"11405993-5903-4716-B452-370281034B42"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6574au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D527E2B1-2A46-4FBA-9F7A-F5543677C8FB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6574au:-:*:*:*:*:*:*:*","matchCriteriaId":"8374DDB3-D484-4141-AE0C-42333D2721F6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6584au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C3DDA896-576C-44B8-85B6-F71F473F776B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6584au:-:*:*:*:*:*:*:*","matchCriteriaId":"51A87BDA-5B24-4212-BAB3-D2BBB2F4162E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6595_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"643EC76D-2836-48E6-81DA-78C4883C33CA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6595:-:*:*:*:*:*:*:*","matchCriteriaId":"477F6529-4CE1-44FC-B6EE-D24D44C71AE7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6595au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"288F637F-22F8-47CF-B67F-C798A730A1BD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6595au:-:*:*:*:*:*:*:*","matchCriteriaId":"D0996EA3-1C92-4933-BE34-9CF625E59FE7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6678aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D001127D-8160-42F0-B8B9-2FAA2976B530"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6678aq:-:*:*:*:*:*:*:*","matchCriteriaId":"C9EB615F-FD4C-450B-AB25-E936FD9816C4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6688aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AFBD264F-F24A-4CDD-B316-9514A61B91E7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6688aq:-:*:*:*:*:*:*:*","matchCriteriaId":"94CC5BC4-011D-4D2B-8891-97FBF61FD783"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6696_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0AE207DB-9770-40ED-961D-FDA75965826F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6696:-:*:*:*:*:*:*:*","matchCriteriaId":"0E23922D-C37F-476F-A623-4C1458A9156F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6698aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5FA1F8F4-EAF2-4704-A8A6-19AD3CA1B577"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6698aq:-:*:*:*:*:*:*:*","matchCriteriaId":"B3F7853D-09EE-476F-B48D-BB30AEB4A67D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6698au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3ACA09C0-84A5-493A-A9BD-EF95A8330D54"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6698au:-:*:*:*:*:*:*:*","matchCriteriaId":"3A2397BD-431C-4730-92E3-17A5C2445A65"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6797aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"797295C2-535C-46A9-A725-E1A5405F0436"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6797aq:-:*:*:*:*:*:*:*","matchCriteriaId":"8BFC575E-594E-4711-94B1-2DC8D03B9AC4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca8075_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CC8A5A87-7D62-4EB7-962A-0F160DE3E889"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca8075:-:*:*:*:*:*:*:*","matchCriteriaId":"7B68D126-7F49-4FFA-8AF8-78120973D78E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca8080_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FC553591-A429-48B6-B378-CDF0A2173EA2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca8080:-:*:*:*:*:*:*:*","matchCriteriaId":"3A0E183F-C9E7-4B6A-8470-44BA77DA4E2E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca8081_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1D1C53DC-D2F3-4C92-9725-9A85340AF026"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca8081:-:*:*:*:*:*:*:*","matchCriteriaId":"ED0585FF-E390-46E8-8701-70964A4057BB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca8082_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EB1F2E8B-1ED2-473D-AFD8-F2590F6BD414"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca8082:-:*:*:*:*:*:*:*","matchCriteriaId":"FBDA9657-7D30-41FD-8112-F53E6C69D53A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca8084_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1B9045A8-BA53-43C4-B24D-5EF320DE7A4A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca8084:-:*:*:*:*:*:*:*","matchCriteriaId":"3D6E8939-AFA3-41AC-B811-BCC282A43106"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca8085_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B87335A8-DC52-478E-B19F-0C4CC63132EA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca8085:-:*:*:*:*:*:*:*","matchCriteriaId":"99C34523-FE2A-4DDC-9A8A-D9072F3D0FD3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca8101_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1A7F8D18-C53F-4C0E-AC2E-4FE6B7F9D4D0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca8101:-:*:*:*:*:*:*:*","matchCriteriaId":"6C2EE327-06BA-41AF-807B-A16875CE5BD5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca8102_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BDB37850-3613-4F72-B559-3BD8CA59A1A1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca8102:-:*:*:*:*:*:*:*","matchCriteriaId":"F482A96D-3BB1-4FFC-8F26-0E6E9AA4F4D4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca8111_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"15A9FAB1-9A90-4CE4-A00F-04703659BB4A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca8111:-:*:*:*:*:*:*:*","matchCriteriaId":"09ADD6B3-8876-469A-83D1-0DF12756D6EE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca8112_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8C25D65C-0F25-49EE-8CD6-16472D081509"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca8112:-:*:*:*:*:*:*:*","matchCriteriaId":"7275DCA9-8429-4C1E-9911-298743E67326"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca8337_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2FA8F9DA-1386-4961-B9B2-484E4347852A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca8337:-:*:*:*:*:*:*:*","matchCriteriaId":"117289C8-7484-4EAE-8F35-A25768F00EED"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca8384_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFE75D55-09F1-4980-AEE7-E4BF80DE8C9B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca8384:-:*:*:*:*:*:*:*","matchCriteriaId":"B62AF79F-88EA-421C-89AE-4F3A8DA563D8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7\\+_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C8E41CBD-D6AD-41CF-A469-92A7E228BBB6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7\\+_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"57E0BA08-3BF4-4E84-BBA9-B48F84197F9D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_778g_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"87ECCB82-B880-412D-A635-CA6F0B035F2B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_778g_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"424743C4-CE74-4A02-835A-023C9DA0CFAC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_778g\\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14EA48BF-BD65-43B2-8DC1-D97F75AD6FE5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_778g\\+_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"B86E317F-12BF-42F6-879B-88A85F7E3F81"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_782g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"194A4BD4-0DDF-49E5-AA89-40A5BFB71933"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_782g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"72FF9732-40D8-4C12-8259-BAA16FAB5A56"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7c\\+_gen_3_compute_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C4A050CA-8514-400A-A6B3-F513CC93CA14"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7c\\+_gen_3_compute:-:*:*:*:*:*:*:*","matchCriteriaId":"BD850305-1E76-4952-A3FB-F6229CBF7FE9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7s_gen_3_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BBD338C6-F731-4B5D-9DE1-32259A23FBC2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7s_gen_3_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"3AB83DA5-30ED-44E8-8517-1988B2D1EC6B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_elite_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EA50192-07B0-4404-93D4-EC4F3B1918B7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_elite:-:*:*:*:*:*:*:*","matchCriteriaId":"26C7FC48-08CB-4E50-B8D3-8AF30549FDF8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_elite_gen_5_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"41070BDB-15E4-4DD7-A132-A14AA24978E5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_elite_gen_5:-:*:*:*:*:*:*:*","matchCriteriaId":"102460A6-9637-4883-9230-2CC888D5D74E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EB8FA32F-4690-4C5B-8968-474DA32FD0A4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"59BD8BEA-725A-4158-84BE-4AFD476ED03D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"60F5899C-BA8D-4B6B-BC61-F77B1EB64739"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"D39AD7CE-A017-4D74-A348-9E4B08363799"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen_3_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0FAB6D60-1C03-4F85-B874-FF169402ED09"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen_3_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"C89A8D93-46DA-4547-A9F1-076FC0D5119D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen_5_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4D8D8AD-B291-4AEC-8817-D7C99E79FF49"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen_5:-:*:*:*:*:*:*:*","matchCriteriaId":"8CA08EA8-A47E-4797-8644-0A48D509939C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8\\+_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"59CB6F2F-7C95-498B-9F9E-728930FD24A7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8\\+_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"284E62AF-2E4D-4E82-AC9A-F27DA71735EF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8\\+_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1FEDF458-DEA7-42A1-A56D-E11250139545"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8\\+_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"D5693438-0F20-47BB-BA32-7175C3152368"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_865\\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22303AD4-779C-45A3-8F33-3864C45E4328"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_865\\+_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"B8EC440D-D420-4477-8F14-427245B80631"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_870_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"41446A77-6EF3-4570-BAD2-4C761A2C4E7F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_870_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"448C401B-EF07-4385-A7B4-123D7808F64F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_888_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22A78236-5965-4F65-9001-3FE7FF6D27E8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_888_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"414C5C1D-A5DA-47C7-B6C9-3564DD4DD911"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_888\\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"01CBD543-635C-4C57-87B7-55DD3BA3C1A2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_888\\+_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"6A7272B6-AADB-4CCD-B041-66170C313C76"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8cx_gen_3_compute_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7C155F86-467F-4B57-950E-12FAAB570B01"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8cx_gen_3_compute_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"71E06B94-9463-49A6-B816-E8A82BEA8545"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_ar1_gen_1_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"53E5BBDA-C07D-42E2-9A34-EC1F6454CAA4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_ar1_gen_1_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"0BB2408F-C768-4DD2-B834-B62E188D6CC2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_ar1\\+_gen_1_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BE30A5E0-10D5-4679-ACA6-4ED991335A6F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_ar1\\+_gen_1_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"CFA75B74-D20D-4C8B-BFA2-5DE4848410CD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_auto_5g_modem-rf_gen_2_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EE5FCA7F-1FBE-42AA-B4E6-09CEA02A33EC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_auto_5g_modem-rf_gen_2:-:*:*:*:*:*:*:*","matchCriteriaId":"E2D789BC-43F5-40FB-A191-163C01BA5FBE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_c_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"65BA9558-E6F4-451C-9393-1D2381AF1840"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_c_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"F2479E36-1020-4EB1-87E3-679987F5040C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_ride_elite_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4E50C2D-229B-4B78-8567-CD603DE2A767"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_ride_elite:-:*:*:*:*:*:*:*","matchCriteriaId":"6C5ECF68-EB2E-46B5-AEC3-0744D4C9215A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_w5\\+_gen_1_wearable_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0C455E7D-D256-4240-BE72-2A93273D685A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_w5\\+_gen_1_wearable_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"423E21A1-8F52-46DA-9AC2-77159FEB6001"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_x2_elite_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7FEA3409-34AF-4FFB-AB58-ABE600FBA9FC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_x2_elite:-:*:*:*:*:*:*:*","matchCriteriaId":"025C1550-D3DC-434A-91E4-EBFE004F3628"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_x32_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A934F06D-71C4-4647-B321-2B86BDA9E586"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_x32_5g_modem-rf_system:-:*:*:*:*:*:*:*","matchCriteriaId":"183FE432-3E53-403B-A96B-AF9E7C3215F6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_x35_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C3358AEB-CD49-4FF9-9410-7EDF0AAABB82"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_x35_5g_modem-rf_system:-:*:*:*:*:*:*:*","matchCriteriaId":"9ED45581-33EE-4D4C-B078-9D7DB6F2386A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_x53_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4F80E77B-B207-4E49-99EF-A1F9ECFAAC99"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_x53_5g_modem-rf_system:-:*:*:*:*:*:*:*","matchCriteriaId":"9A12A6DC-63A2-4B52-971A-C014E40C1E6D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_x55_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AAFF2095-4257-40C9-8C48-B38C143159ED"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_x55_5g_modem-rf_system:-:*:*:*:*:*:*:*","matchCriteriaId":"7FEA2F1D-7D07-4684-BDC1-24224A53A8BC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_x62_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FEA4DE65-C5F1-45F6-9D79-CF80196471B6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_x62_5g_modem-rf_system:-:*:*:*:*:*:*:*","matchCriteriaId":"1F27FE86-F0E3-4EBD-933F-9B0210CBD72F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_x65_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F74BF53E-DFA1-4750-A638-FE7572B79D16"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_x65_5g_modem-rf_system:-:*:*:*:*:*:*:*","matchCriteriaId":"226D1ABD-E4AD-487E-88EB-4C66D51DB33D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_x70_modem-rf_system_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EAD88351-1DA2-4CE5-BCEB-3C64BD16468A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_x70_modem-rf_system:-:*:*:*:*:*:*:*","matchCriteriaId":"03149AA1-8048-4675-8C6F-18FD32E54064"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_x72_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"205BF723-DBED-4EAE-8B5C-0E01B01E1544"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_x72_5g_modem-rf_system:-:*:*:*:*:*:*:*","matchCriteriaId":"9A36A7B8-CF35-4003-AC3E-C5D25288B1A1"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_x75_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"95A98B39-067F-4047-9ADB-7C53F18CBB7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_x75_5g_modem-rf_system:-:*:*:*:*:*:*:*","matchCriteriaId":"1C462F32-0E70-472A-A42D-CD0229A97E94"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_x80_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6E96F1C6-6A40-4B5F-BD3B-605E00344731"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_x80_5g_modem-rf_system:-:*:*:*:*:*:*:*","matchCriteriaId":"97D20AFE-A979-4453-B233-BD3D005420AC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_xr2_5g_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1A129620-8241-4A47-AAC8-CC7E10A09C9C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_xr2_5g_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"4CEDD78E-124C-4216-9B57-3B7B53463659"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_xr2\\+_gen_1_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BF9740EB-F82E-42EA-993E-A393B05CC6BB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_xr2\\+_gen_1_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"022A5532-03F7-4FB8-BA0D-4221178C9486"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_cockpit_elite_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D4E05762-315D-46A9-93DB-435DB78FEE71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_cockpit_elite:-:*:*:*:*:*:*:*","matchCriteriaId":"5028FDF9-6852-4C88-97D8-CE6392960A55"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_reality_elite_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"08ACBE23-DBE3-4AE0-B9EA-F3A73290D5F0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_reality_elite_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"3F82A885-4CAB-44F2-85FA-3D581283A936"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca8385_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"840E8FE5-5496-4C36-A6DD-5A1AA42FD039"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca8385:-:*:*:*:*:*:*:*","matchCriteriaId":"1C60AC74-A676-4BA9-8709-B834241B0D78"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca8386_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"08E9E6CB-2216-4AF2-81C2-D482598298BE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca8386:-:*:*:*:*:*:*:*","matchCriteriaId":"4774FAA6-6141-4B08-819C-58D4D9A2B69F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca8695au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"55A21DB0-4722-4421-8E97-B0E31B93E53B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca8695au:-:*:*:*:*:*:*:*","matchCriteriaId":"797B8944-61F0-4522-97FE-3C172369F477"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcc2070_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E2E06F54-34ED-4907-962B-49A847936F12"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcc2070:-:*:*:*:*:*:*:*","matchCriteriaId":"09102ED0-405E-431F-A12C-8980F60B946F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcc6705_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E791EB5B-D1D5-467E-8BF5-CECEFEB36E80"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcc6705:-:*:*:*:*:*:*:*","matchCriteriaId":"3F325C66-28EF-4708-A12D-60975912F646"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcc710_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2A75D017-032F-4369-917C-567EE2A809F2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcc710:-:*:*:*:*:*:*:*","matchCriteriaId":"107F0423-608C-404D-B58B-616A6494418F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcf8001_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"287199B4-9CBB-4290-BDB3-ABBB41794259"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcf8001:-:*:*:*:*:*:*:*","matchCriteriaId":"142DC510-DD92-4174-8B37-4D239573661E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm2290_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5AB1F0FA-25F3-4304-A3BC-5264E55CC092"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm2290:-:*:*:*:*:*:*:*","matchCriteriaId":"214A053F-D80C-4AD9-B4F1-83384095A3F3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm4290_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3C7FFB96-53E7-41A2-BC99-7ACD853214A8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm4290:-:*:*:*:*:*:*:*","matchCriteriaId":"74EBA77E-69A5-4145-9BEC-CD39BA132309"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm4325_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F2D8044B-D4E5-4174-A0FB-478F8434EE8F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm4325:-:*:*:*:*:*:*:*","matchCriteriaId":"163FE96E-DF5B-4B67-8EDE-44A5B9A8492D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm4490_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DA506489-4338-44DF-8F92-12E60AF0048C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm4490:-:*:*:*:*:*:*:*","matchCriteriaId":"A8718C37-A82A-4A08-A887-3F22B37601A9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm5430_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4EC5F81B-AA24-4E3C-9FC8-53E010AC977E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm5430:-:*:*:*:*:*:*:*","matchCriteriaId":"B5C66DAD-0D85-46B8-92D7-6D68B9429E9A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm6490_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"ADD6D51E-5787-42A6-8A02-4EBBAFFF9C94"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm6490:-:*:*:*:*:*:*:*","matchCriteriaId":"99AA0291-B822-4CAD-BA17-81B632FC3FEF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm8838_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7C6535AE-8680-4AB9-ABF6-82DAE1795531"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm8838:-:*:*:*:*:*:*:*","matchCriteriaId":"9C3FEACB-1AE1-4BF2-9552-C31A32DCCA9B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcn5124_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2A9F76FF-96D3-4BCE-918D-B3B0ADA3E8E0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcn5124:-:*:*:*:*:*:*:*","matchCriteriaId":"2908A543-EFE4-477D-9CF3-76534B2E6CF6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcn5224_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9242D662-65B5-4EE4-85F7-AB4864962A9E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcn5224:-:*:*:*:*:*:*:*","matchCriteriaId":"F15FC87F-8E22-433E-A1EB-46982FFCD033"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcn6024_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A49DBE04-E2EA-4DA1-B774-A878A71524AC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcn6024:-:*:*:*:*:*:*:*","matchCriteriaId":"69E98386-3BB2-4E8C-AD00-E05123608439"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcn6224_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5F4362D2-30A3-4388-ABB6-293878AD7036"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcn6224:-:*:*:*:*:*:*:*","matchCriteriaId":"BB6AE9A7-386A-473B-9BD5-DA37B1E696C5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcn6274_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"88376C1D-AC4D-4EB0-AF6A-274D020F5859"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcn6274:-:*:*:*:*:*:*:*","matchCriteriaId":"E15BA4B4-C97F-45C0-A4AD-7E46387F19A6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcn9011_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9306C34D-47E4-40CF-89F4-BA5263655D13"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcn9011:-:*:*:*:*:*:*:*","matchCriteriaId":"02BA009F-24E1-4953-BA95-2A5BC1CDBDBB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcn9012_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"61F34DD2-9DC0-49E5-BC85-1543EA199477"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcn9012:-:*:*:*:*:*:*:*","matchCriteriaId":"1A06879F-6FE9-448A-8186-8347D76F872B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcn9024_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A64CDA49-19BF-413F-A0E0-2B9729E45E25"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcn9024:-:*:*:*:*:*:*:*","matchCriteriaId":"345CCD64-C09E-407D-AAA2-311C4CCFE24F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcn9274_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9129A244-AB8C-4AA4-BFBB-37F84D66BD3E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcn9274:-:*:*:*:*:*:*:*","matchCriteriaId":"41F243A1-3C0B-4780-95BF-69A4E1A91F18"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs2290_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"93CDB7BC-89F2-4482-B8E3-9DDBD918C851"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs2290:-:*:*:*:*:*:*:*","matchCriteriaId":"76E03AE9-2485-449B-BCFD-3E452BB01FC6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs4290_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"06789CB9-E6FA-400D-90B6-C2DB6C8EF153"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs4290:-:*:*:*:*:*:*:*","matchCriteriaId":"FFCB9F22-57F2-4327-95B9-B2342A02E45E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs4490_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3336CDD7-9E7B-4FFB-A5CE-594B19B63A6C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs4490:-:*:*:*:*:*:*:*","matchCriteriaId":"1197E229-1E27-4CA3-A386-B77FAE5DFE1A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs6690_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F8AD50C4-E725-48B8-8291-A62EF153D50A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs6690:-:*:*:*:*:*:*:*","matchCriteriaId":"4B5A7BC1-E4B1-486C-A433-D206A42A1356"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs8550_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FFF23DDB-98A0-4343-ADD3-5AB9C2383E7E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs8550:-:*:*:*:*:*:*:*","matchCriteriaId":"5ACB8AFB-5B91-4AA1-BA3A-1AF0B3503080"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qdu1000_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"407EE4D5-1F52-40D6-B85A-E49915D6EF2D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qdu1000:-:*:*:*:*:*:*:*","matchCriteriaId":"5846C9DD-63E5-482D-BE01-3A1E89CC0EDE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qdu1110_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7F5F9F3D-1F57-4D16-972E-AF39E438E4C3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qdu1110:-:*:*:*:*:*:*:*","matchCriteriaId":"53D6BEFE-AA21-4786-B11C-A6683AC06622"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qdu1210_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"32E0EBD5-A846-44F9-9DEC-1C6711C96A5B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qdu1210:-:*:*:*:*:*:*:*","matchCriteriaId":"C68F8102-788C-4EF3-83E4-56DF764DFFBC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qdx1010_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B7AB84B-55D0-45EB-ABA8-F69E5179507E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qdx1010:-:*:*:*:*:*:*:*","matchCriteriaId":"B908A65E-F3B2-417A-91EE-1BE855BABD2E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qdx1011_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6554B2E1-AE96-40CE-A19F-C7516CDBC41A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qdx1011:-:*:*:*:*:*:*:*","matchCriteriaId":"1991232B-B58F-481E-A7EE-0546E64C12CC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qep8111_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEB4913D-940F-49CC-951A-9704CCEE636C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qep8111:-:*:*:*:*:*:*:*","matchCriteriaId":"4E93E1D2-4546-4D60-B53D-20CF09551766"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qfw7114_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7456782E-B6CE-42ED-A51E-39907120E28B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qfw7114:-:*:*:*:*:*:*:*","matchCriteriaId":"637BF4DF-BB40-479F-B696-6AD9D4B35D64"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qfw7124_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D72C4CE0-AB59-4652-854F-94C9998F2712"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qfw7124:-:*:*:*:*:*:*:*","matchCriteriaId":"98720774-11B8-4B4B-BC73-D4DA84E07F78"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qfw7224_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EF48F2E5-5500-411B-9000-3AE3734B5B9A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qfw7224:-:*:*:*:*:*:*:*","matchCriteriaId":"13D8247B-BFB3-4ED9-8982-5E653CAD7A65"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qln1083bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FD70F234-1EE7-4362-97F6-5AEDB7078D03"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qln1083bd:-:*:*:*:*:*:*:*","matchCriteriaId":"C569A848-B70C-42EF-B6D5-4A86547586EE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qln1086bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F218DF06-C40A-4738-ABB5-A3FA2243EF84"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qln1086bd:-:*:*:*:*:*:*:*","matchCriteriaId":"2E2A0CD0-66FA-45D6-BBC7-03641203EC73"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qmp1000_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5298473D-8B34-42E6-BC32-69A3800972B4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qmp1000:-:*:*:*:*:*:*:*","matchCriteriaId":"2A1CF44E-FFC2-4DCB-8DC2-46422D912448"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_wear_elite_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"21C295D3-AC5D-4DFC-A0B1-3B5F7C08DC46"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_wear_elite_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"A32D44E3-02FC-47AA-B6FF-E87F5866E453"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:srv1h_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0CD199F5-DA68-4BEB-AA99-11572DA26B4F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:srv1h:-:*:*:*:*:*:*:*","matchCriteriaId":"8ACA2D4D-FC77-4C1A-8278-1C27B3EA3303"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:srv1l_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B88B3A43-24DD-44EB-AEF1-B7ECAB97C0FB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:srv1l:-:*:*:*:*:*:*:*","matchCriteriaId":"07602885-8BEA-4820-A8F5-41E909718FBA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:srv1m_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4B29E7F-8BFE-466A-B357-63F8A2160C4E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:srv1m:-:*:*:*:*:*:*:*","matchCriteriaId":"6D55CC7D-2E65-4CA9-9892-B6FBCC087E6F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sw-only_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"52433CDD-4776-41C7-96BA-D9EB12934C06"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sw-only:-:*:*:*:*:*:*:*","matchCriteriaId":"A996EBB2-BE81-41AD-8164-21A741FD2793"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sw5100_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AA1BF9BB-AF11-46A7-A71C-F7D289E76E3F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sw5100:-:*:*:*:*:*:*:*","matchCriteriaId":"7B8455D6-287D-4934-8E4D-F4127A9C0449"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sw5100p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DB599A9F-0305-4FE4-8623-0F86630FEDCB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sw5100p:-:*:*:*:*:*:*:*","matchCriteriaId":"EEB883BF-68B2-4C25-84DC-5DA953BFAA2F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sxr2230p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD6444F6-A477-4B4C-8A09-C22C47CCE45B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sxr2230p:-:*:*:*:*:*:*:*","matchCriteriaId":"F3E20681-4FC4-46E2-AF77-BCF03BC8E77E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sxr2250p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"68A93ED1-F509-439E-AE7B-F0EC87AE759F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sxr2250p:-:*:*:*:*:*:*:*","matchCriteriaId":"FB5E2A98-EDD0-4298-911D-EC7527D5A424"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:themisto_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"55DE7B27-56A2-4046-9E03-8215587C8827"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:themisto:-:*:*:*:*:*:*:*","matchCriteriaId":"0853EA22-4EFD-4037-8B83-CB7C18417D23"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:trestles_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E423EDA5-D90A-4A76-8B14-77F16F6857AF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:trestles:-:*:*:*:*:*:*:*","matchCriteriaId":"919D8CE3-A7FF-4F56-AF37-EBFFB5377B7F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9335_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"28717583-463A-468A-8073-ECF0F90585F6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9335:-:*:*:*:*:*:*:*","matchCriteriaId":"4D1A7188-7D5D-4D46-AEAB-08BA84FFF539"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9340_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8BA28CC6-C8BB-4F50-BFE3-A59F664A4F54"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9340:-:*:*:*:*:*:*:*","matchCriteriaId":"94D2BDF1-764C-48BA-8944-3275E8768078"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9370_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1295D869-F4DD-4766-B4AA-3513752F43B4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9370:-:*:*:*:*:*:*:*","matchCriteriaId":"B98784DC-3143-4D38-AD28-DBBDCCAB4272"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9371_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2503805B-B2A6-4AEE-8AB1-2B8A040702BD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9371:-:*:*:*:*:*:*:*","matchCriteriaId":"D3AD370C-2ED0-43CF-83D9-50DC92A01CA5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9375_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"34143ABA-7D09-429F-A65C-3A33438BF62C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9375:-:*:*:*:*:*:*:*","matchCriteriaId":"9D56DFE3-5EF1-4B23-BBD5-0203FBF9CCEC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9378_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4CFDBB5B-0A4F-4032-874F-D2A7EF933FB0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9378:-:*:*:*:*:*:*:*","matchCriteriaId":"D28A12D6-CC60-4BE9-ADEE-FAB58B05440F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9378c_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"95D79E3A-1978-4B23-B60B-2BD47FEDF5C2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9378c:-:*:*:*:*:*:*:*","matchCriteriaId":"91B32C89-3238-4FDF-BB3F-F6BAE829769B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"70292B01-617F-44AD-AF77-1AFC1450523D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9380:-:*:*:*:*:*:*:*","matchCriteriaId":"FA94C6D6-85DB-4031-AAF4-C399019AE16D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"92B17201-8185-47F1-9720-5AB4ECD11B22"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9385:-:*:*:*:*:*:*:*","matchCriteriaId":"E1FA2EB9-416F-4D69-8786-386CC73978AE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9390_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"896F1C04-9957-440F-BF01-C3772CC3B3DF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9390:-:*:*:*:*:*:*:*","matchCriteriaId":"A90555EB-47A7-4717-92D5-35B561825F06"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9395_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"699056F6-1517-4F25-AE07-4FFCF6923B9F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9395:-:*:*:*:*:*:*:*","matchCriteriaId":"E4C023D2-6FF5-4FFC-B9F2-895979166580"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3910_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9F0D7B24-D567-479A-B4F1-595FAA053418"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3910:-:*:*:*:*:*:*:*","matchCriteriaId":"33A8FAA1-F824-4561-9CCC-7F0DF12F740F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3950_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3FEF2DB6-00F5-4B07-953B-EF58B31267F1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3950:-:*:*:*:*:*:*:*","matchCriteriaId":"120E8F0F-EBEB-4565-9927-2D473F783EF7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3980_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9C6E9038-9B18-4958-BE1E-215901C9B4B2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3980:-:*:*:*:*:*:*:*","matchCriteriaId":"B36D3274-F8D0-49C5-A6D5-95F5DC6D1950"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4BFB25F-013B-48E3-99FF-3E8687F94423"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3988:-:*:*:*:*:*:*:*","matchCriteriaId":"BF676C5B-838B-446C-A689-6A25AB8A87E2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn6450_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1FAFC9FA-E6EF-44C5-BD50-2824C7711541"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn6450:-:*:*:*:*:*:*:*","matchCriteriaId":"6F895CDD-F9BB-45AD-AE60-71F4549114A4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn6650_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"93398092-AF7C-4F04-874C-7E5B4CF7AB00"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn6650:-:*:*:*:*:*:*:*","matchCriteriaId":"7D242084-5844-4E43-8D7F-D2F8E3521F0C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn6755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2BC386D9-3D2B-40FA-A2D9-199BB138F46A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn6755:-:*:*:*:*:*:*:*","matchCriteriaId":"133FFD9F-FA09-4801-939B-AD1D507BE5FE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7760_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"506C6CE1-6BDF-4542-82C1-820D10D8181A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7760:-:*:*:*:*:*:*:*","matchCriteriaId":"72F8CE3B-2BDC-40B1-BB04-A3A7E25B8096"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7860_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2EB8794F-7998-424E-AF68-E4A4F9310F65"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7860:-:*:*:*:*:*:*:*","matchCriteriaId":"799D69CE-3FCC-4B19-8B00-9AF38111D983"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7861_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"57608D47-894C-4895-B4B3-4733D55D57DB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7861:-:*:*:*:*:*:*:*","matchCriteriaId":"2FFD2C38-1A61-4BED-ABFA-DAE0C4B78620"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7880_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"63735D33-9F09-4841-9FE0-0D9AB604BECF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7880:-:*:*:*:*:*:*:*","matchCriteriaId":"E826F765-4C2E-4319-BBC4-DEB02AAD783F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D765C392-5F38-4E6A-9E88-59629E7A6911"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7881:-:*:*:*:*:*:*:*","matchCriteriaId":"FAE8F4F9-F692-4EC0-A3FE-2CDD681DCBFD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8810_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"15307882-7039-43E9-9BA3-035045988B99"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8810:-:*:*:*:*:*:*:*","matchCriteriaId":"AA85B322-E593-4499-829A-CC6D70BAE884"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E839A0B9-64C3-4C7A-82B7-D2AAF65928F8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8815:-:*:*:*:*:*:*:*","matchCriteriaId":"7E870D82-DE3B-4199-A730-C8FB545BAA98"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8830_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"11B69595-E488-4590-A150-CE5BE08B5E13"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8830:-:*:*:*:*:*:*:*","matchCriteriaId":"BF680174-5FA6-47D9-8EAB-CC2A37A7BD42"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8832_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7ACAD26E-B79E-4659-91A5-D301281F7D36"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8832:-:*:*:*:*:*:*:*","matchCriteriaId":"F0E46DA6-9494-4D92-A4AE-A272AF6ACCCC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F80BC68E-7476-4A40-9F48-53722FE9A5BF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8835:-:*:*:*:*:*:*:*","matchCriteriaId":"6B36F4B2-BAA3-45AD-9967-0EB482C99708"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8840_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA33DE15-C177-43B3-AD50-FF797753D12E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8840:-:*:*:*:*:*:*:*","matchCriteriaId":"AE1A5841-5BCB-4033-ACB9-23F3FCA65309"}]}]}],"references":[{"url":"https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2026-bulletin.html","source":"product-security@qualcomm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-57537","sourceIdentifier":"product-security@qualcomm.com","published":"2026-10-06T07:16:58.300","lastModified":"2026-10-09T14:12:04.180","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization."}],"affected":[{"source":"product-security@qualcomm.com","affectedData":[{"vendor":"Qualcomm, Inc.","product":"Snapdragon","defaultStatus":"unaffected","platforms":["Snapdragon Auto","Snapdragon Compute","Snapdragon Mobile","Snapdragon Wearables"],"versions":[{"version":"FastConnect 6900","status":"affected"},{"version":"FastConnect 7800","status":"affected"},{"version":"IQ10 Series","status":"affected"},{"version":"Pandeiro","status":"affected"},{"version":"QCA6595AU","status":"affected"},{"version":"QCA6698AQ","status":"affected"},{"version":"QCA6797AQ","status":"affected"},{"version":"QCA8695AU","status":"affected"},{"version":"QCM8838","status":"affected"},{"version":"QLN1083BD","status":"affected"},{"version":"QLN1086BD","status":"affected"},{"version":"QPA1083BD","status":"affected"},{"version":"QPA1086BD","status":"affected"},{"version":"QXM1083","status":"affected"},{"version":"QXM1086","status":"affected"},{"version":"QXM1093","status":"affected"},{"version":"QXM1094","status":"affected"},{"version":"QXM1095","status":"affected"},{"version":"QXM1096","status":"affected"},{"version":"SAR1165P","status":"affected"},{"version":"SC8380XP","status":"affected"},{"version":"SD865 5G","status":"affected"},{"version":"SDR753","status":"affected"},{"version":"SM8750P","status":"affected"},{"version":"Snapdragon 8 Elite","status":"affected"},{"version":"Snapdragon 8 Elite Gen 5","status":"affected"},{"version":"Snapdragon AR1+ Gen 1 Platform","status":"affected"},{"version":"Snapdragon Ride Elite","status":"affected"},{"version":"Snapdragon XR2 5G Platform","status":"affected"},{"version":"Snapdragon XR2+ Gen 1 Platform","status":"affected"},{"version":"Snapdragon Cockpit Elite","status":"affected"},{"version":"Snapdragon Reality Elite Platform","status":"affected"},{"version":"Snapdragon Wear Elite platform","status":"affected"},{"version":"SW5100","status":"affected"},{"version":"SW5100P","status":"affected"},{"version":"SXR2230P","status":"affected"},{"version":"SXR2250P","status":"affected"},{"version":"Themisto","status":"affected"},{"version":"WCD9380","status":"affected"},{"version":"WCD9385","status":"affected"},{"version":"WCD9395","status":"affected"},{"version":"WCN3660B","status":"affected"},{"version":"WCN3680B","status":"affected"},{"version":"WCN3980","status":"affected"},{"version":"WCN3988","status":"affected"},{"version":"WCN7860","status":"affected"},{"version":"WCN7861","status":"affected"},{"version":"WCN7880","status":"affected"},{"version":"WCN7881","status":"affected"},{"version":"WSA8810","status":"affected"},{"version":"WSA8815","status":"affected"},{"version":"WSA8830","status":"affected"},{"version":"WSA8832","status":"affected"},{"version":"WSA8835","status":"affected"},{"version":"WSA8840","status":"affected"},{"version":"WSA8845","status":"affected"},{"version":"WSA8845H","status":"affected"},{"version":"X1E80100","status":"affected"},{"version":"XRV7209","status":"affected"},{"version":"XRV9209","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"product-security@qualcomm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T12:57:37.576031Z","id":"CVE-2026-57537","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"product-security@qualcomm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:congo_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4DA1D059-7672-40F5-BB2E-3072475666A0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:congo:-:*:*:*:*:*:*:*","matchCriteriaId":"48C84939-F83F-4E79-902C-32B77C4A4BBB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6200_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CDE1CBDE-3D28-463C-B215-AA7DF373EF09"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6200:-:*:*:*:*:*:*:*","matchCriteriaId":"66BD3B88-7CF9-482D-A2DD-67F6ACF4CC57"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6900_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E670F500-9B71-4BBE-B5DA-221D35803C89"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6900:-:*:*:*:*:*:*:*","matchCriteriaId":"9ADEB5C5-B79A-4F45-B7D3-75945B38DB6C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_7800_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B3053D68-C5D8-4D47-A4F0-9F3AF2289E1D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_7800:-:*:*:*:*:*:*:*","matchCriteriaId":"638DBC7F-456F-487D-BED2-2214DFF8BEE2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:orne_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"19FB8345-BBFC-4E18-A4E6-64A159D7F65B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:orne:-:*:*:*:*:*:*:*","matchCriteriaId":"FFDA4056-3F1B-4F3A-BE59-1908BD3DE5E9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:pandeiro_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F8EF0C-BB48-47E1-A045-254D79388F75"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:pandeiro:-:*:*:*:*:*:*:*","matchCriteriaId":"058950FC-ED72-4E91-AE13-87E738ADC083"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6595au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"288F637F-22F8-47CF-B67F-C798A730A1BD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6595au:-:*:*:*:*:*:*:*","matchCriteriaId":"D0996EA3-1C92-4933-BE34-9CF625E59FE7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6698aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5FA1F8F4-EAF2-4704-A8A6-19AD3CA1B577"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6698aq:-:*:*:*:*:*:*:*","matchCriteriaId":"B3F7853D-09EE-476F-B48D-BB30AEB4A67D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6797aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"797295C2-535C-46A9-A725-E1A5405F0436"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6797aq:-:*:*:*:*:*:*:*","matchCriteriaId":"8BFC575E-594E-4711-94B1-2DC8D03B9AC4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca8695au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"55A21DB0-4722-4421-8E97-B0E31B93E53B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca8695au:-:*:*:*:*:*:*:*","matchCriteriaId":"797B8944-61F0-4522-97FE-3C172369F477"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm8838_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7C6535AE-8680-4AB9-ABF6-82DAE1795531"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm8838:-:*:*:*:*:*:*:*","matchCriteriaId":"9C3FEACB-1AE1-4BF2-9552-C31A32DCCA9B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qln1083bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FD70F234-1EE7-4362-97F6-5AEDB7078D03"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qln1083bd:-:*:*:*:*:*:*:*","matchCriteriaId":"C569A848-B70C-42EF-B6D5-4A86547586EE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qln1086bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F218DF06-C40A-4738-ABB5-A3FA2243EF84"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qln1086bd:-:*:*:*:*:*:*:*","matchCriteriaId":"2E2A0CD0-66FA-45D6-BBC7-03641203EC73"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qmp1000_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5298473D-8B34-42E6-BC32-69A3800972B4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qmp1000:-:*:*:*:*:*:*:*","matchCriteriaId":"2A1CF44E-FFC2-4DCB-8DC2-46422D912448"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qmp2001_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0B53AF78-37B0-4D64-A7D3-1729D0248D61"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qmp2001:-:*:*:*:*:*:*:*","matchCriteriaId":"560E36D2-27DB-4590-A879-C2071ED72641"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qpa1083bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B0208F7B-A959-485E-B004-A34CB7C7C4C9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qpa1083bd:-:*:*:*:*:*:*:*","matchCriteriaId":"FBDAC812-4603-4D24-A861-23825E32D44E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qpa1086bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7F6DEF72-A8FF-4B67-AA6C-5CB4AA7B35E1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qpa1086bd:-:*:*:*:*:*:*:*","matchCriteriaId":"00EF6875-B088-40BD-A526-C962789CDC5A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_8800_mobile_connectivity_system_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"28C65092-164F-40B7-8DCF-0F72F19C1CC3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_8800_mobile_connectivity_system:-:*:*:*:*:*:*:*","matchCriteriaId":"C3813BD8-2228-414D-BB2B-E3C00210404A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1083_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0CE74B89-5E3F-428E-8000-E3452B8B6953"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1083:-:*:*:*:*:*:*:*","matchCriteriaId":"DC11B7A6-E621-463D-B861-6B203EADFA57"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1086_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E48759CC-B751-4466-87DF-2D0AB220C0FB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1086:-:*:*:*:*:*:*:*","matchCriteriaId":"E7F1C9D2-6616-4F74-85C2-1850B5C3F6BC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1093_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9A46B609-BD06-4BB7-B055-1F71C555E93D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1093:-:*:*:*:*:*:*:*","matchCriteriaId":"59598462-1E53-4F6D-BAB5-06ACEDF6CD9F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1094_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8F30D66E-2802-4394-BC39-5E04711234FF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1094:-:*:*:*:*:*:*:*","matchCriteriaId":"078EC383-784F-4468-B94C-AE7CC9808419"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1095_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B7B67C93-0453-4696-8F3D-0AD664922C44"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1095:-:*:*:*:*:*:*:*","matchCriteriaId":"D61C46AA-9130-46A8-BD04-8B4235118B81"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1096_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2E2D5E44-48F6-41E8-A38B-A2E070E16AA9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1096:-:*:*:*:*:*:*:*","matchCriteriaId":"9BD0372F-5140-4966-9A27-6B5A606C0665"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sar1165p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D97CD52-4CB0-4F57-9C24-530B326B8D9D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sar1165p:-:*:*:*:*:*:*:*","matchCriteriaId":"582EE932-DDE5-4BE5-837C-523FE3EFBA5D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sc8380xp_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14E3FE58-7F1C-4F5C-B62D-0CF124E14AB2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sc8380xp:-:*:*:*:*:*:*:*","matchCriteriaId":"FFCB0BBA-3F81-4FCA-B3DE-190C46DA50DB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sdr753_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A49B142B-E8DC-4A79-B969-2C2FBE2E009A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sdr753:-:*:*:*:*:*:*:*","matchCriteriaId":"8A1A6C7D-EAB0-4D8D-9A3E-DA066F4ACF7D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm4875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E21AC0DB-36FF-4B36-9CA9-809949B0CA53"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm4875:-:*:*:*:*:*:*:*","matchCriteriaId":"471434D6-35A1-4F4E-85C5-0180383BD315"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6850_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DE09FF94-7751-4EED-B269-C7BB056CA90C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6850:-:*:*:*:*:*:*:*","matchCriteriaId":"02B1463D-EE74-42DC-95D5-D0F66260CB32"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8845p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A205320E-6C60-4F6A-90D5-06CABAF0FDEA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8845p:-:*:*:*:*:*:*:*","matchCriteriaId":"0FB8CE86-605E-4B3D-82E5-A55093ABCE5F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8950_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"09662E75-32BB-4D24-8A81-B743FF0DE323"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8950:-:*:*:*:*:*:*:*","matchCriteriaId":"8D44C02D-3FCA-4885-A1B5-7C2836B1233B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8950p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D5350DB-39BD-4BF4-87AB-5FD6DECB25D3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8950p:-:*:*:*:*:*:*:*","matchCriteriaId":"0AE6E7D9-E7E8-490E-B801-D97F522CA0FA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8975_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42D47A7D-A79C-4EA0-AEDF-533F4F9933B9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8975:-:*:*:*:*:*:*:*","matchCriteriaId":"1CC31B0D-3890-442E-87BE-47E58A0F6537"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8975p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"73D04C5D-A3A8-45A3-A83E-03DF5EF400C2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8975p:-:*:*:*:*:*:*:*","matchCriteriaId":"A67DF502-A50C-4E7E-B457-F46B7149B85C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_460_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"390D7CAF-6C0B-4438-AA7D-AEEE127F4D3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_460_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"5BB1FC5E-CF6F-4E54-B78D-C01AFD034903"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_662_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"37DF4D73-3ACC-41B3-8CA4-20DAECE6BFB7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_662_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"FE08D23A-2D0D-4472-8847-27B955F55165"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_elite_gen_5_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"41070BDB-15E4-4DD7-A132-A14AA24978E5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_elite_gen_5:-:*:*:*:*:*:*:*","matchCriteriaId":"102460A6-9637-4883-9230-2CC888D5D74E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen_5_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4D8D8AD-B291-4AEC-8817-D7C99E79FF49"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen_5:-:*:*:*:*:*:*:*","matchCriteriaId":"8CA08EA8-A47E-4797-8644-0A48D509939C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_ar1_gen_1_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"53E5BBDA-C07D-42E2-9A34-EC1F6454CAA4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_ar1_gen_1_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"0BB2408F-C768-4DD2-B834-B62E188D6CC2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_ar1\\+_gen_1_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BE30A5E0-10D5-4679-ACA6-4ED991335A6F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_ar1\\+_gen_1_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"CFA75B74-D20D-4C8B-BFA2-5DE4848410CD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_ride_elite_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4E50C2D-229B-4B78-8567-CD603DE2A767"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_ride_elite:-:*:*:*:*:*:*:*","matchCriteriaId":"6C5ECF68-EB2E-46B5-AEC3-0744D4C9215A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_cockpit_elite_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D4E05762-315D-46A9-93DB-435DB78FEE71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_cockpit_elite:-:*:*:*:*:*:*:*","matchCriteriaId":"5028FDF9-6852-4C88-97D8-CE6392960A55"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_reality_elite_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"08ACBE23-DBE3-4AE0-B9EA-F3A73290D5F0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_reality_elite_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"3F82A885-4CAB-44F2-85FA-3D581283A936"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_wear_elite_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"21C295D3-AC5D-4DFC-A0B1-3B5F7C08DC46"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_wear_elite_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"A32D44E3-02FC-47AA-B6FF-E87F5866E453"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sxr2230p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD6444F6-A477-4B4C-8A09-C22C47CCE45B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sxr2230p:-:*:*:*:*:*:*:*","matchCriteriaId":"F3E20681-4FC4-46E2-AF77-BCF03BC8E77E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:themisto_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"55DE7B27-56A2-4046-9E03-8215587C8827"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:themisto:-:*:*:*:*:*:*:*","matchCriteriaId":"0853EA22-4EFD-4037-8B83-CB7C18417D23"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9370_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1295D869-F4DD-4766-B4AA-3513752F43B4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9370:-:*:*:*:*:*:*:*","matchCriteriaId":"B98784DC-3143-4D38-AD28-DBBDCCAB4272"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9375_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"34143ABA-7D09-429F-A65C-3A33438BF62C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9375:-:*:*:*:*:*:*:*","matchCriteriaId":"9D56DFE3-5EF1-4B23-BBD5-0203FBF9CCEC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9378_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4CFDBB5B-0A4F-4032-874F-D2A7EF933FB0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9378:-:*:*:*:*:*:*:*","matchCriteriaId":"D28A12D6-CC60-4BE9-ADEE-FAB58B05440F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"70292B01-617F-44AD-AF77-1AFC1450523D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9380:-:*:*:*:*:*:*:*","matchCriteriaId":"FA94C6D6-85DB-4031-AAF4-C399019AE16D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"92B17201-8185-47F1-9720-5AB4ECD11B22"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9385:-:*:*:*:*:*:*:*","matchCriteriaId":"E1FA2EB9-416F-4D69-8786-386CC73978AE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9395_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"699056F6-1517-4F25-AE07-4FFCF6923B9F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9395:-:*:*:*:*:*:*:*","matchCriteriaId":"E4C023D2-6FF5-4FFC-B9F2-895979166580"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3950_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3FEF2DB6-00F5-4B07-953B-EF58B31267F1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3950:-:*:*:*:*:*:*:*","matchCriteriaId":"120E8F0F-EBEB-4565-9927-2D473F783EF7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4BFB25F-013B-48E3-99FF-3E8687F94423"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3988:-:*:*:*:*:*:*:*","matchCriteriaId":"BF676C5B-838B-446C-A689-6A25AB8A87E2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn6450_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1FAFC9FA-E6EF-44C5-BD50-2824C7711541"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn6450:-:*:*:*:*:*:*:*","matchCriteriaId":"6F895CDD-F9BB-45AD-AE60-71F4549114A4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7760_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"506C6CE1-6BDF-4542-82C1-820D10D8181A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7760:-:*:*:*:*:*:*:*","matchCriteriaId":"72F8CE3B-2BDC-40B1-BB04-A3A7E25B8096"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7860_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2EB8794F-7998-424E-AF68-E4A4F9310F65"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7860:-:*:*:*:*:*:*:*","matchCriteriaId":"799D69CE-3FCC-4B19-8B00-9AF38111D983"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7861_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"57608D47-894C-4895-B4B3-4733D55D57DB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7861:-:*:*:*:*:*:*:*","matchCriteriaId":"2FFD2C38-1A61-4BED-ABFA-DAE0C4B78620"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7880_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"63735D33-9F09-4841-9FE0-0D9AB604BECF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7880:-:*:*:*:*:*:*:*","matchCriteriaId":"E826F765-4C2E-4319-BBC4-DEB02AAD783F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D765C392-5F38-4E6A-9E88-59629E7A6911"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7881:-:*:*:*:*:*:*:*","matchCriteriaId":"FAE8F4F9-F692-4EC0-A3FE-2CDD681DCBFD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn8841_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C7A02129-BB8C-43F1-BFC1-3632BA299AB6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn8841:-:*:*:*:*:*:*:*","matchCriteriaId":"4082B1D2-9CBD-48FE-93EF-C069A4B6A466"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8830_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"11B69595-E488-4590-A150-CE5BE08B5E13"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8830:-:*:*:*:*:*:*:*","matchCriteriaId":"BF680174-5FA6-47D9-8EAB-CC2A37A7BD42"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8832_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7ACAD26E-B79E-4659-91A5-D301281F7D36"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8832:-:*:*:*:*:*:*:*","matchCriteriaId":"F0E46DA6-9494-4D92-A4AE-A272AF6ACCCC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F80BC68E-7476-4A40-9F48-53722FE9A5BF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8835:-:*:*:*:*:*:*:*","matchCriteriaId":"6B36F4B2-BAA3-45AD-9967-0EB482C99708"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8840_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA33DE15-C177-43B3-AD50-FF797753D12E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8840:-:*:*:*:*:*:*:*","matchCriteriaId":"AE1A5841-5BCB-4033-ACB9-23F3FCA65309"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8845_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5B47BF35-3AA0-4667-842E-19B0FE30BF3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8845:-:*:*:*:*:*:*:*","matchCriteriaId":"8A071672-9405-4418-9141-35CEADBB65AF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8845h_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB7CF473-8B25-4851-91F2-1BD693CCDC85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8845h:-:*:*:*:*:*:*:*","matchCriteriaId":"91E591F2-8F72-4A5A-9264-2742EB2DABDA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8850_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FA243934-7BFA-47AA-B78C-CCB25377E471"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8850:-:*:*:*:*:*:*:*","matchCriteriaId":"2FD65035-4D20-48D5-874E-47CD9C7A985C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8850w_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22707187-A56D-48AD-800F-A438FD844546"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8850w:-:*:*:*:*:*:*:*","matchCriteriaId":"F526A54A-F974-4D0A-A1A6-FABBB6711CD0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8855c_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"671E0B82-5D58-4644-8806-7F4CAFFB6641"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8855c:-:*:*:*:*:*:*:*","matchCriteriaId":"CC066321-B3CC-4E88-BFA9-414B8D095207"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:xrv7209_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CC6C6243-E092-4903-BC20-E3B0CECBC790"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:xrv7209:-:*:*:*:*:*:*:*","matchCriteriaId":"AAA33761-D61C-4A81-B233-5E2D50F3596F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:xrv9209_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D693483-72F9-42B1-8EDA-8DABD537F428"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:xrv9209:-:*:*:*:*:*:*:*","matchCriteriaId":"43F4A7D9-055D-475B-BFE4-61A86C7397F8"}]}]}],"references":[{"url":"https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2026-bulletin.html","source":"product-security@qualcomm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-57545","sourceIdentifier":"product-security@qualcomm.com","published":"2026-10-06T07:16:58.437","lastModified":"2026-10-09T14:12:14.660","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Memory corruption when processing draw objects of incorrect type during graphics command list execution."}],"affected":[{"source":"product-security@qualcomm.com","affectedData":[{"vendor":"Qualcomm, Inc.","product":"Snapdragon","defaultStatus":"unaffected","platforms":["Snapdragon Auto","Snapdragon CCW","Snapdragon Compute","Snapdragon Consumer IOT","Snapdragon Industrial IOT","Snapdragon Mobile","Snapdragon WBC","Snapdragon Wearables"],"versions":[{"version":"Cologne","status":"affected"},{"version":"CQ7790","status":"affected"},{"version":"CQ8725S","status":"affected"},{"version":"CQ8750M","status":"affected"},{"version":"CSRA6620","status":"affected"},{"version":"CSRA6640","status":"affected"},{"version":"FastConnect 6200","status":"affected"},{"version":"FastConnect 6700","status":"affected"},{"version":"FastConnect 6900","status":"affected"},{"version":"FastConnect 7800","status":"affected"},{"version":"G1 Gen 1","status":"affected"},{"version":"G2 Gen 1","status":"affected"},{"version":"IQ10 Series","status":"affected"},{"version":"IQ6 Series Platform","status":"affected"},{"version":"IQ8 Series Platform","status":"affected"},{"version":"IQ9 Series Platform","status":"affected"},{"version":"Kalpeni","status":"affected"},{"version":"LeMans_AU_LGIT","status":"affected"},{"version":"LeMansAU","status":"affected"},{"version":"MBM415","status":"affected"},{"version":"MBM715","status":"affected"},{"version":"Milos","status":"affected"},{"version":"Monaco_IOT","status":"affected"},{"version":"Orne","status":"affected"},{"version":"Palawan25","status":"affected"},{"version":"Pandeiro","status":"affected"},{"version":"Q-2390","status":"affected"},{"version":"Q-4390","status":"affected"},{"version":"QAM8255P","status":"affected"},{"version":"QAM8295P","status":"affected"},{"version":"QAM8620P","status":"affected"},{"version":"QAMSRV1H","status":"affected"},{"version":"QAMSRV1M","status":"affected"},{"version":"QCA6391","status":"affected"},{"version":"QCA6574","status":"affected"},{"version":"QCA6574A","status":"affected"},{"version":"QCA6574AU","status":"affected"},{"version":"QCA6595","status":"affected"},{"version":"QCA6595AU","status":"affected"},{"version":"QCA6678AQ","status":"affected"},{"version":"QCA6688AQ","status":"affected"},{"version":"QCA6696","status":"affected"},{"version":"QCA6698AQ","status":"affected"},{"version":"QCA6698AU","status":"affected"},{"version":"QCA6797AQ","status":"affected"},{"version":"QCA8695AU","status":"affected"},{"version":"QCM2290","status":"affected"},{"version":"QCM4290","status":"affected"},{"version":"QCM4325","status":"affected"},{"version":"QCM5430","status":"affected"},{"version":"QCM6125","status":"affected"},{"version":"QCM6490","status":"affected"},{"version":"QCM6650","status":"affected"},{"version":"QCM8550","status":"affected"},{"version":"QCM8838","status":"affected"},{"version":"QCN9011","status":"affected"},{"version":"QCN9012","status":"affected"},{"version":"QCN9274","status":"affected"},{"version":"QCS2290","status":"affected"},{"version":"QCS4290","status":"affected"},{"version":"QCS8550","status":"affected"},{"version":"QLN1083BD","status":"affected"},{"version":"QLN1086BD","status":"affected"},{"version":"QMP1000","status":"affected"},{"version":"QPA1083BD","status":"affected"},{"version":"QPA1086BD","status":"affected"},{"version":"Qualcomm Dragonwing Q-6690","status":"affected"},{"version":"Qualcomm Dragonwing Q-7790","status":"affected"},{"version":"Qualcomm Dragonwing Q-8845","status":"affected"},{"version":"Qualcomm Dragonwing QCM4490","status":"affected"},{"version":"Qualcomm Video Collaboration VC1 Platform","status":"affected"},{"version":"Qualcomm Video Collaboration VC3 Platform","status":"affected"},{"version":"Qualcomm Video Collaboration VC5 Platform","status":"affected"},{"version":"QXM1083","status":"affected"},{"version":"QXM1086","status":"affected"},{"version":"QXM1093","status":"affected"},{"version":"QXM1094","status":"affected"},{"version":"QXM1095","status":"affected"},{"version":"QXM1096","status":"affected"},{"version":"SA6155P","status":"affected"},{"version":"SA7255P","status":"affected"},{"version":"SA7775P","status":"affected"},{"version":"SA8155P","status":"affected"},{"version":"SA8195P","status":"affected"},{"version":"SA8255P","status":"affected"},{"version":"SA8295P","status":"affected"},{"version":"SA8620P","status":"affected"},{"version":"SA8770P","status":"affected"},{"version":"SA9000P","status":"affected"},{"version":"SAR1165P","status":"affected"},{"version":"SAR2130P","status":"affected"},{"version":"SC8380XP","status":"affected"},{"version":"SD 8 Gen1 5G","status":"affected"},{"version":"SD662","status":"affected"},{"version":"SDR753","status":"affected"},{"version":"SM6225P","status":"affected"},{"version":"SM6650P","status":"affected"},{"version":"SM7325P","status":"affected"},{"version":"SM7635P","status":"affected"},{"version":"SM7675","status":"affected"},{"version":"SM7675P","status":"affected"},{"version":"SM8550P","status":"affected"},{"version":"SM8635","status":"affected"},{"version":"SM8635P","status":"affected"},{"version":"SM8650Q","status":"affected"},{"version":"SM8750P","status":"affected"},{"version":"Smart Audio 400 Platform","status":"affected"},{"version":"Snapdragon 4 Gen 1 Mobile Platform","status":"affected"},{"version":"Snapdragon 4 Gen 2 Mobile Platform","status":"affected"},{"version":"Snapdragon 460 Mobile Platform","status":"affected"},{"version":"Snapdragon 480 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 480+ 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 6 Gen 4 Mobile Platform","status":"affected"},{"version":"Snapdragon 662 Mobile Platform","status":"affected"},{"version":"Snapdragon 680 4G Mobile Platform","status":"affected"},{"version":"Snapdragon 685 4G Mobile Platform","status":"affected"},{"version":"Snapdragon 695 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 7 Gen 4 Mobile Platform","status":"affected"},{"version":"Snapdragon 778G 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 778G+ 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 782G Mobile Platform","status":"affected"},{"version":"Snapdragon 7c+ Gen 3 Compute","status":"affected"},{"version":"Snapdragon 7s Gen 3 Mobile Platform","status":"affected"},{"version":"Snapdragon 8 Elite","status":"affected"},{"version":"Snapdragon 8 Elite Gen 5","status":"affected"},{"version":"Snapdragon 8 Gen 1 Mobile Platform","status":"affected"},{"version":"Snapdragon 8 Gen 2 Mobile Platform","status":"affected"},{"version":"Snapdragon 8 Gen 3 Mobile Platform","status":"affected"},{"version":"Snapdragon 8+ Gen 1 Mobile Platform","status":"affected"},{"version":"Snapdragon 8+ Gen 2 Mobile Platform","status":"affected"},{"version":"Snapdragon 888 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 888+ 5G Mobile Platform","status":"affected"},{"version":"Snapdragon AR1 Gen 1 Platform","status":"affected"},{"version":"Snapdragon AR1+ Gen 1 Platform","status":"affected"},{"version":"Snapdragon Ride Elite","status":"affected"},{"version":"Snapdragon W5+ Gen 1 Wearable Platform","status":"affected"},{"version":"Snapdragon X53 5G Modem-RF System","status":"affected"},{"version":"Snapdragon Cockpit Elite","status":"affected"},{"version":"Snapdragon Reality Elite Platform","status":"affected"},{"version":"Snapdragon Wear Elite platform","status":"affected"},{"version":"SRV1H","status":"affected"},{"version":"SRV1L","status":"affected"},{"version":"SRV1M","status":"affected"},{"version":"SSG2115P","status":"affected"},{"version":"SSG2125P","status":"affected"},{"version":"SW5100","status":"affected"},{"version":"SW5100P","status":"affected"},{"version":"SW-only","status":"affected"},{"version":"SXR1230P","status":"affected"},{"version":"SXR2230P","status":"affected"},{"version":"SXR2250P","status":"affected"},{"version":"TalynPlus","status":"affected"},{"version":"Themisto","status":"affected"},{"version":"Vision Intelligence 400 Platform","status":"affected"},{"version":"WCD9335","status":"affected"},{"version":"WCD9341","status":"affected"},{"version":"WCD9370","status":"affected"},{"version":"WCD9375","status":"affected"},{"version":"WCD9378","status":"affected"},{"version":"WCD9380","status":"affected"},{"version":"WCD9385","status":"affected"},{"version":"WCD9390","status":"affected"},{"version":"WCD9395","status":"affected"},{"version":"WCN3910","status":"affected"},{"version":"WCN3950","status":"affected"},{"version":"WCN3980","status":"affected"},{"version":"WCN3988","status":"affected"},{"version":"WCN3990","status":"affected"},{"version":"WCN6450","status":"affected"},{"version":"WCN6650","status":"affected"},{"version":"WCN6755","status":"affected"},{"version":"WCN7860","status":"affected"},{"version":"WCN7861","status":"affected"},{"version":"WCN7880","status":"affected"},{"version":"WCN7881","status":"affected"},{"version":"WSA8810","status":"affected"},{"version":"WSA8815","status":"affected"},{"version":"WSA8830","status":"affected"},{"version":"WSA8832","status":"affected"},{"version":"WSA8835","status":"affected"},{"version":"WSA8840","status":"affected"},{"version":"WSA8845","status":"affected"},{"version":"WSA8845H","status":"affected"},{"version":"X1E80100","status":"affected"},{"version":"XRV7209","status":"affected"},{"version":"XRV9209","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"product-security@qualcomm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T12:56:59.716926Z","id":"CVE-2026-57545","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"product-security@qualcomm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-822"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_g1_gen_2_gaming_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"905C9267-C1B5-4A77-BC33-118986A907C7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_g1_gen_2_gaming_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"671C9107-7E54-4FBC-B03D-1EB4DCD8597E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:ar8031_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FCE1ADA9-8042-4CDE-A2B9-E96665CB41BE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:ar8031:-:*:*:*:*:*:*:*","matchCriteriaId":"BB1DE046-DD70-4ACA-9DF4-59939DAC1889"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cologne_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8FF959C0-5AAB-4DC5-AE8F-4EFA21A00B5E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cologne:-:*:*:*:*:*:*:*","matchCriteriaId":"E31E0C48-FB61-47C8-B28B-3A701E85E126"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:congo_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4DA1D059-7672-40F5-BB2E-3072475666A0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:congo:-:*:*:*:*:*:*:*","matchCriteriaId":"48C84939-F83F-4E79-902C-32B77C4A4BBB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq2390m_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8DAB4A10-45A2-47B2-AAED-46DCC9740396"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq2390m:-:*:*:*:*:*:*:*","matchCriteriaId":"F793F65B-324E-416A-B9CD-0496F5E9CB8C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq2390s_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B0928CC-C507-4437-946B-B2AD400E9B3E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq2390s:-:*:*:*:*:*:*:*","matchCriteriaId":"E6FAF059-0D17-40DD-B0DA-A708081F6062"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq7790_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9FEBA60-92CC-4660-B410-74A9D0AEB7B9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq7790:-:*:*:*:*:*:*:*","matchCriteriaId":"25B3F423-6AF3-472A-A178-21776C708A88"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq7790m_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1FE23E54-0845-43ED-ADFD-B36A039503A6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq7790m:-:*:*:*:*:*:*:*","matchCriteriaId":"88BAAE9C-4B48-4CEF-BBC9-42A21DF1ABB2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq8725s_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C6143A36-BA18-432C-A6BB-2F33B1509C44"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq8725s:-:*:*:*:*:*:*:*","matchCriteriaId":"09EE5F30-46A6-423B-94AF-E7F4DAB532CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq8750m_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23301B23-E3B8-4FFA-BC7A-33FDDEEDC425"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq8750m:-:*:*:*:*:*:*:*","matchCriteriaId":"F05B2437-B6C0-41C4-818E-12AFE616D790"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq8845s_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4FB1D261-4C1B-4D43-B8ED-975E526A2FF5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq8845s:-:*:*:*:*:*:*:*","matchCriteriaId":"54AC5C16-88A9-4C16-B7AF-835E53D7DFA4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cq8850ns_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"867A0C11-FBA0-46F1-871F-1800A7A75BB3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cq8850ns:-:*:*:*:*:*:*:*","matchCriteriaId":"9885533F-4021-429D-917F-0A2733725B43"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:csra6620_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FA42F2EA-5D00-42B8-B020-C27675B72915"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:csra6620:-:*:*:*:*:*:*:*","matchCriteriaId":"BFCF207D-B8C8-4860-89C7-673C821F0237"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:csra6640_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A8A35ECF-B12E-42DE-A74B-2C3BE03639A4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:csra6640:-:*:*:*:*:*:*:*","matchCriteriaId":"65B283D6-B2D2-49B6-98A8-08EDB54C1F15"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6200_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CDE1CBDE-3D28-463C-B215-AA7DF373EF09"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6200:-:*:*:*:*:*:*:*","matchCriteriaId":"66BD3B88-7CF9-482D-A2DD-67F6ACF4CC57"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6700_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"82B82E87-F3F4-466F-A76B-C8809121FF6F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6700:-:*:*:*:*:*:*:*","matchCriteriaId":"419A132E-E42C-4395-B74B-788A39DF1D13"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6900_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E670F500-9B71-4BBE-B5DA-221D35803C89"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6900:-:*:*:*:*:*:*:*","matchCriteriaId":"9ADEB5C5-B79A-4F45-B7D3-75945B38DB6C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_7800_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B3053D68-C5D8-4D47-A4F0-9F3AF2289E1D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_7800:-:*:*:*:*:*:*:*","matchCriteriaId":"638DBC7F-456F-487D-BED2-2214DFF8BEE2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:g1_gen_1_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0556CCE6-B61B-4DE7-AD4B-333414280DF8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:g1_gen_1:-:*:*:*:*:*:*:*","matchCriteriaId":"CC734495-D935-40CC-9644-477E921F3EE0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:g2_gen_1_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"924DFF0F-E8B2-4B94-9B98-E0C2D6313C87"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:g2_gen_1:-:*:*:*:*:*:*:*","matchCriteriaId":"2A5E644B-D05F-4241-8E20-4A6DA1A56695"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:g3x_gen_2_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C167BE19-999E-4538-A23E-01F9C287A6C7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:g3x_gen_2:-:*:*:*:*:*:*:*","matchCriteriaId":"1026CB5F-E30A-42DE-8432-74412CC8BA00"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iq-615_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D2B2D5D-0213-4979-ACBF-BEF843166047"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iq-615:-:*:*:*:*:*:*:*","matchCriteriaId":"CE575B0C-DDE4-4E5A-9FE8-03305C804558"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iq-8275_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"253BF0D2-D24D-4EE3-A157-9853BBB368F2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iq-8275:-:*:*:*:*:*:*:*","matchCriteriaId":"78C6B840-62E9-4DDD-9376-2F7A8FB9D589"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iq-9075_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"08431A88-C176-48BB-918C-DF3FEABE78D4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iq-9075:-:*:*:*:*:*:*:*","matchCriteriaId":"3C50A35E-023A-404D-BFBC-FFCD1F30E872"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:kalpeni_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5A2D4C45-005F-4A02-BFD7-84893FF1A0E8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:kalpeni:-:*:*:*:*:*:*:*","matchCriteriaId":"B3178A79-485F-40DB-A71D-B29BD3875A7D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:lemans_au_lgit_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5767FE95-737F-4C20-A5AB-EC641A68D906"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:lemans_au_lgit:-:*:*:*:*:*:*:*","matchCriteriaId":"33323A49-9267-421B-96E1-80C5FA709EBC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:lemansau_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2DF0ED3F-C98B-458E-ADCC-C922402BB185"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:lemansau:-:*:*:*:*:*:*:*","matchCriteriaId":"102A4B5E-1739-4C31-A626-ABF6B02FEE29"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:mbm415_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"06917C11-6ABA-4972-A4A5-AEA69A5E73FE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:mbm415:-:*:*:*:*:*:*:*","matchCriteriaId":"9B1C6B87-2B59-4220-BC0D-7CE30F514728"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:mbm715_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F9E2ED64-0268-4C88-9553-D6EF646C3BA1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:mbm715:-:*:*:*:*:*:*:*","matchCriteriaId":"861D5B95-47E1-4374-9EF6-157516FF5171"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:milos_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22EFC07D-16C3-4CCC-A928-EA5EA69CAB65"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:milos:-:*:*:*:*:*:*:*","matchCriteriaId":"0D3491C1-A427-4CEC-B8BD-6A1930E6827F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:milos_iot_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"18471E2B-412C-4D07-9997-C8663902D7B5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:milos_iot:-:*:*:*:*:*:*:*","matchCriteriaId":"0284E269-A212-4474-AE46-255D5245096F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:monaco_iot_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D071BA3E-36AE-40E5-88FB-04012ABECBD2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:monaco_iot:-:*:*:*:*:*:*:*","matchCriteriaId":"F9FB6B54-7F16-497D-B211-327744F35ECB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:netrani_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9C52A53B-1182-47F3-9800-D8C58F954277"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:netrani:-:*:*:*:*:*:*:*","matchCriteriaId":"BEC1F084-78C8-4413-940A-47E9554CB6D0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:orne_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"19FB8345-BBFC-4E18-A4E6-64A159D7F65B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:orne:-:*:*:*:*:*:*:*","matchCriteriaId":"FFDA4056-3F1B-4F3A-BE59-1908BD3DE5E9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:palawan25_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C18C3535-3074-41DE-B40F-F3055BAFF686"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:palawan25:-:*:*:*:*:*:*:*","matchCriteriaId":"7B590B1E-06D1-4C99-BDDF-4A086BEBB4C7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:pandeiro_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F8EF0C-BB48-47E1-A045-254D79388F75"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:pandeiro:-:*:*:*:*:*:*:*","matchCriteriaId":"058950FC-ED72-4E91-AE13-87E738ADC083"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:q-4390_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F534D99F-9B90-457A-B2EE-8E2E05ECC9A2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:q-4390:-:*:*:*:*:*:*:*","matchCriteriaId":"3733BE8F-DF77-49E9-866F-B426194148B3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:q-7790_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3FF5B1C3-B3D9-4ADF-B31E-CDB65DE83EB1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:q-7790:-:*:*:*:*:*:*:*","matchCriteriaId":"67FD545B-CF5E-46F4-A955-4A66DFABBFEC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qam8255p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3723C7B1-A7E2-401F-8D6D-189350F6BCA5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qam8255p:-:*:*:*:*:*:*:*","matchCriteriaId":"B12B89EF-7B12-481E-BCBC-F12B9D16321A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qam8295p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C2D9E281-B382-41AC-84CB-5B1063E5AC51"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qam8295p:-:*:*:*:*:*:*:*","matchCriteriaId":"44EBEBD5-98C3-493B-A108-FD4DE6FFBE97"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qamsrv1h_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F8673334-5E11-4E95-B33D-3029499F71DF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qamsrv1h:-:*:*:*:*:*:*:*","matchCriteriaId":"EC0B32F6-5EF0-4591-99D7-D0E9B09DEC5A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qamsrv1m_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CE03AB2A-3ED9-4489-8E5B-4FCF8BAA8559"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qamsrv1m:-:*:*:*:*:*:*:*","matchCriteriaId":"9E646738-6A87-4470-9640-6A5A1DF3AF78"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca2066_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6366F2ED-C6B7-4579-B304-C5B6DF951EB4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca2066:-:*:*:*:*:*:*:*","matchCriteriaId":"09B688AF-E1A4-496C-924C-D6B725CBBE26"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6391_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"83B53119-1B2F-4978-B7F5-33B84BE73B68"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6391:-:*:*:*:*:*:*:*","matchCriteriaId":"6FEBC0C5-CAA1-475C-96C2-B8D24B2E4536"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6574_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9B828AC8-4A01-4537-B2BD-8180C99F5C32"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6574:-:*:*:*:*:*:*:*","matchCriteriaId":"66C16E1E-9D4A-4F20-B697-833FDCCA86FB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1094_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8F30D66E-2802-4394-BC39-5E04711234FF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1094:-:*:*:*:*:*:*:*","matchCriteriaId":"078EC383-784F-4468-B94C-AE7CC9808419"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1095_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B7B67C93-0453-4696-8F3D-0AD664922C44"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1095:-:*:*:*:*:*:*:*","matchCriteriaId":"D61C46AA-9130-46A8-BD04-8B4235118B81"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1096_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2E2D5E44-48F6-41E8-A38B-A2E070E16AA9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1096:-:*:*:*:*:*:*:*","matchCriteriaId":"9BD0372F-5140-4966-9A27-6B5A606C0665"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa6155p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8DC40C14-3B2D-4E00-9E0F-86E6BDBF2D81"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa6155p:-:*:*:*:*:*:*:*","matchCriteriaId":"0514D433-162C-4680-8912-721D19BE6201"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa7255p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2B651F0A-34DA-400F-A376-B499BFDF8E86"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa7255p:-:*:*:*:*:*:*:*","matchCriteriaId":"4CFF093D-98C8-470F-8330-E5126E06343A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa7775p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6C32CA38-5D48-4108-9858-FD66E20CAF2F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa7775p:-:*:*:*:*:*:*:*","matchCriteriaId":"E1997F8B-17B8-4DE3-BCF7-726928720592"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8155p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C8648B38-2597-401A-8F53-D582FA911569"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8155p:-:*:*:*:*:*:*:*","matchCriteriaId":"A01CD59B-8F21-4CD6-8A1A-7B37547A8715"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8195p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"51BC0A66-493B-43BE-B51F-640BDF2FF32E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8195p:-:*:*:*:*:*:*:*","matchCriteriaId":"D8DA4D12-7ABF-4A04-B44E-E1D68C8E58AB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8255p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EC6E268D-C4AF-4950-9223-39EA36D538A8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8255p:-:*:*:*:*:*:*:*","matchCriteriaId":"073C1A81-D02B-4F2F-9378-CD1B2DCE0E5B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8295p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2A19659B-A0C3-44B7-8D54-BA21729873A4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8295p:-:*:*:*:*:*:*:*","matchCriteriaId":"F978041A-CE28-4BDF-A7DB-F0360F1A5F14"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8620p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6ACE6D64-A498-482F-8270-718F4884CFFD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8620p:-:*:*:*:*:*:*:*","matchCriteriaId":"B6E016D6-1B83-4261-A27E-1F9873F81E14"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8770p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"781CCC31-C08F-499B-BE73-6C7DB70437AF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8770p:-:*:*:*:*:*:*:*","matchCriteriaId":"75AFAA21-0589-4C6A-9418-34EE8A61BBAD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa9000p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A024AB04-B213-4018-A4C1-FA467C7BA775"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa9000p:-:*:*:*:*:*:*:*","matchCriteriaId":"A2A8AB7C-5D34-4794-8C06-2193075B323F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sar1165p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D97CD52-4CB0-4F57-9C24-530B326B8D9D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sar1165p:-:*:*:*:*:*:*:*","matchCriteriaId":"582EE932-DDE5-4BE5-837C-523FE3EFBA5D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sar2130p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"95696696-D2AE-4358-AF5D-3ED14F969964"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sar2130p:-:*:*:*:*:*:*:*","matchCriteriaId":"1A6FC469-463F-4EC1-B4EF-010BDB9BAA05"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sc8380xp_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14E3FE58-7F1C-4F5C-B62D-0CF124E14AB2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sc8380xp:-:*:*:*:*:*:*:*","matchCriteriaId":"FFCB0BBA-3F81-4FCA-B3DE-190C46DA50DB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen1_5g_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D0567B3-D81A-4EEE-868B-4DC2214C159D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen1_5g:-:*:*:*:*:*:*:*","matchCriteriaId":"76236C11-4903-4AD4-9134-3EDD3451EE43"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_662_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"37DF4D73-3ACC-41B3-8CA4-20DAECE6BFB7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_662_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"FE08D23A-2D0D-4472-8847-27B955F55165"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sdr753_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A49B142B-E8DC-4A79-B969-2C2FBE2E009A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sdr753:-:*:*:*:*:*:*:*","matchCriteriaId":"8A1A6C7D-EAB0-4D8D-9A3E-DA066F4ACF7D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm4850_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E7D1CC27-76AE-42A7-98BD-38ED7E63B733"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm4850:-:*:*:*:*:*:*:*","matchCriteriaId":"BD6059A3-2B16-4EE7-B4C5-4376F875A5CC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm4850p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E58014BF-A65B-4DA3-86AB-57FB93B21A4D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm4850p:-:*:*:*:*:*:*:*","matchCriteriaId":"221FC5B4-6059-4F7E-AFDE-7D6A8DB91A4A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm4875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E21AC0DB-36FF-4B36-9CA9-809949B0CA53"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm4875:-:*:*:*:*:*:*:*","matchCriteriaId":"471434D6-35A1-4F4E-85C5-0180383BD315"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6225p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8D2B7D93-4218-4FFF-B1C0-F50EC0B2B934"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6225p:-:*:*:*:*:*:*:*","matchCriteriaId":"00D9DCE1-B3CD-4F45-97DD-637AA27572DD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6450p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEE752CE-2121-477E-A1C9-6A05DF36DFA9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6450p:-:*:*:*:*:*:*:*","matchCriteriaId":"DCA019DB-C24E-4C2B-B4E4-95F61E038FEA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6475p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E32FAA6A-E882-4978-B748-5617BE33F347"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6475p:-:*:*:*:*:*:*:*","matchCriteriaId":"FFFCBBD0-3F52-446F-9A6B-2D138463AB80"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6475q_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03B375DA-4A46-4BC6-B873-99538D53DFBD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6475q:-:*:*:*:*:*:*:*","matchCriteriaId":"ACEA2D75-14DB-4F87-8F3C-A6E9436ECA97"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6650p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"09020F3F-C869-42DF-BD9C-E78056CC8123"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6650p:-:*:*:*:*:*:*:*","matchCriteriaId":"E8272228-2D68-45F2-A670-B5D6E90D9C14"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6850_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DE09FF94-7751-4EED-B269-C7BB056CA90C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6850:-:*:*:*:*:*:*:*","matchCriteriaId":"02B1463D-EE74-42DC-95D5-D0F66260CB32"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7325p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4BEC725F-19B1-4078-B13D-CE624BE23344"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7325p:-:*:*:*:*:*:*:*","matchCriteriaId":"4EA43E38-A12D-49C3-B05C-A2AF07ED2710"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7435_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F7A95A9E-617A-4D3A-9A4E-0C0A29B3C8B5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7435:-:*:*:*:*:*:*:*","matchCriteriaId":"3559292E-B5A6-4F88-BC20-F6AA85F07C97"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7435p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"55C65D26-71D7-4840-B8B1-7C5EC69EB320"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7435p:-:*:*:*:*:*:*:*","matchCriteriaId":"B322FB35-2415-45EA-A350-746AFF734ACD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7525_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2410FF59-E0C0-4920-9656-C398DB06DEAE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7525:-:*:*:*:*:*:*:*","matchCriteriaId":"7D2B800C-4DBC-4028-875D-667C87D75247"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7550_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EEA5CE41-0596-4D38-9891-D1DF711EA7E9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7550:-:*:*:*:*:*:*:*","matchCriteriaId":"E1A901C6-FB73-4361-B391-4A4AF8C70029"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7550p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5C5D7E2C-0955-4B6E-96E4-CFA06D937492"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7550p:-:*:*:*:*:*:*:*","matchCriteriaId":"9D1D0F33-AD5A-4826-9A06-EAD2A8709974"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7635p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3A72DAA5-E10F-40A0-A8CC-541594A3279F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7635p:-:*:*:*:*:*:*:*","matchCriteriaId":"15CC657A-7623-4F37-AC52-8AF5C83D5BDA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7675_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"012C20A8-3F48-48DD-9A77-65C9CB1F6C30"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7675:-:*:*:*:*:*:*:*","matchCriteriaId":"EE992A86-36BC-40E3-8E96-6542560BE8EC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7675p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3B46F132-4049-40D0-8351-C1C6FD2B47A0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7675p:-:*:*:*:*:*:*:*","matchCriteriaId":"1846514C-1F95-4568-98DE-C57214401841"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7750p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B8A511E-B43B-4617-A3B3-03F4EE80CA1D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7750p:-:*:*:*:*:*:*:*","matchCriteriaId":"BAE215A4-3860-45B1-BDFC-B614692F7905"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8475p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8DBF6AE8-605B-4E72-BD3B-0B6C390FCE32"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8475p:-:*:*:*:*:*:*:*","matchCriteriaId":"26AAE148-96B6-4FDE-BABD-48F607464A38"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8550p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C4CDD6A2-5A3C-4572-8CE1-2F102333BB79"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8550p:-:*:*:*:*:*:*:*","matchCriteriaId":"699E5D17-6144-4F0A-8D52-1E8C83990E52"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6574a_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"828CFB37-76A6-4927-9D00-AF9A1C432DD6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6574a:-:*:*:*:*:*:*:*","matchCriteriaId":"11405993-5903-4716-B452-370281034B42"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6574au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D527E2B1-2A46-4FBA-9F7A-F5543677C8FB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6574au:-:*:*:*:*:*:*:*","matchCriteriaId":"8374DDB3-D484-4141-AE0C-42333D2721F6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6595_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"643EC76D-2836-48E6-81DA-78C4883C33CA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6595:-:*:*:*:*:*:*:*","matchCriteriaId":"477F6529-4CE1-44FC-B6EE-D24D44C71AE7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6595au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"288F637F-22F8-47CF-B67F-C798A730A1BD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6595au:-:*:*:*:*:*:*:*","matchCriteriaId":"D0996EA3-1C92-4933-BE34-9CF625E59FE7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6678aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D001127D-8160-42F0-B8B9-2FAA2976B530"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6678aq:-:*:*:*:*:*:*:*","matchCriteriaId":"C9EB615F-FD4C-450B-AB25-E936FD9816C4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6688aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AFBD264F-F24A-4CDD-B316-9514A61B91E7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6688aq:-:*:*:*:*:*:*:*","matchCriteriaId":"94CC5BC4-011D-4D2B-8891-97FBF61FD783"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6696_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0AE207DB-9770-40ED-961D-FDA75965826F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6696:-:*:*:*:*:*:*:*","matchCriteriaId":"0E23922D-C37F-476F-A623-4C1458A9156F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6698aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5FA1F8F4-EAF2-4704-A8A6-19AD3CA1B577"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6698aq:-:*:*:*:*:*:*:*","matchCriteriaId":"B3F7853D-09EE-476F-B48D-BB30AEB4A67D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6698au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3ACA09C0-84A5-493A-A9BD-EF95A8330D54"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6698au:-:*:*:*:*:*:*:*","matchCriteriaId":"3A2397BD-431C-4730-92E3-17A5C2445A65"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6797aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"797295C2-535C-46A9-A725-E1A5405F0436"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6797aq:-:*:*:*:*:*:*:*","matchCriteriaId":"8BFC575E-594E-4711-94B1-2DC8D03B9AC4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca8695au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"55A21DB0-4722-4421-8E97-B0E31B93E53B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca8695au:-:*:*:*:*:*:*:*","matchCriteriaId":"797B8944-61F0-4522-97FE-3C172369F477"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm2290_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5AB1F0FA-25F3-4304-A3BC-5264E55CC092"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm2290:-:*:*:*:*:*:*:*","matchCriteriaId":"214A053F-D80C-4AD9-B4F1-83384095A3F3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm4290_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3C7FFB96-53E7-41A2-BC99-7ACD853214A8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm4290:-:*:*:*:*:*:*:*","matchCriteriaId":"74EBA77E-69A5-4145-9BEC-CD39BA132309"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm4325_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F2D8044B-D4E5-4174-A0FB-478F8434EE8F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm4325:-:*:*:*:*:*:*:*","matchCriteriaId":"163FE96E-DF5B-4B67-8EDE-44A5B9A8492D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm4490_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DA506489-4338-44DF-8F92-12E60AF0048C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm4490:-:*:*:*:*:*:*:*","matchCriteriaId":"A8718C37-A82A-4A08-A887-3F22B37601A9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm5430_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4EC5F81B-AA24-4E3C-9FC8-53E010AC977E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm5430:-:*:*:*:*:*:*:*","matchCriteriaId":"B5C66DAD-0D85-46B8-92D7-6D68B9429E9A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm6125_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AB226552-52D9-44F5-A170-35C44761A72B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm6125:-:*:*:*:*:*:*:*","matchCriteriaId":"FBB16DC4-CDC9-4936-9C6A-0ED8E1F6D056"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm6490_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"ADD6D51E-5787-42A6-8A02-4EBBAFFF9C94"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm6490:-:*:*:*:*:*:*:*","matchCriteriaId":"99AA0291-B822-4CAD-BA17-81B632FC3FEF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm8838_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7C6535AE-8680-4AB9-ABF6-82DAE1795531"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm8838:-:*:*:*:*:*:*:*","matchCriteriaId":"9C3FEACB-1AE1-4BF2-9552-C31A32DCCA9B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcn9011_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9306C34D-47E4-40CF-89F4-BA5263655D13"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcn9011:-:*:*:*:*:*:*:*","matchCriteriaId":"02BA009F-24E1-4953-BA95-2A5BC1CDBDBB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcn9012_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"61F34DD2-9DC0-49E5-BC85-1543EA199477"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcn9012:-:*:*:*:*:*:*:*","matchCriteriaId":"1A06879F-6FE9-448A-8186-8347D76F872B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs2290_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"93CDB7BC-89F2-4482-B8E3-9DDBD918C851"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs2290:-:*:*:*:*:*:*:*","matchCriteriaId":"76E03AE9-2485-449B-BCFD-3E452BB01FC6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs4290_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"06789CB9-E6FA-400D-90B6-C2DB6C8EF153"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs4290:-:*:*:*:*:*:*:*","matchCriteriaId":"FFCB9F22-57F2-4327-95B9-B2342A02E45E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs4490_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3336CDD7-9E7B-4FFB-A5CE-594B19B63A6C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs4490:-:*:*:*:*:*:*:*","matchCriteriaId":"1197E229-1E27-4CA3-A386-B77FAE5DFE1A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs6690_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F8AD50C4-E725-48B8-8291-A62EF153D50A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs6690:-:*:*:*:*:*:*:*","matchCriteriaId":"4B5A7BC1-E4B1-486C-A433-D206A42A1356"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs8550_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FFF23DDB-98A0-4343-ADD3-5AB9C2383E7E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs8550:-:*:*:*:*:*:*:*","matchCriteriaId":"5ACB8AFB-5B91-4AA1-BA3A-1AF0B3503080"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qln1083bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FD70F234-1EE7-4362-97F6-5AEDB7078D03"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qln1083bd:-:*:*:*:*:*:*:*","matchCriteriaId":"C569A848-B70C-42EF-B6D5-4A86547586EE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qln1086bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F218DF06-C40A-4738-ABB5-A3FA2243EF84"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qln1086bd:-:*:*:*:*:*:*:*","matchCriteriaId":"2E2A0CD0-66FA-45D6-BBC7-03641203EC73"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qmp1000_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5298473D-8B34-42E6-BC32-69A3800972B4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qmp1000:-:*:*:*:*:*:*:*","matchCriteriaId":"2A1CF44E-FFC2-4DCB-8DC2-46422D912448"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qmp2001_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0B53AF78-37B0-4D64-A7D3-1729D0248D61"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qmp2001:-:*:*:*:*:*:*:*","matchCriteriaId":"560E36D2-27DB-4590-A879-C2071ED72641"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qna715_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7B3FD468-BE2F-4C80-843B-7EC3845F6923"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qna715:-:*:*:*:*:*:*:*","matchCriteriaId":"342A6C3B-5128-40C5-BB3B-151D5B6C7BDA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qpa1083bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B0208F7B-A959-485E-B004-A34CB7C7C4C9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qpa1083bd:-:*:*:*:*:*:*:*","matchCriteriaId":"FBDAC812-4603-4D24-A861-23825E32D44E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qpa1086bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7F6DEF72-A8FF-4B67-AA6C-5CB4AA7B35E1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qpa1086bd:-:*:*:*:*:*:*:*","matchCriteriaId":"00EF6875-B088-40BD-A526-C962789CDC5A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_8800_mobile_connectivity_system_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"28C65092-164F-40B7-8DCF-0F72F19C1CC3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_8800_mobile_connectivity_system:-:*:*:*:*:*:*:*","matchCriteriaId":"C3813BD8-2228-414D-BB2B-E3C00210404A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:video_collaboration_vc1_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C3607443-848D-4334-B5E4-0DC27F28509B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:video_collaboration_vc1_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"2E8F00DD-C894-4236-8932-7F7FCD15D2A5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:video_collaboration_vc3_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DD4946C6-778F-4542-AB77-C9B86AF25C05"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:video_collaboration_vc3_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"6F1D604A-4530-42B3-80A0-58A82D658DDD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:video_collaboration_vc5_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"87CF9AD4-6E1B-47E8-B441-022A03858875"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:video_collaboration_vc5_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"791C1E60-162D-4881-80D5-895658FEC47E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1083_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0CE74B89-5E3F-428E-8000-E3452B8B6953"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1083:-:*:*:*:*:*:*:*","matchCriteriaId":"DC11B7A6-E621-463D-B861-6B203EADFA57"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1086_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E48759CC-B751-4466-87DF-2D0AB220C0FB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1086:-:*:*:*:*:*:*:*","matchCriteriaId":"E7F1C9D2-6616-4F74-85C2-1850B5C3F6BC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1093_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9A46B609-BD06-4BB7-B055-1F71C555E93D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1093:-:*:*:*:*:*:*:*","matchCriteriaId":"59598462-1E53-4F6D-BAB5-06ACEDF6CD9F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8830_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"11B69595-E488-4590-A150-CE5BE08B5E13"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8830:-:*:*:*:*:*:*:*","matchCriteriaId":"BF680174-5FA6-47D9-8EAB-CC2A37A7BD42"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8832_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7ACAD26E-B79E-4659-91A5-D301281F7D36"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8832:-:*:*:*:*:*:*:*","matchCriteriaId":"F0E46DA6-9494-4D92-A4AE-A272AF6ACCCC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F80BC68E-7476-4A40-9F48-53722FE9A5BF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8835:-:*:*:*:*:*:*:*","matchCriteriaId":"6B36F4B2-BAA3-45AD-9967-0EB482C99708"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8840_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA33DE15-C177-43B3-AD50-FF797753D12E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8840:-:*:*:*:*:*:*:*","matchCriteriaId":"AE1A5841-5BCB-4033-ACB9-23F3FCA65309"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8845_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5B47BF35-3AA0-4667-842E-19B0FE30BF3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8845:-:*:*:*:*:*:*:*","matchCriteriaId":"8A071672-9405-4418-9141-35CEADBB65AF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8845h_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB7CF473-8B25-4851-91F2-1BD693CCDC85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8845h:-:*:*:*:*:*:*:*","matchCriteriaId":"91E591F2-8F72-4A5A-9264-2742EB2DABDA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8850_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FA243934-7BFA-47AA-B78C-CCB25377E471"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8850:-:*:*:*:*:*:*:*","matchCriteriaId":"2FD65035-4D20-48D5-874E-47CD9C7A985C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8850w_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22707187-A56D-48AD-800F-A438FD844546"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8850w:-:*:*:*:*:*:*:*","matchCriteriaId":"F526A54A-F974-4D0A-A1A6-FABBB6711CD0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8855c_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"671E0B82-5D58-4644-8806-7F4CAFFB6641"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8855c:-:*:*:*:*:*:*:*","matchCriteriaId":"CC066321-B3CC-4E88-BFA9-414B8D095207"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:x1e80100_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42F453E4-02CC-4E48-A25B-F1394069F524"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:x1e80100:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6671AE-3490-4D85-A20C-3DA26F7D7AEB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:xrv7209_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CC6C6243-E092-4903-BC20-E3B0CECBC790"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:xrv7209:-:*:*:*:*:*:*:*","matchCriteriaId":"AAA33761-D61C-4A81-B233-5E2D50F3596F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:xrv9209_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D693483-72F9-42B1-8EDA-8DABD537F428"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:xrv9209:-:*:*:*:*:*:*:*","matchCriteriaId":"43F4A7D9-055D-475B-BFE4-61A86C7397F8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8635_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"65865EE9-59C0-498F-A4C5-EC00D4642603"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8635:-:*:*:*:*:*:*:*","matchCriteriaId":"CE02AB51-6FB6-4727-999B-A7466CEDC534"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8635p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"88F63D90-4BFC-4EFA-8B74-7A5027A7052D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8635p:-:*:*:*:*:*:*:*","matchCriteriaId":"20EB529B-6B9F-464F-A98B-A8ABE0F01ADB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8650q_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1CAA8D9D-0238-4223-8F7B-134ECBB6FA05"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8650q:-:*:*:*:*:*:*:*","matchCriteriaId":"D8A722B8-E1E4-43B4-8882-591CE8C5C166"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8735p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B24D04FB-6823-452C-8F0D-0088E9B402EC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8735p:-:*:*:*:*:*:*:*","matchCriteriaId":"B9CCD62E-F9D1-4CF9-9595-3BF28DED89AC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8750p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4D8ABDBF-BABC-4219-8A18-BDFC8C826B1F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8750p:-:*:*:*:*:*:*:*","matchCriteriaId":"685D81D0-7E95-4DBA-A05B-7C708A5DFDF0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8845p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A205320E-6C60-4F6A-90D5-06CABAF0FDEA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8845p:-:*:*:*:*:*:*:*","matchCriteriaId":"0FB8CE86-605E-4B3D-82E5-A55093ABCE5F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8950_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"09662E75-32BB-4D24-8A81-B743FF0DE323"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8950:-:*:*:*:*:*:*:*","matchCriteriaId":"8D44C02D-3FCA-4885-A1B5-7C2836B1233B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8950p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D5350DB-39BD-4BF4-87AB-5FD6DECB25D3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8950p:-:*:*:*:*:*:*:*","matchCriteriaId":"0AE6E7D9-E7E8-490E-B801-D97F522CA0FA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8975_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42D47A7D-A79C-4EA0-AEDF-533F4F9933B9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8975:-:*:*:*:*:*:*:*","matchCriteriaId":"1CC31B0D-3890-442E-87BE-47E58A0F6537"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8975p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"73D04C5D-A3A8-45A3-A83E-03DF5EF400C2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8975p:-:*:*:*:*:*:*:*","matchCriteriaId":"A67DF502-A50C-4E7E-B457-F46B7149B85C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:smart_audio_400_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"57B0086F-5F2C-4F89-AC53-D8429D6506CD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:smart_audio_400_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"FB8145C8-D978-4047-9203-602E854E7290"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_4_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2CCBF666-CB4E-44E1-9676-6891EDC73578"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_4_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"C767AB6A-1A8C-406C-A600-96A816F44E2F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_4_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"55AECCCF-0761-46B6-B669-E73096679AFB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_4_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"7DE87CA2-160A-43BF-AC18-DA788501B5B4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_460_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"390D7CAF-6C0B-4438-AA7D-AEEE127F4D3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_460_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"5BB1FC5E-CF6F-4E54-B78D-C01AFD034903"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_480_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA3F11F3-C9F4-460D-BD77-1BFBCC1F0592"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_480_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"25673A10-D99C-4F67-BDA7-9C2E4A70EF9C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_480\\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"50906EF2-01F7-4E97-9F49-F892DF41CB29"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_480\\+_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"B23A89FF-9C94-40C6-B9B7-3E8354777916"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_6_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EBB3BC1B-2EBC-457C-AE91-6BD408EB7D5F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_6_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"0870CC30-07F8-4FFF-85B4-FBACE947CC14"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_6_gen_3_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D69E4203-EA20-4D6F-BD1C-C8E550588F87"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_6_gen_3_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"C1225010-5A08-4D13-A3E2-4C57C4265605"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_6_gen_4_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"20ABA235-1380-4D76-A248-36A6E905AEB2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_6_gen_4_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"923775B3-1916-4E60-A888-574AB3F3E282"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_680_4g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8D0ED00F-1345-43AD-83C6-E979890B84AB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_680_4g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"92C28019-B57D-4487-B551-F7B53395C6E5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_685_4g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C174F07D-0E33-43FD-9BAD-6C6D8B51B6A6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_685_4g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"47311B68-A07F-448B-99D5-9C92C8127A81"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_695_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A9A2DA11-5E4E-4E36-923C-A2D3CC2F2751"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_695_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"BE7DFAD4-1D21-4A3A-9E8C-10F00AD7C403"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"677D5A3F-2A0D-48F0-A1C5-B067BADFD11A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"CB79B015-A401-4FAD-8818-1475653C2B12"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7_gen_4_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"48BB1413-6719-4026-9154-0AF3BA32C26B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7_gen_4_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"97851334-202F-4695-A4B2-6D0B221D6E23"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7\\+_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C8E41CBD-D6AD-41CF-A469-92A7E228BBB6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7\\+_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"57E0BA08-3BF4-4E84-BBA9-B48F84197F9D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_778g_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"87ECCB82-B880-412D-A635-CA6F0B035F2B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_778g_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"424743C4-CE74-4A02-835A-023C9DA0CFAC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_778g\\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14EA48BF-BD65-43B2-8DC1-D97F75AD6FE5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_778g\\+_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"B86E317F-12BF-42F6-879B-88A85F7E3F81"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_782g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"194A4BD4-0DDF-49E5-AA89-40A5BFB71933"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_782g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"72FF9732-40D8-4C12-8259-BAA16FAB5A56"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7c\\+_gen_3_compute_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C4A050CA-8514-400A-A6B3-F513CC93CA14"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7c\\+_gen_3_compute:-:*:*:*:*:*:*:*","matchCriteriaId":"BD850305-1E76-4952-A3FB-F6229CBF7FE9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7s_gen_3_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BBD338C6-F731-4B5D-9DE1-32259A23FBC2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7s_gen_3_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"3AB83DA5-30ED-44E8-8517-1988B2D1EC6B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_elite_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EA50192-07B0-4404-93D4-EC4F3B1918B7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_elite:-:*:*:*:*:*:*:*","matchCriteriaId":"26C7FC48-08CB-4E50-B8D3-8AF30549FDF8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_elite_gen_5_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"41070BDB-15E4-4DD7-A132-A14AA24978E5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_elite_gen_5:-:*:*:*:*:*:*:*","matchCriteriaId":"102460A6-9637-4883-9230-2CC888D5D74E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EB8FA32F-4690-4C5B-8968-474DA32FD0A4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"59BD8BEA-725A-4158-84BE-4AFD476ED03D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"60F5899C-BA8D-4B6B-BC61-F77B1EB64739"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"D39AD7CE-A017-4D74-A348-9E4B08363799"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen_3_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0FAB6D60-1C03-4F85-B874-FF169402ED09"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen_3_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"C89A8D93-46DA-4547-A9F1-076FC0D5119D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen_5_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4D8D8AD-B291-4AEC-8817-D7C99E79FF49"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen_5:-:*:*:*:*:*:*:*","matchCriteriaId":"8CA08EA8-A47E-4797-8644-0A48D509939C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8\\+_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"59CB6F2F-7C95-498B-9F9E-728930FD24A7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8\\+_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"284E62AF-2E4D-4E82-AC9A-F27DA71735EF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8\\+_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1FEDF458-DEA7-42A1-A56D-E11250139545"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8\\+_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"D5693438-0F20-47BB-BA32-7175C3152368"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_888_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22A78236-5965-4F65-9001-3FE7FF6D27E8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_888_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"414C5C1D-A5DA-47C7-B6C9-3564DD4DD911"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_888\\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"01CBD543-635C-4C57-87B7-55DD3BA3C1A2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_888\\+_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"6A7272B6-AADB-4CCD-B041-66170C313C76"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_ar1_gen_1_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"53E5BBDA-C07D-42E2-9A34-EC1F6454CAA4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_ar1_gen_1_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"0BB2408F-C768-4DD2-B834-B62E188D6CC2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_ar1\\+_gen_1_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BE30A5E0-10D5-4679-ACA6-4ED991335A6F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_ar1\\+_gen_1_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"CFA75B74-D20D-4C8B-BFA2-5DE4848410CD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_ride_elite_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4E50C2D-229B-4B78-8567-CD603DE2A767"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_ride_elite:-:*:*:*:*:*:*:*","matchCriteriaId":"6C5ECF68-EB2E-46B5-AEC3-0744D4C9215A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_w5\\+_gen_1_wearable_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0C455E7D-D256-4240-BE72-2A93273D685A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_w5\\+_gen_1_wearable_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"423E21A1-8F52-46DA-9AC2-77159FEB6001"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_x53_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4F80E77B-B207-4E49-99EF-A1F9ECFAAC99"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_x53_5g_modem-rf_system:-:*:*:*:*:*:*:*","matchCriteriaId":"9A12A6DC-63A2-4B52-971A-C014E40C1E6D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_cockpit_elite_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D4E05762-315D-46A9-93DB-435DB78FEE71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_cockpit_elite:-:*:*:*:*:*:*:*","matchCriteriaId":"5028FDF9-6852-4C88-97D8-CE6392960A55"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_reality_elite_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"08ACBE23-DBE3-4AE0-B9EA-F3A73290D5F0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_reality_elite_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"3F82A885-4CAB-44F2-85FA-3D581283A936"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_wear_elite_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"21C295D3-AC5D-4DFC-A0B1-3B5F7C08DC46"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_wear_elite_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"A32D44E3-02FC-47AA-B6FF-E87F5866E453"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:srv1h_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0CD199F5-DA68-4BEB-AA99-11572DA26B4F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:srv1h:-:*:*:*:*:*:*:*","matchCriteriaId":"8ACA2D4D-FC77-4C1A-8278-1C27B3EA3303"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:srv1m_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4B29E7F-8BFE-466A-B357-63F8A2160C4E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:srv1m:-:*:*:*:*:*:*:*","matchCriteriaId":"6D55CC7D-2E65-4CA9-9892-B6FBCC087E6F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sw-only_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"52433CDD-4776-41C7-96BA-D9EB12934C06"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sw-only:-:*:*:*:*:*:*:*","matchCriteriaId":"A996EBB2-BE81-41AD-8164-21A741FD2793"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sw5100_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AA1BF9BB-AF11-46A7-A71C-F7D289E76E3F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sw5100:-:*:*:*:*:*:*:*","matchCriteriaId":"7B8455D6-287D-4934-8E4D-F4127A9C0449"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sw5100p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DB599A9F-0305-4FE4-8623-0F86630FEDCB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sw5100p:-:*:*:*:*:*:*:*","matchCriteriaId":"EEB883BF-68B2-4C25-84DC-5DA953BFAA2F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sxr2230p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD6444F6-A477-4B4C-8A09-C22C47CCE45B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sxr2230p:-:*:*:*:*:*:*:*","matchCriteriaId":"F3E20681-4FC4-46E2-AF77-BCF03BC8E77E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sxr2250p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"68A93ED1-F509-439E-AE7B-F0EC87AE759F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sxr2250p:-:*:*:*:*:*:*:*","matchCriteriaId":"FB5E2A98-EDD0-4298-911D-EC7527D5A424"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:themisto_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"55DE7B27-56A2-4046-9E03-8215587C8827"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:themisto:-:*:*:*:*:*:*:*","matchCriteriaId":"0853EA22-4EFD-4037-8B83-CB7C18417D23"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9335_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"28717583-463A-468A-8073-ECF0F90585F6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9335:-:*:*:*:*:*:*:*","matchCriteriaId":"4D1A7188-7D5D-4D46-AEAB-08BA84FFF539"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9370_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1295D869-F4DD-4766-B4AA-3513752F43B4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9370:-:*:*:*:*:*:*:*","matchCriteriaId":"B98784DC-3143-4D38-AD28-DBBDCCAB4272"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9371_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2503805B-B2A6-4AEE-8AB1-2B8A040702BD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9371:-:*:*:*:*:*:*:*","matchCriteriaId":"D3AD370C-2ED0-43CF-83D9-50DC92A01CA5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9375_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"34143ABA-7D09-429F-A65C-3A33438BF62C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9375:-:*:*:*:*:*:*:*","matchCriteriaId":"9D56DFE3-5EF1-4B23-BBD5-0203FBF9CCEC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9378_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4CFDBB5B-0A4F-4032-874F-D2A7EF933FB0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9378:-:*:*:*:*:*:*:*","matchCriteriaId":"D28A12D6-CC60-4BE9-ADEE-FAB58B05440F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"70292B01-617F-44AD-AF77-1AFC1450523D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9380:-:*:*:*:*:*:*:*","matchCriteriaId":"FA94C6D6-85DB-4031-AAF4-C399019AE16D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"92B17201-8185-47F1-9720-5AB4ECD11B22"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9385:-:*:*:*:*:*:*:*","matchCriteriaId":"E1FA2EB9-416F-4D69-8786-386CC73978AE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9390_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"896F1C04-9957-440F-BF01-C3772CC3B3DF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9390:-:*:*:*:*:*:*:*","matchCriteriaId":"A90555EB-47A7-4717-92D5-35B561825F06"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9395_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"699056F6-1517-4F25-AE07-4FFCF6923B9F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9395:-:*:*:*:*:*:*:*","matchCriteriaId":"E4C023D2-6FF5-4FFC-B9F2-895979166580"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3910_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9F0D7B24-D567-479A-B4F1-595FAA053418"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3910:-:*:*:*:*:*:*:*","matchCriteriaId":"33A8FAA1-F824-4561-9CCC-7F0DF12F740F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3950_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3FEF2DB6-00F5-4B07-953B-EF58B31267F1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3950:-:*:*:*:*:*:*:*","matchCriteriaId":"120E8F0F-EBEB-4565-9927-2D473F783EF7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3980_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9C6E9038-9B18-4958-BE1E-215901C9B4B2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3980:-:*:*:*:*:*:*:*","matchCriteriaId":"B36D3274-F8D0-49C5-A6D5-95F5DC6D1950"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4BFB25F-013B-48E3-99FF-3E8687F94423"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3988:-:*:*:*:*:*:*:*","matchCriteriaId":"BF676C5B-838B-446C-A689-6A25AB8A87E2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn6450_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1FAFC9FA-E6EF-44C5-BD50-2824C7711541"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn6450:-:*:*:*:*:*:*:*","matchCriteriaId":"6F895CDD-F9BB-45AD-AE60-71F4549114A4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn6650_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"93398092-AF7C-4F04-874C-7E5B4CF7AB00"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn6650:-:*:*:*:*:*:*:*","matchCriteriaId":"7D242084-5844-4E43-8D7F-D2F8E3521F0C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn6755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2BC386D9-3D2B-40FA-A2D9-199BB138F46A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn6755:-:*:*:*:*:*:*:*","matchCriteriaId":"133FFD9F-FA09-4801-939B-AD1D507BE5FE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7760_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"506C6CE1-6BDF-4542-82C1-820D10D8181A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7760:-:*:*:*:*:*:*:*","matchCriteriaId":"72F8CE3B-2BDC-40B1-BB04-A3A7E25B8096"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7860_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2EB8794F-7998-424E-AF68-E4A4F9310F65"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7860:-:*:*:*:*:*:*:*","matchCriteriaId":"799D69CE-3FCC-4B19-8B00-9AF38111D983"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7861_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"57608D47-894C-4895-B4B3-4733D55D57DB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7861:-:*:*:*:*:*:*:*","matchCriteriaId":"2FFD2C38-1A61-4BED-ABFA-DAE0C4B78620"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7880_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"63735D33-9F09-4841-9FE0-0D9AB604BECF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7880:-:*:*:*:*:*:*:*","matchCriteriaId":"E826F765-4C2E-4319-BBC4-DEB02AAD783F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D765C392-5F38-4E6A-9E88-59629E7A6911"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7881:-:*:*:*:*:*:*:*","matchCriteriaId":"FAE8F4F9-F692-4EC0-A3FE-2CDD681DCBFD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn8841_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C7A02129-BB8C-43F1-BFC1-3632BA299AB6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn8841:-:*:*:*:*:*:*:*","matchCriteriaId":"4082B1D2-9CBD-48FE-93EF-C069A4B6A466"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8810_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"15307882-7039-43E9-9BA3-035045988B99"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8810:-:*:*:*:*:*:*:*","matchCriteriaId":"AA85B322-E593-4499-829A-CC6D70BAE884"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E839A0B9-64C3-4C7A-82B7-D2AAF65928F8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8815:-:*:*:*:*:*:*:*","matchCriteriaId":"7E870D82-DE3B-4199-A730-C8FB545BAA98"}]}]}],"references":[{"url":"https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2026-bulletin.html","source":"product-security@qualcomm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-57546","sourceIdentifier":"product-security@qualcomm.com","published":"2026-10-06T07:16:58.630","lastModified":"2026-10-09T14:12:27.940","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Transient DOS when processing a continuous receive command with a zero-sized global configuration override."}],"affected":[{"source":"product-security@qualcomm.com","affectedData":[{"vendor":"Qualcomm, Inc.","product":"Snapdragon","defaultStatus":"unaffected","platforms":["Snapdragon MC"],"versions":[{"version":"Congo","status":"affected"},{"version":"Qualcomm FastConnect 8800 Mobile Connectivity System","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"product-security@qualcomm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T12:04:20.003239Z","id":"CVE-2026-57546","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"product-security@qualcomm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-126"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:congo_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4DA1D059-7672-40F5-BB2E-3072475666A0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:congo:-:*:*:*:*:*:*:*","matchCriteriaId":"48C84939-F83F-4E79-902C-32B77C4A4BBB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_7800_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B3053D68-C5D8-4D47-A4F0-9F3AF2289E1D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_7800:-:*:*:*:*:*:*:*","matchCriteriaId":"638DBC7F-456F-487D-BED2-2214DFF8BEE2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:orne_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"19FB8345-BBFC-4E18-A4E6-64A159D7F65B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:orne:-:*:*:*:*:*:*:*","matchCriteriaId":"FFDA4056-3F1B-4F3A-BE59-1908BD3DE5E9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:pandeiro_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F8EF0C-BB48-47E1-A045-254D79388F75"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:pandeiro:-:*:*:*:*:*:*:*","matchCriteriaId":"058950FC-ED72-4E91-AE13-87E738ADC083"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_8800_mobile_connectivity_system_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"28C65092-164F-40B7-8DCF-0F72F19C1CC3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_8800_mobile_connectivity_system:-:*:*:*:*:*:*:*","matchCriteriaId":"C3813BD8-2228-414D-BB2B-E3C00210404A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8950_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"09662E75-32BB-4D24-8A81-B743FF0DE323"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8950:-:*:*:*:*:*:*:*","matchCriteriaId":"8D44C02D-3FCA-4885-A1B5-7C2836B1233B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8950p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D5350DB-39BD-4BF4-87AB-5FD6DECB25D3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8950p:-:*:*:*:*:*:*:*","matchCriteriaId":"0AE6E7D9-E7E8-490E-B801-D97F522CA0FA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8975_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42D47A7D-A79C-4EA0-AEDF-533F4F9933B9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8975:-:*:*:*:*:*:*:*","matchCriteriaId":"1CC31B0D-3890-442E-87BE-47E58A0F6537"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8975p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"73D04C5D-A3A8-45A3-A83E-03DF5EF400C2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8975p:-:*:*:*:*:*:*:*","matchCriteriaId":"A67DF502-A50C-4E7E-B457-F46B7149B85C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9378_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4CFDBB5B-0A4F-4032-874F-D2A7EF933FB0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9378:-:*:*:*:*:*:*:*","matchCriteriaId":"D28A12D6-CC60-4BE9-ADEE-FAB58B05440F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9395_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"699056F6-1517-4F25-AE07-4FFCF6923B9F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9395:-:*:*:*:*:*:*:*","matchCriteriaId":"E4C023D2-6FF5-4FFC-B9F2-895979166580"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7880_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"63735D33-9F09-4841-9FE0-0D9AB604BECF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7880:-:*:*:*:*:*:*:*","matchCriteriaId":"E826F765-4C2E-4319-BBC4-DEB02AAD783F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D765C392-5F38-4E6A-9E88-59629E7A6911"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7881:-:*:*:*:*:*:*:*","matchCriteriaId":"FAE8F4F9-F692-4EC0-A3FE-2CDD681DCBFD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn8841_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C7A02129-BB8C-43F1-BFC1-3632BA299AB6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn8841:-:*:*:*:*:*:*:*","matchCriteriaId":"4082B1D2-9CBD-48FE-93EF-C069A4B6A466"}]}]}],"references":[{"url":"https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2026-bulletin.html","source":"product-security@qualcomm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-57554","sourceIdentifier":"product-security@qualcomm.com","published":"2026-10-06T07:16:58.760","lastModified":"2026-10-09T14:12:38.403","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations."}],"affected":[{"source":"product-security@qualcomm.com","affectedData":[{"vendor":"Qualcomm, Inc.","product":"Snapdragon","defaultStatus":"unaffected","platforms":["Snapdragon Auto","Snapdragon CCW","Snapdragon Compute","Snapdragon Connectivity","Snapdragon Consumer IOT","Snapdragon Industrial IOT","Snapdragon Mobile","Snapdragon WBC","Snapdragon Wearables"],"versions":[{"version":"AR8035","status":"affected"},{"version":"CSRA6620","status":"affected"},{"version":"CSRA6640","status":"affected"},{"version":"FastConnect 6200","status":"affected"},{"version":"FastConnect 6700","status":"affected"},{"version":"FastConnect 6900","status":"affected"},{"version":"FastConnect 7800","status":"affected"},{"version":"FWA Gen 3 Ultra Platform","status":"affected"},{"version":"G1 Gen 1","status":"affected"},{"version":"IQ10 Series","status":"affected"},{"version":"Kalpeni","status":"affected"},{"version":"LeMans_AU_LGIT","status":"affected"},{"version":"LeMansAU","status":"affected"},{"version":"MBM415","status":"affected"},{"version":"MBM715","status":"affected"},{"version":"MDM9250","status":"affected"},{"version":"MDM9628","status":"affected"},{"version":"Milos","status":"affected"},{"version":"Orne","status":"affected"},{"version":"Palawan25","status":"affected"},{"version":"QAM8255P","status":"affected"},{"version":"QAM8295P","status":"affected"},{"version":"QAM8620P","status":"affected"},{"version":"QAMSRV1H","status":"affected"},{"version":"QAMSRV1M","status":"affected"},{"version":"QCA6174A","status":"affected"},{"version":"QCA6391","status":"affected"},{"version":"QCA6564A","status":"affected"},{"version":"QCA6564AU","status":"affected"},{"version":"QCA6574","status":"affected"},{"version":"QCA6574A","status":"affected"},{"version":"QCA6574AU","status":"affected"},{"version":"QCA6584AU","status":"affected"},{"version":"QCA6595","status":"affected"},{"version":"QCA6595AU","status":"affected"},{"version":"QCA6678AQ","status":"affected"},{"version":"QCA6688AQ","status":"affected"},{"version":"QCA6696","status":"affected"},{"version":"QCA6698AQ","status":"affected"},{"version":"QCA6698AU","status":"affected"},{"version":"QCA6797AQ","status":"affected"},{"version":"QCA8081","status":"affected"},{"version":"QCA8337","status":"affected"},{"version":"QCA8695AU","status":"affected"},{"version":"QCA9377","status":"affected"},{"version":"QCC710","status":"affected"},{"version":"QCM2290","status":"affected"},{"version":"QCM4290","status":"affected"},{"version":"QCM4325","status":"affected"},{"version":"QCM5430","status":"affected"},{"version":"QCM6125","status":"affected"},{"version":"QCM6490","status":"affected"},{"version":"QCM6650","status":"affected"},{"version":"QCM8550","status":"affected"},{"version":"QCM8838","status":"affected"},{"version":"QCN6024","status":"affected"},{"version":"QCN6224","status":"affected"},{"version":"QCN6274","status":"affected"},{"version":"QCN9011","status":"affected"},{"version":"QCN9012","status":"affected"},{"version":"QCN9024","status":"affected"},{"version":"QCS2290","status":"affected"},{"version":"QCS410","status":"affected"},{"version":"QCS4290","status":"affected"},{"version":"QCS8550","status":"affected"},{"version":"QDU1000","status":"affected"},{"version":"QDU1110","status":"affected"},{"version":"QDU1210","status":"affected"},{"version":"QDX1010","status":"affected"},{"version":"QDX1011","status":"affected"},{"version":"QEP8111","status":"affected"},{"version":"QFW7114","status":"affected"},{"version":"QFW7124","status":"affected"},{"version":"QMP1000","status":"affected"},{"version":"QRB5165N","status":"affected"},{"version":"QRU1032","status":"affected"},{"version":"QSM8350","status":"affected"},{"version":"Qualcomm Dragonwing Q-6690","status":"affected"},{"version":"Qualcomm Dragonwing QCM4490","status":"affected"},{"version":"Qualcomm Dragonwing QRB5165","status":"affected"},{"version":"Qualcomm Dragonwing QRU100 Platform","status":"affected"},{"version":"Qualcomm Dragonwing X100 Accelerator Card","status":"affected"},{"version":"Qualcomm Video Collaboration VC1 Platform","status":"affected"},{"version":"Qualcomm Video Collaboration VC3 Platform","status":"affected"},{"version":"Qualcomm Video Collaboration VC5 Platform","status":"affected"},{"version":"QXM1083","status":"affected"},{"version":"QXM1086","status":"affected"},{"version":"Robotics RB2 Platform","status":"affected"},{"version":"Robotics RB5 Platform","status":"affected"},{"version":"SA4150P","status":"affected"},{"version":"SA4155P","status":"affected"},{"version":"SA6145P","status":"affected"},{"version":"SA6150P","status":"affected"},{"version":"SA6155P","status":"affected"},{"version":"SA7255P","status":"affected"},{"version":"SA7775P","status":"affected"},{"version":"SA8145P","status":"affected"},{"version":"SA8150P","status":"affected"},{"version":"SA8155P","status":"affected"},{"version":"SA8195P","status":"affected"},{"version":"SA8255P","status":"affected"},{"version":"SA8295P","status":"affected"},{"version":"SA8530P","status":"affected"},{"version":"SA8540P","status":"affected"},{"version":"SA8620P","status":"affected"},{"version":"SA8770P","status":"affected"},{"version":"SA9000P","status":"affected"},{"version":"SAR1165P","status":"affected"},{"version":"SAR2130P","status":"affected"},{"version":"SD 8 Gen1 5G","status":"affected"},{"version":"SD662","status":"affected"},{"version":"SD865 5G","status":"affected"},{"version":"SD888","status":"affected"},{"version":"SDR753","status":"affected"},{"version":"SDX61","status":"affected"},{"version":"SM6225P","status":"affected"},{"version":"SM6370","status":"affected"},{"version":"SM6650P","status":"affected"},{"version":"SM7315","status":"affected"},{"version":"SM7325P","status":"affected"},{"version":"SM7635P","status":"affected"},{"version":"SM7675","status":"affected"},{"version":"SM7675P","status":"affected"},{"version":"SM8550P","status":"affected"},{"version":"SM8635","status":"affected"},{"version":"SM8635P","status":"affected"},{"version":"SM8650Q","status":"affected"},{"version":"SM8750P","status":"affected"},{"version":"Smart Audio 400 Platform","status":"affected"},{"version":"Snapdragon 4 Gen 1 Mobile Platform","status":"affected"},{"version":"Snapdragon 4 Gen 2 Mobile Platform","status":"affected"},{"version":"Snapdragon 460 Mobile Platform","status":"affected"},{"version":"Snapdragon 480 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 480+ 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 6 Gen 4 Mobile Platform","status":"affected"},{"version":"Snapdragon 662 Mobile Platform","status":"affected"},{"version":"Snapdragon 680 4G Mobile Platform","status":"affected"},{"version":"Snapdragon 685 4G Mobile Platform","status":"affected"},{"version":"Snapdragon 695 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 7 Gen 4 Mobile Platform","status":"affected"},{"version":"Snapdragon 778G 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 778G+ 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 780G 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 782G Mobile Platform","status":"affected"},{"version":"Snapdragon 7c+ Gen 3 Compute","status":"affected"},{"version":"Snapdragon 7s Gen 3 Mobile Platform","status":"affected"},{"version":"Snapdragon 8 Elite","status":"affected"},{"version":"Snapdragon 8 Elite Gen 5","status":"affected"},{"version":"Snapdragon 8 Gen 1 Mobile Platform","status":"affected"},{"version":"Snapdragon 8 Gen 2 Mobile Platform","status":"affected"},{"version":"Snapdragon 8 Gen 3 Mobile Platform","status":"affected"},{"version":"Snapdragon 8+ Gen 1 Mobile Platform","status":"affected"},{"version":"Snapdragon 8+ Gen 2 Mobile Platform","status":"affected"},{"version":"Snapdragon 888 5G Mobile Platform","status":"affected"},{"version":"Snapdragon 888+ 5G Mobile Platform","status":"affected"},{"version":"Snapdragon AR1 Gen 1 Platform","status":"affected"},{"version":"Snapdragon AR1+ Gen 1 Platform","status":"affected"},{"version":"Snapdragon Auto 5G Modem-RF","status":"affected"},{"version":"Snapdragon Auto 5G Modem-RF Gen 2","status":"affected"},{"version":"Snapdragon Ride Elite","status":"affected"},{"version":"Snapdragon W5+ Gen 1 Wearable Platform","status":"affected"},{"version":"Snapdragon X12 LTE Modem","status":"affected"},{"version":"Snapdragon X32 5G Modem-RF System","status":"affected"},{"version":"Snapdragon X35 5G Modem-RF System","status":"affected"},{"version":"Snapdragon X53 5G Modem-RF System","status":"affected"},{"version":"Snapdragon X62 5G Modem-RF System","status":"affected"},{"version":"Snapdragon X65 5G Modem-RF System","status":"affected"},{"version":"Snapdragon X72 5G Modem-RF System","status":"affected"},{"version":"Snapdragon X75 5G Modem-RF System","status":"affected"},{"version":"Snapdragon XR2 5G Platform","status":"affected"},{"version":"Snapdragon XR2+ Gen 1 Platform","status":"affected"},{"version":"Snapdragon Cockpit Elite","status":"affected"},{"version":"Snapdragon Reality Elite Platform","status":"affected"},{"version":"SRV1H","status":"affected"},{"version":"SRV1L","status":"affected"},{"version":"SRV1M","status":"affected"},{"version":"SSG2115P","status":"affected"},{"version":"SSG2125P","status":"affected"},{"version":"SW5100","status":"affected"},{"version":"SW5100P","status":"affected"},{"version":"SXR1230P","status":"affected"},{"version":"SXR2230P","status":"affected"},{"version":"SXR2250P","status":"affected"},{"version":"TalynPlus","status":"affected"},{"version":"Vision Intelligence 400 Platform","status":"affected"},{"version":"WCD9335","status":"affected"},{"version":"WCD9340","status":"affected"},{"version":"WCD9341","status":"affected"},{"version":"WCD9370","status":"affected"},{"version":"WCD9375","status":"affected"},{"version":"WCD9378","status":"affected"},{"version":"WCD9380","status":"affected"},{"version":"WCD9385","status":"affected"},{"version":"WCD9390","status":"affected"},{"version":"WCD9395","status":"affected"},{"version":"WCN3910","status":"affected"},{"version":"WCN3950","status":"affected"},{"version":"WCN3980","status":"affected"},{"version":"WCN3988","status":"affected"},{"version":"WCN3990","status":"affected"},{"version":"WCN6450","status":"affected"},{"version":"WCN6650","status":"affected"},{"version":"WCN6740","status":"affected"},{"version":"WCN6755","status":"affected"},{"version":"WCN7860","status":"affected"},{"version":"WCN7861","status":"affected"},{"version":"WCN7880","status":"affected"},{"version":"WCN7881","status":"affected"},{"version":"WSA8810","status":"affected"},{"version":"WSA8815","status":"affected"},{"version":"WSA8830","status":"affected"},{"version":"WSA8832","status":"affected"},{"version":"WSA8835","status":"affected"},{"version":"WSA8840","status":"affected"},{"version":"WSA8845","status":"affected"},{"version":"WSA8845H","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"product-security@qualcomm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T12:02:29.946012Z","id":"CVE-2026-57554","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"product-security@qualcomm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_g1_gen_2_gaming_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"905C9267-C1B5-4A77-BC33-118986A907C7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_g1_gen_2_gaming_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"671C9107-7E54-4FBC-B03D-1EB4DCD8597E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:ar8031_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FCE1ADA9-8042-4CDE-A2B9-E96665CB41BE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:ar8031:-:*:*:*:*:*:*:*","matchCriteriaId":"BB1DE046-DD70-4ACA-9DF4-59939DAC1889"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:ar8035_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C88B9C86-2E8E-4DCE-A30C-02977CC00F00"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:ar8035:-:*:*:*:*:*:*:*","matchCriteriaId":"EE473A5A-5CFC-4F08-A173-30717F8BD0D7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:csra6620_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FA42F2EA-5D00-42B8-B020-C27675B72915"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:csra6620:-:*:*:*:*:*:*:*","matchCriteriaId":"BFCF207D-B8C8-4860-89C7-673C821F0237"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:csra6640_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A8A35ECF-B12E-42DE-A74B-2C3BE03639A4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:csra6640:-:*:*:*:*:*:*:*","matchCriteriaId":"65B283D6-B2D2-49B6-98A8-08EDB54C1F15"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7435p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"55C65D26-71D7-4840-B8B1-7C5EC69EB320"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7435p:-:*:*:*:*:*:*:*","matchCriteriaId":"B322FB35-2415-45EA-A350-746AFF734ACD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7525_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2410FF59-E0C0-4920-9656-C398DB06DEAE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7525:-:*:*:*:*:*:*:*","matchCriteriaId":"7D2B800C-4DBC-4028-875D-667C87D75247"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7550_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EEA5CE41-0596-4D38-9891-D1DF711EA7E9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7550:-:*:*:*:*:*:*:*","matchCriteriaId":"E1A901C6-FB73-4361-B391-4A4AF8C70029"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7550p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5C5D7E2C-0955-4B6E-96E4-CFA06D937492"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7550p:-:*:*:*:*:*:*:*","matchCriteriaId":"9D1D0F33-AD5A-4826-9A06-EAD2A8709974"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7635p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3A72DAA5-E10F-40A0-A8CC-541594A3279F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7635p:-:*:*:*:*:*:*:*","matchCriteriaId":"15CC657A-7623-4F37-AC52-8AF5C83D5BDA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7675_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"012C20A8-3F48-48DD-9A77-65C9CB1F6C30"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7675:-:*:*:*:*:*:*:*","matchCriteriaId":"EE992A86-36BC-40E3-8E96-6542560BE8EC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7675p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3B46F132-4049-40D0-8351-C1C6FD2B47A0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7675p:-:*:*:*:*:*:*:*","matchCriteriaId":"1846514C-1F95-4568-98DE-C57214401841"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7750p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B8A511E-B43B-4617-A3B3-03F4EE80CA1D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7750p:-:*:*:*:*:*:*:*","matchCriteriaId":"BAE215A4-3860-45B1-BDFC-B614692F7905"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8475p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8DBF6AE8-605B-4E72-BD3B-0B6C390FCE32"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8475p:-:*:*:*:*:*:*:*","matchCriteriaId":"26AAE148-96B6-4FDE-BABD-48F607464A38"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8550p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C4CDD6A2-5A3C-4572-8CE1-2F102333BB79"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8550p:-:*:*:*:*:*:*:*","matchCriteriaId":"699E5D17-6144-4F0A-8D52-1E8C83990E52"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8635_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"65865EE9-59C0-498F-A4C5-EC00D4642603"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8635:-:*:*:*:*:*:*:*","matchCriteriaId":"CE02AB51-6FB6-4727-999B-A7466CEDC534"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8635p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"88F63D90-4BFC-4EFA-8B74-7A5027A7052D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8635p:-:*:*:*:*:*:*:*","matchCriteriaId":"20EB529B-6B9F-464F-A98B-A8ABE0F01ADB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8650q_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1CAA8D9D-0238-4223-8F7B-134ECBB6FA05"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8650q:-:*:*:*:*:*:*:*","matchCriteriaId":"D8A722B8-E1E4-43B4-8882-591CE8C5C166"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8735p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B24D04FB-6823-452C-8F0D-0088E9B402EC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8735p:-:*:*:*:*:*:*:*","matchCriteriaId":"B9CCD62E-F9D1-4CF9-9595-3BF28DED89AC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm8750p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4D8ABDBF-BABC-4219-8A18-BDFC8C826B1F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm8750p:-:*:*:*:*:*:*:*","matchCriteriaId":"685D81D0-7E95-4DBA-A05B-7C708A5DFDF0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:smart_audio_400_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"57B0086F-5F2C-4F89-AC53-D8429D6506CD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:smart_audio_400_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"FB8145C8-D978-4047-9203-602E854E7290"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_4_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2CCBF666-CB4E-44E1-9676-6891EDC73578"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_4_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"C767AB6A-1A8C-406C-A600-96A816F44E2F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_4_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"55AECCCF-0761-46B6-B669-E73096679AFB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_4_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"7DE87CA2-160A-43BF-AC18-DA788501B5B4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_460_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"390D7CAF-6C0B-4438-AA7D-AEEE127F4D3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_460_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"5BB1FC5E-CF6F-4E54-B78D-C01AFD034903"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_480_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA3F11F3-C9F4-460D-BD77-1BFBCC1F0592"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_480_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"25673A10-D99C-4F67-BDA7-9C2E4A70EF9C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_480\\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"50906EF2-01F7-4E97-9F49-F892DF41CB29"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_480\\+_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"B23A89FF-9C94-40C6-B9B7-3E8354777916"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_6_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EBB3BC1B-2EBC-457C-AE91-6BD408EB7D5F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_6_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"0870CC30-07F8-4FFF-85B4-FBACE947CC14"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_6_gen_3_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D69E4203-EA20-4D6F-BD1C-C8E550588F87"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_6_gen_3_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"C1225010-5A08-4D13-A3E2-4C57C4265605"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_6_gen_4_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"20ABA235-1380-4D76-A248-36A6E905AEB2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_6_gen_4_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"923775B3-1916-4E60-A888-574AB3F3E282"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_680_4g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8D0ED00F-1345-43AD-83C6-E979890B84AB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_680_4g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"92C28019-B57D-4487-B551-F7B53395C6E5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_685_4g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C174F07D-0E33-43FD-9BAD-6C6D8B51B6A6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_685_4g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"47311B68-A07F-448B-99D5-9C92C8127A81"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_695_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A9A2DA11-5E4E-4E36-923C-A2D3CC2F2751"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_695_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"BE7DFAD4-1D21-4A3A-9E8C-10F00AD7C403"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"677D5A3F-2A0D-48F0-A1C5-B067BADFD11A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"CB79B015-A401-4FAD-8818-1475653C2B12"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7_gen_4_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"48BB1413-6719-4026-9154-0AF3BA32C26B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7_gen_4_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"97851334-202F-4695-A4B2-6D0B221D6E23"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7\\+_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C8E41CBD-D6AD-41CF-A469-92A7E228BBB6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7\\+_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"57E0BA08-3BF4-4E84-BBA9-B48F84197F9D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_778g_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"87ECCB82-B880-412D-A635-CA6F0B035F2B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_778g_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"424743C4-CE74-4A02-835A-023C9DA0CFAC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_778g\\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14EA48BF-BD65-43B2-8DC1-D97F75AD6FE5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_778g\\+_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"B86E317F-12BF-42F6-879B-88A85F7E3F81"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_782g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"194A4BD4-0DDF-49E5-AA89-40A5BFB71933"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_782g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"72FF9732-40D8-4C12-8259-BAA16FAB5A56"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7c\\+_gen_3_compute_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C4A050CA-8514-400A-A6B3-F513CC93CA14"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7c\\+_gen_3_compute:-:*:*:*:*:*:*:*","matchCriteriaId":"BD850305-1E76-4952-A3FB-F6229CBF7FE9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_7s_gen_3_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BBD338C6-F731-4B5D-9DE1-32259A23FBC2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_7s_gen_3_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"3AB83DA5-30ED-44E8-8517-1988B2D1EC6B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_elite_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EA50192-07B0-4404-93D4-EC4F3B1918B7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_elite:-:*:*:*:*:*:*:*","matchCriteriaId":"26C7FC48-08CB-4E50-B8D3-8AF30549FDF8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EB8FA32F-4690-4C5B-8968-474DA32FD0A4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"59BD8BEA-725A-4158-84BE-4AFD476ED03D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"60F5899C-BA8D-4B6B-BC61-F77B1EB64739"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"D39AD7CE-A017-4D74-A348-9E4B08363799"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen_3_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0FAB6D60-1C03-4F85-B874-FF169402ED09"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen_3_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"C89A8D93-46DA-4547-A9F1-076FC0D5119D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8\\+_gen_1_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"59CB6F2F-7C95-498B-9F9E-728930FD24A7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8\\+_gen_1_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"284E62AF-2E4D-4E82-AC9A-F27DA71735EF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6200_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CDE1CBDE-3D28-463C-B215-AA7DF373EF09"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6200:-:*:*:*:*:*:*:*","matchCriteriaId":"66BD3B88-7CF9-482D-A2DD-67F6ACF4CC57"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6700_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"82B82E87-F3F4-466F-A76B-C8809121FF6F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6700:-:*:*:*:*:*:*:*","matchCriteriaId":"419A132E-E42C-4395-B74B-788A39DF1D13"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6900_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E670F500-9B71-4BBE-B5DA-221D35803C89"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6900:-:*:*:*:*:*:*:*","matchCriteriaId":"9ADEB5C5-B79A-4F45-B7D3-75945B38DB6C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_7800_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B3053D68-C5D8-4D47-A4F0-9F3AF2289E1D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_7800:-:*:*:*:*:*:*:*","matchCriteriaId":"638DBC7F-456F-487D-BED2-2214DFF8BEE2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fwa_gen_3_ultra_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AEB6D1A6-2CB2-4425-A5A0-EE9A9434C08C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fwa_gen_3_ultra:*:*:*:*:*:*:*:*","matchCriteriaId":"886D0B06-7718-4C8E-9F05-12185B887516"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:g1_gen_1_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0556CCE6-B61B-4DE7-AD4B-333414280DF8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:g1_gen_1:-:*:*:*:*:*:*:*","matchCriteriaId":"CC734495-D935-40CC-9644-477E921F3EE0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:g2_gen_1_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"924DFF0F-E8B2-4B94-9B98-E0C2D6313C87"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:g2_gen_1:-:*:*:*:*:*:*:*","matchCriteriaId":"2A5E644B-D05F-4241-8E20-4A6DA1A56695"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:g3x_gen_2_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C167BE19-999E-4538-A23E-01F9C287A6C7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:g3x_gen_2:-:*:*:*:*:*:*:*","matchCriteriaId":"1026CB5F-E30A-42DE-8432-74412CC8BA00"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:kalpeni_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5A2D4C45-005F-4A02-BFD7-84893FF1A0E8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:kalpeni:-:*:*:*:*:*:*:*","matchCriteriaId":"B3178A79-485F-40DB-A71D-B29BD3875A7D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:lemans_au_lgit_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5767FE95-737F-4C20-A5AB-EC641A68D906"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:lemans_au_lgit:-:*:*:*:*:*:*:*","matchCriteriaId":"33323A49-9267-421B-96E1-80C5FA709EBC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:lemansau_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2DF0ED3F-C98B-458E-ADCC-C922402BB185"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:lemansau:-:*:*:*:*:*:*:*","matchCriteriaId":"102A4B5E-1739-4C31-A626-ABF6B02FEE29"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:mbm415_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"06917C11-6ABA-4972-A4A5-AEA69A5E73FE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:mbm415:-:*:*:*:*:*:*:*","matchCriteriaId":"9B1C6B87-2B59-4220-BC0D-7CE30F514728"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:mbm715_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F9E2ED64-0268-4C88-9553-D6EF646C3BA1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:mbm715:-:*:*:*:*:*:*:*","matchCriteriaId":"861D5B95-47E1-4374-9EF6-157516FF5171"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:mdm9250_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BA44E1D7-C4B5-4A1C-8D89-C080856104EE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:mdm9250:-:*:*:*:*:*:*:*","matchCriteriaId":"268F94E5-15A2-4BCA-BE1B-0B6A7179B9C9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:mdm9628_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"ADC6FBEE-D2FA-4660-A078-D6CE2097653D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:mdm9628:-:*:*:*:*:*:*:*","matchCriteriaId":"F6BD8A1C-D9AB-4BE7-A855-31E58631879C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:milos_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22EFC07D-16C3-4CCC-A928-EA5EA69CAB65"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:milos:-:*:*:*:*:*:*:*","matchCriteriaId":"0D3491C1-A427-4CEC-B8BD-6A1930E6827F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:milos_iot_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"18471E2B-412C-4D07-9997-C8663902D7B5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:milos_iot:-:*:*:*:*:*:*:*","matchCriteriaId":"0284E269-A212-4474-AE46-255D5245096F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:netrani_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9C52A53B-1182-47F3-9800-D8C58F954277"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:netrani:-:*:*:*:*:*:*:*","matchCriteriaId":"BEC1F084-78C8-4413-940A-47E9554CB6D0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:orne_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"19FB8345-BBFC-4E18-A4E6-64A159D7F65B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:orne:-:*:*:*:*:*:*:*","matchCriteriaId":"FFDA4056-3F1B-4F3A-BE59-1908BD3DE5E9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:palawan25_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C18C3535-3074-41DE-B40F-F3055BAFF686"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:palawan25:-:*:*:*:*:*:*:*","matchCriteriaId":"7B590B1E-06D1-4C99-BDDF-4A086BEBB4C7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:pandeiro_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F8EF0C-BB48-47E1-A045-254D79388F75"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:pandeiro:-:*:*:*:*:*:*:*","matchCriteriaId":"058950FC-ED72-4E91-AE13-87E738ADC083"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qam8255p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3723C7B1-A7E2-401F-8D6D-189350F6BCA5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qam8255p:-:*:*:*:*:*:*:*","matchCriteriaId":"B12B89EF-7B12-481E-BCBC-F12B9D16321A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qam8295p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C2D9E281-B382-41AC-84CB-5B1063E5AC51"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qam8295p:-:*:*:*:*:*:*:*","matchCriteriaId":"44EBEBD5-98C3-493B-A108-FD4DE6FFBE97"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qamsrv1h_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F8673334-5E11-4E95-B33D-3029499F71DF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qamsrv1h:-:*:*:*:*:*:*:*","matchCriteriaId":"EC0B32F6-5EF0-4591-99D7-D0E9B09DEC5A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qamsrv1m_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CE03AB2A-3ED9-4489-8E5B-4FCF8BAA8559"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qamsrv1m:-:*:*:*:*:*:*:*","matchCriteriaId":"9E646738-6A87-4470-9640-6A5A1DF3AF78"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca2066_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6366F2ED-C6B7-4579-B304-C5B6DF951EB4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca2066:-:*:*:*:*:*:*:*","matchCriteriaId":"09B688AF-E1A4-496C-924C-D6B725CBBE26"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6174a_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4FF653D0-15CF-4A10-8D8E-BE56F4DAB890"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6174a:-:*:*:*:*:*:*:*","matchCriteriaId":"C31FA74C-6659-4457-BC32-257624F43C66"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6391_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"83B53119-1B2F-4978-B7F5-33B84BE73B68"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6391:-:*:*:*:*:*:*:*","matchCriteriaId":"6FEBC0C5-CAA1-475C-96C2-B8D24B2E4536"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6564a_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"886124F6-B397-4EB6-8E01-6012E468ABE9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6564a:-:*:*:*:*:*:*:*","matchCriteriaId":"93ED74CE-6BF2-4983-8780-07D5336745B3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6564au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B59672A0-2FA6-46CC-B75A-C599B842AFB9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6564au:-:*:*:*:*:*:*:*","matchCriteriaId":"3847F4A5-90A5-4C84-B43F-0DDD81BD79CE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6574_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9B828AC8-4A01-4537-B2BD-8180C99F5C32"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6574:-:*:*:*:*:*:*:*","matchCriteriaId":"66C16E1E-9D4A-4F20-B697-833FDCCA86FB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6574a_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"828CFB37-76A6-4927-9D00-AF9A1C432DD6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6574a:-:*:*:*:*:*:*:*","matchCriteriaId":"11405993-5903-4716-B452-370281034B42"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6574au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D527E2B1-2A46-4FBA-9F7A-F5543677C8FB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6574au:-:*:*:*:*:*:*:*","matchCriteriaId":"8374DDB3-D484-4141-AE0C-42333D2721F6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6584au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C3DDA896-576C-44B8-85B6-F71F473F776B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6584au:-:*:*:*:*:*:*:*","matchCriteriaId":"51A87BDA-5B24-4212-BAB3-D2BBB2F4162E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6595_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"643EC76D-2836-48E6-81DA-78C4883C33CA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6595:-:*:*:*:*:*:*:*","matchCriteriaId":"477F6529-4CE1-44FC-B6EE-D24D44C71AE7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6595au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"288F637F-22F8-47CF-B67F-C798A730A1BD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6595au:-:*:*:*:*:*:*:*","matchCriteriaId":"D0996EA3-1C92-4933-BE34-9CF625E59FE7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6678aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D001127D-8160-42F0-B8B9-2FAA2976B530"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6678aq:-:*:*:*:*:*:*:*","matchCriteriaId":"C9EB615F-FD4C-450B-AB25-E936FD9816C4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6688aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AFBD264F-F24A-4CDD-B316-9514A61B91E7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6688aq:-:*:*:*:*:*:*:*","matchCriteriaId":"94CC5BC4-011D-4D2B-8891-97FBF61FD783"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6696_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0AE207DB-9770-40ED-961D-FDA75965826F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6696:-:*:*:*:*:*:*:*","matchCriteriaId":"0E23922D-C37F-476F-A623-4C1458A9156F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6698aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5FA1F8F4-EAF2-4704-A8A6-19AD3CA1B577"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6698aq:-:*:*:*:*:*:*:*","matchCriteriaId":"B3F7853D-09EE-476F-B48D-BB30AEB4A67D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8\\+_gen_2_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1FEDF458-DEA7-42A1-A56D-E11250139545"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8\\+_gen_2_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"D5693438-0F20-47BB-BA32-7175C3152368"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_888_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22A78236-5965-4F65-9001-3FE7FF6D27E8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_888_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"414C5C1D-A5DA-47C7-B6C9-3564DD4DD911"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_888\\+_5g_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"01CBD543-635C-4C57-87B7-55DD3BA3C1A2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_888\\+_5g_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"6A7272B6-AADB-4CCD-B041-66170C313C76"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_ar1_gen_1_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"53E5BBDA-C07D-42E2-9A34-EC1F6454CAA4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_ar1_gen_1_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"0BB2408F-C768-4DD2-B834-B62E188D6CC2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_ar1\\+_gen_1_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BE30A5E0-10D5-4679-ACA6-4ED991335A6F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_ar1\\+_gen_1_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"CFA75B74-D20D-4C8B-BFA2-5DE4848410CD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_auto_5g_modem-rf_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"88AF39A5-F44E-4B14-AA6E-4F80D9EEB017"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_auto_5g_modem-rf:-:*:*:*:*:*:*:*","matchCriteriaId":"2A25FE8F-555A-4D85-8A94-A808B62EAE86"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_auto_5g_modem-rf_gen_2_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EE5FCA7F-1FBE-42AA-B4E6-09CEA02A33EC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_auto_5g_modem-rf_gen_2:-:*:*:*:*:*:*:*","matchCriteriaId":"E2D789BC-43F5-40FB-A191-163C01BA5FBE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_w5\\+_gen_1_wearable_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0C455E7D-D256-4240-BE72-2A93273D685A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_w5\\+_gen_1_wearable_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"423E21A1-8F52-46DA-9AC2-77159FEB6001"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_x12_lte_modem_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"05396B5E-C70F-4D83-84AA-7A7DB1B7B0E4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_x12_lte_modem:-:*:*:*:*:*:*:*","matchCriteriaId":"6E180EE7-5254-4C57-B4EE-BF2A9C21CA94"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_x32_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A934F06D-71C4-4647-B321-2B86BDA9E586"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_x32_5g_modem-rf_system:-:*:*:*:*:*:*:*","matchCriteriaId":"183FE432-3E53-403B-A96B-AF9E7C3215F6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_x35_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C3358AEB-CD49-4FF9-9410-7EDF0AAABB82"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_x35_5g_modem-rf_system:-:*:*:*:*:*:*:*","matchCriteriaId":"9ED45581-33EE-4D4C-B078-9D7DB6F2386A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_x53_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4F80E77B-B207-4E49-99EF-A1F9ECFAAC99"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_x53_5g_modem-rf_system:-:*:*:*:*:*:*:*","matchCriteriaId":"9A12A6DC-63A2-4B52-971A-C014E40C1E6D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_x62_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FEA4DE65-C5F1-45F6-9D79-CF80196471B6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_x62_5g_modem-rf_system:-:*:*:*:*:*:*:*","matchCriteriaId":"1F27FE86-F0E3-4EBD-933F-9B0210CBD72F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_x65_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F74BF53E-DFA1-4750-A638-FE7572B79D16"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_x65_5g_modem-rf_system:-:*:*:*:*:*:*:*","matchCriteriaId":"226D1ABD-E4AD-487E-88EB-4C66D51DB33D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_x72_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"205BF723-DBED-4EAE-8B5C-0E01B01E1544"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_x72_5g_modem-rf_system:-:*:*:*:*:*:*:*","matchCriteriaId":"9A36A7B8-CF35-4003-AC3E-C5D25288B1A1"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_x75_5g_modem-rf_system_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"95A98B39-067F-4047-9ADB-7C53F18CBB7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_x75_5g_modem-rf_system:-:*:*:*:*:*:*:*","matchCriteriaId":"1C462F32-0E70-472A-A42D-CD0229A97E94"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_reality_elite_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"08ACBE23-DBE3-4AE0-B9EA-F3A73290D5F0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_reality_elite_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"3F82A885-4CAB-44F2-85FA-3D581283A936"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:srv1h_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0CD199F5-DA68-4BEB-AA99-11572DA26B4F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:srv1h:-:*:*:*:*:*:*:*","matchCriteriaId":"8ACA2D4D-FC77-4C1A-8278-1C27B3EA3303"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:srv1m_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4B29E7F-8BFE-466A-B357-63F8A2160C4E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:srv1m:-:*:*:*:*:*:*:*","matchCriteriaId":"6D55CC7D-2E65-4CA9-9892-B6FBCC087E6F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sw5100_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AA1BF9BB-AF11-46A7-A71C-F7D289E76E3F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sw5100:-:*:*:*:*:*:*:*","matchCriteriaId":"7B8455D6-287D-4934-8E4D-F4127A9C0449"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sw5100p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DB599A9F-0305-4FE4-8623-0F86630FEDCB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sw5100p:-:*:*:*:*:*:*:*","matchCriteriaId":"EEB883BF-68B2-4C25-84DC-5DA953BFAA2F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sxr2230p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD6444F6-A477-4B4C-8A09-C22C47CCE45B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sxr2230p:-:*:*:*:*:*:*:*","matchCriteriaId":"F3E20681-4FC4-46E2-AF77-BCF03BC8E77E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sxr2250p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"68A93ED1-F509-439E-AE7B-F0EC87AE759F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sxr2250p:-:*:*:*:*:*:*:*","matchCriteriaId":"FB5E2A98-EDD0-4298-911D-EC7527D5A424"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9335_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"28717583-463A-468A-8073-ECF0F90585F6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9335:-:*:*:*:*:*:*:*","matchCriteriaId":"4D1A7188-7D5D-4D46-AEAB-08BA84FFF539"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9340_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8BA28CC6-C8BB-4F50-BFE3-A59F664A4F54"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9340:-:*:*:*:*:*:*:*","matchCriteriaId":"94D2BDF1-764C-48BA-8944-3275E8768078"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9370_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1295D869-F4DD-4766-B4AA-3513752F43B4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9370:-:*:*:*:*:*:*:*","matchCriteriaId":"B98784DC-3143-4D38-AD28-DBBDCCAB4272"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9371_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2503805B-B2A6-4AEE-8AB1-2B8A040702BD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9371:-:*:*:*:*:*:*:*","matchCriteriaId":"D3AD370C-2ED0-43CF-83D9-50DC92A01CA5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9375_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"34143ABA-7D09-429F-A65C-3A33438BF62C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9375:-:*:*:*:*:*:*:*","matchCriteriaId":"9D56DFE3-5EF1-4B23-BBD5-0203FBF9CCEC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9378_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4CFDBB5B-0A4F-4032-874F-D2A7EF933FB0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9378:-:*:*:*:*:*:*:*","matchCriteriaId":"D28A12D6-CC60-4BE9-ADEE-FAB58B05440F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"70292B01-617F-44AD-AF77-1AFC1450523D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9380:-:*:*:*:*:*:*:*","matchCriteriaId":"FA94C6D6-85DB-4031-AAF4-C399019AE16D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"92B17201-8185-47F1-9720-5AB4ECD11B22"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9385:-:*:*:*:*:*:*:*","matchCriteriaId":"E1FA2EB9-416F-4D69-8786-386CC73978AE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9390_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"896F1C04-9957-440F-BF01-C3772CC3B3DF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9390:-:*:*:*:*:*:*:*","matchCriteriaId":"A90555EB-47A7-4717-92D5-35B561825F06"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9395_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"699056F6-1517-4F25-AE07-4FFCF6923B9F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9395:-:*:*:*:*:*:*:*","matchCriteriaId":"E4C023D2-6FF5-4FFC-B9F2-895979166580"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3950_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3FEF2DB6-00F5-4B07-953B-EF58B31267F1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3950:-:*:*:*:*:*:*:*","matchCriteriaId":"120E8F0F-EBEB-4565-9927-2D473F783EF7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3980_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9C6E9038-9B18-4958-BE1E-215901C9B4B2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3980:-:*:*:*:*:*:*:*","matchCriteriaId":"B36D3274-F8D0-49C5-A6D5-95F5DC6D1950"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn3988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E4BFB25F-013B-48E3-99FF-3E8687F94423"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn3988:-:*:*:*:*:*:*:*","matchCriteriaId":"BF676C5B-838B-446C-A689-6A25AB8A87E2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn6450_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1FAFC9FA-E6EF-44C5-BD50-2824C7711541"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn6450:-:*:*:*:*:*:*:*","matchCriteriaId":"6F895CDD-F9BB-45AD-AE60-71F4549114A4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn6650_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"93398092-AF7C-4F04-874C-7E5B4CF7AB00"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn6650:-:*:*:*:*:*:*:*","matchCriteriaId":"7D242084-5844-4E43-8D7F-D2F8E3521F0C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn6755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2BC386D9-3D2B-40FA-A2D9-199BB138F46A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn6755:-:*:*:*:*:*:*:*","matchCriteriaId":"133FFD9F-FA09-4801-939B-AD1D507BE5FE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7860_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2EB8794F-7998-424E-AF68-E4A4F9310F65"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7860:-:*:*:*:*:*:*:*","matchCriteriaId":"799D69CE-3FCC-4B19-8B00-9AF38111D983"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6698au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3ACA09C0-84A5-493A-A9BD-EF95A8330D54"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6698au:-:*:*:*:*:*:*:*","matchCriteriaId":"3A2397BD-431C-4730-92E3-17A5C2445A65"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca6797aq_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"797295C2-535C-46A9-A725-E1A5405F0436"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca6797aq:-:*:*:*:*:*:*:*","matchCriteriaId":"8BFC575E-594E-4711-94B1-2DC8D03B9AC4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca8081_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1D1C53DC-D2F3-4C92-9725-9A85340AF026"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca8081:-:*:*:*:*:*:*:*","matchCriteriaId":"ED0585FF-E390-46E8-8701-70964A4057BB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca8337_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2FA8F9DA-1386-4961-B9B2-484E4347852A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca8337:-:*:*:*:*:*:*:*","matchCriteriaId":"117289C8-7484-4EAE-8F35-A25768F00EED"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca8695au_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"55A21DB0-4722-4421-8E97-B0E31B93E53B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca8695au:-:*:*:*:*:*:*:*","matchCriteriaId":"797B8944-61F0-4522-97FE-3C172369F477"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca9377_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C4D2B46E-3996-42FD-B932-09E92C02EC8A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca9377:-:*:*:*:*:*:*:*","matchCriteriaId":"98E58C63-F253-4DCC-8A14-48FEB64B4C3D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcc710_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2A75D017-032F-4369-917C-567EE2A809F2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcc710:-:*:*:*:*:*:*:*","matchCriteriaId":"107F0423-608C-404D-B58B-616A6494418F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm2290_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5AB1F0FA-25F3-4304-A3BC-5264E55CC092"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm2290:-:*:*:*:*:*:*:*","matchCriteriaId":"214A053F-D80C-4AD9-B4F1-83384095A3F3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm4290_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3C7FFB96-53E7-41A2-BC99-7ACD853214A8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm4290:-:*:*:*:*:*:*:*","matchCriteriaId":"74EBA77E-69A5-4145-9BEC-CD39BA132309"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm4325_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F2D8044B-D4E5-4174-A0FB-478F8434EE8F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm4325:-:*:*:*:*:*:*:*","matchCriteriaId":"163FE96E-DF5B-4B67-8EDE-44A5B9A8492D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm4490_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DA506489-4338-44DF-8F92-12E60AF0048C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm4490:-:*:*:*:*:*:*:*","matchCriteriaId":"A8718C37-A82A-4A08-A887-3F22B37601A9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm5430_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4EC5F81B-AA24-4E3C-9FC8-53E010AC977E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm5430:-:*:*:*:*:*:*:*","matchCriteriaId":"B5C66DAD-0D85-46B8-92D7-6D68B9429E9A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm6125_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AB226552-52D9-44F5-A170-35C44761A72B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm6125:-:*:*:*:*:*:*:*","matchCriteriaId":"FBB16DC4-CDC9-4936-9C6A-0ED8E1F6D056"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm6490_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"ADD6D51E-5787-42A6-8A02-4EBBAFFF9C94"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm6490:-:*:*:*:*:*:*:*","matchCriteriaId":"99AA0291-B822-4CAD-BA17-81B632FC3FEF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcn6024_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A49DBE04-E2EA-4DA1-B774-A878A71524AC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcn6024:-:*:*:*:*:*:*:*","matchCriteriaId":"69E98386-3BB2-4E8C-AD00-E05123608439"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcn6224_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5F4362D2-30A3-4388-ABB6-293878AD7036"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcn6224:-:*:*:*:*:*:*:*","matchCriteriaId":"BB6AE9A7-386A-473B-9BD5-DA37B1E696C5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcn6274_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"88376C1D-AC4D-4EB0-AF6A-274D020F5859"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcn6274:-:*:*:*:*:*:*:*","matchCriteriaId":"E15BA4B4-C97F-45C0-A4AD-7E46387F19A6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcn9011_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9306C34D-47E4-40CF-89F4-BA5263655D13"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcn9011:-:*:*:*:*:*:*:*","matchCriteriaId":"02BA009F-24E1-4953-BA95-2A5BC1CDBDBB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcn9012_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"61F34DD2-9DC0-49E5-BC85-1543EA199477"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcn9012:-:*:*:*:*:*:*:*","matchCriteriaId":"1A06879F-6FE9-448A-8186-8347D76F872B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcn9024_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A64CDA49-19BF-413F-A0E0-2B9729E45E25"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcn9024:-:*:*:*:*:*:*:*","matchCriteriaId":"345CCD64-C09E-407D-AAA2-311C4CCFE24F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs2290_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"93CDB7BC-89F2-4482-B8E3-9DDBD918C851"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs2290:-:*:*:*:*:*:*:*","matchCriteriaId":"76E03AE9-2485-449B-BCFD-3E452BB01FC6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs4290_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"06789CB9-E6FA-400D-90B6-C2DB6C8EF153"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs4290:-:*:*:*:*:*:*:*","matchCriteriaId":"FFCB9F22-57F2-4327-95B9-B2342A02E45E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs4490_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3336CDD7-9E7B-4FFB-A5CE-594B19B63A6C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs4490:-:*:*:*:*:*:*:*","matchCriteriaId":"1197E229-1E27-4CA3-A386-B77FAE5DFE1A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs6690_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F8AD50C4-E725-48B8-8291-A62EF153D50A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs6690:-:*:*:*:*:*:*:*","matchCriteriaId":"4B5A7BC1-E4B1-486C-A433-D206A42A1356"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcs8550_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FFF23DDB-98A0-4343-ADD3-5AB9C2383E7E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcs8550:-:*:*:*:*:*:*:*","matchCriteriaId":"5ACB8AFB-5B91-4AA1-BA3A-1AF0B3503080"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qdu1000_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"407EE4D5-1F52-40D6-B85A-E49915D6EF2D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qdu1000:-:*:*:*:*:*:*:*","matchCriteriaId":"5846C9DD-63E5-482D-BE01-3A1E89CC0EDE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qdu1110_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7F5F9F3D-1F57-4D16-972E-AF39E438E4C3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qdu1110:-:*:*:*:*:*:*:*","matchCriteriaId":"53D6BEFE-AA21-4786-B11C-A6683AC06622"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qdu1210_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"32E0EBD5-A846-44F9-9DEC-1C6711C96A5B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qdu1210:-:*:*:*:*:*:*:*","matchCriteriaId":"C68F8102-788C-4EF3-83E4-56DF764DFFBC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qdx1010_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B7AB84B-55D0-45EB-ABA8-F69E5179507E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qdx1010:-:*:*:*:*:*:*:*","matchCriteriaId":"B908A65E-F3B2-417A-91EE-1BE855BABD2E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qdx1011_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6554B2E1-AE96-40CE-A19F-C7516CDBC41A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qdx1011:-:*:*:*:*:*:*:*","matchCriteriaId":"1991232B-B58F-481E-A7EE-0546E64C12CC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qep8111_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEB4913D-940F-49CC-951A-9704CCEE636C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qep8111:-:*:*:*:*:*:*:*","matchCriteriaId":"4E93E1D2-4546-4D60-B53D-20CF09551766"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qfw7114_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7456782E-B6CE-42ED-A51E-39907120E28B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qfw7114:-:*:*:*:*:*:*:*","matchCriteriaId":"637BF4DF-BB40-479F-B696-6AD9D4B35D64"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qfw7124_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D72C4CE0-AB59-4652-854F-94C9998F2712"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qfw7124:-:*:*:*:*:*:*:*","matchCriteriaId":"98720774-11B8-4B4B-BC73-D4DA84E07F78"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qln1083bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FD70F234-1EE7-4362-97F6-5AEDB7078D03"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qln1083bd:-:*:*:*:*:*:*:*","matchCriteriaId":"C569A848-B70C-42EF-B6D5-4A86547586EE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qln1086bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F218DF06-C40A-4738-ABB5-A3FA2243EF84"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qln1086bd:-:*:*:*:*:*:*:*","matchCriteriaId":"2E2A0CD0-66FA-45D6-BBC7-03641203EC73"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qmp1000_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5298473D-8B34-42E6-BC32-69A3800972B4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qmp1000:-:*:*:*:*:*:*:*","matchCriteriaId":"2A1CF44E-FFC2-4DCB-8DC2-46422D912448"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qna715_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7B3FD468-BE2F-4C80-843B-7EC3845F6923"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qna715:-:*:*:*:*:*:*:*","matchCriteriaId":"342A6C3B-5128-40C5-BB3B-151D5B6C7BDA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qpa1083bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B0208F7B-A959-485E-B004-A34CB7C7C4C9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qpa1083bd:-:*:*:*:*:*:*:*","matchCriteriaId":"FBDAC812-4603-4D24-A861-23825E32D44E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qpa1086bd_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7F6DEF72-A8FF-4B67-AA6C-5CB4AA7B35E1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qpa1086bd:-:*:*:*:*:*:*:*","matchCriteriaId":"00EF6875-B088-40BD-A526-C962789CDC5A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qru1032_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8ECC6966-23CF-4189-81B3-477A97E38B05"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qru1032:-:*:*:*:*:*:*:*","matchCriteriaId":"01490429-D26C-4F80-83A4-8DC257142B86"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7861_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"57608D47-894C-4895-B4B3-4733D55D57DB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7861:-:*:*:*:*:*:*:*","matchCriteriaId":"2FFD2C38-1A61-4BED-ABFA-DAE0C4B78620"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7880_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"63735D33-9F09-4841-9FE0-0D9AB604BECF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7880:-:*:*:*:*:*:*:*","matchCriteriaId":"E826F765-4C2E-4319-BBC4-DEB02AAD783F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcn7881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D765C392-5F38-4E6A-9E88-59629E7A6911"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcn7881:-:*:*:*:*:*:*:*","matchCriteriaId":"FAE8F4F9-F692-4EC0-A3FE-2CDD681DCBFD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8810_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"15307882-7039-43E9-9BA3-035045988B99"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8810:-:*:*:*:*:*:*:*","matchCriteriaId":"AA85B322-E593-4499-829A-CC6D70BAE884"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E839A0B9-64C3-4C7A-82B7-D2AAF65928F8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8815:-:*:*:*:*:*:*:*","matchCriteriaId":"7E870D82-DE3B-4199-A730-C8FB545BAA98"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8830_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"11B69595-E488-4590-A150-CE5BE08B5E13"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8830:-:*:*:*:*:*:*:*","matchCriteriaId":"BF680174-5FA6-47D9-8EAB-CC2A37A7BD42"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8832_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7ACAD26E-B79E-4659-91A5-D301281F7D36"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8832:-:*:*:*:*:*:*:*","matchCriteriaId":"F0E46DA6-9494-4D92-A4AE-A272AF6ACCCC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F80BC68E-7476-4A40-9F48-53722FE9A5BF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8835:-:*:*:*:*:*:*:*","matchCriteriaId":"6B36F4B2-BAA3-45AD-9967-0EB482C99708"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8840_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA33DE15-C177-43B3-AD50-FF797753D12E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8840:-:*:*:*:*:*:*:*","matchCriteriaId":"AE1A5841-5BCB-4033-ACB9-23F3FCA65309"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8845_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5B47BF35-3AA0-4667-842E-19B0FE30BF3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8845:-:*:*:*:*:*:*:*","matchCriteriaId":"8A071672-9405-4418-9141-35CEADBB65AF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8845h_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB7CF473-8B25-4851-91F2-1BD693CCDC85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8845h:-:*:*:*:*:*:*:*","matchCriteriaId":"91E591F2-8F72-4A5A-9264-2742EB2DABDA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:xrv7209_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CC6C6243-E092-4903-BC20-E3B0CECBC790"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:xrv7209:-:*:*:*:*:*:*:*","matchCriteriaId":"AAA33761-D61C-4A81-B233-5E2D50F3596F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:xrv9209_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D693483-72F9-42B1-8EDA-8DABD537F428"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:xrv9209:-:*:*:*:*:*:*:*","matchCriteriaId":"43F4A7D9-055D-475B-BFE4-61A86C7397F8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qualcomm_dragonwing_qru100_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7A4CF522-1781-4FA1-9584-6FACAF4E2A93"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qualcomm_dragonwing_qru100_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"E8242199-4435-40F8-847F-57096494430A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qualcomm_dragonwing_x100_accelerator_card_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2B607855-6EEC-42E8-AA0E-AC76CB86EBEF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qualcomm_dragonwing_x100_accelerator_card:-:*:*:*:*:*:*:*","matchCriteriaId":"D7533B93-3804-4E35-9FEE-840517D5B1F9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:video_collaboration_vc1_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C3607443-848D-4334-B5E4-0DC27F28509B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:video_collaboration_vc1_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"2E8F00DD-C894-4236-8932-7F7FCD15D2A5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:video_collaboration_vc3_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DD4946C6-778F-4542-AB77-C9B86AF25C05"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:video_collaboration_vc3_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"6F1D604A-4530-42B3-80A0-58A82D658DDD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:video_collaboration_vc5_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"87CF9AD4-6E1B-47E8-B441-022A03858875"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:video_collaboration_vc5_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"791C1E60-162D-4881-80D5-895658FEC47E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1083_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0CE74B89-5E3F-428E-8000-E3452B8B6953"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1083:-:*:*:*:*:*:*:*","matchCriteriaId":"DC11B7A6-E621-463D-B861-6B203EADFA57"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1086_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E48759CC-B751-4466-87DF-2D0AB220C0FB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1086:-:*:*:*:*:*:*:*","matchCriteriaId":"E7F1C9D2-6616-4F74-85C2-1850B5C3F6BC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1093_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9A46B609-BD06-4BB7-B055-1F71C555E93D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1093:-:*:*:*:*:*:*:*","matchCriteriaId":"59598462-1E53-4F6D-BAB5-06ACEDF6CD9F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1094_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8F30D66E-2802-4394-BC39-5E04711234FF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1094:-:*:*:*:*:*:*:*","matchCriteriaId":"078EC383-784F-4468-B94C-AE7CC9808419"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1095_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B7B67C93-0453-4696-8F3D-0AD664922C44"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1095:-:*:*:*:*:*:*:*","matchCriteriaId":"D61C46AA-9130-46A8-BD04-8B4235118B81"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qxm1096_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2E2D5E44-48F6-41E8-A38B-A2E070E16AA9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qxm1096:-:*:*:*:*:*:*:*","matchCriteriaId":"9BD0372F-5140-4966-9A27-6B5A606C0665"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:robotics_rb2_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"76F5D880-7BBD-4B33-AC47-9B5C4AA49A36"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:robotics_rb2_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"3D0194E5-328D-4E53-A1F2-1CFE333217F4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa4150p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0DC99C0C-8AE3-4918-B91D-2C26990FE931"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa4150p:-:*:*:*:*:*:*:*","matchCriteriaId":"A558A868-1B67-48D2-8A94-FDEA7126FAE7"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa4155p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D8D28764-EF4F-4FB3-B936-B42397450EFD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa4155p:-:*:*:*:*:*:*:*","matchCriteriaId":"7964A762-467B-47D7-865F-30D48A0AE47C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa6145p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C66671C1-AE1A-44BE-9DB2-0B09FF4417DB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa6145p:-:*:*:*:*:*:*:*","matchCriteriaId":"74AA3929-3F80-4D54-B13A-9B070D5C03BB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa6150p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"054F77D6-FC66-4151-9005-DC7ECDB5C722"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa6150p:-:*:*:*:*:*:*:*","matchCriteriaId":"8ED3F589-16D9-46A7-A539-C9862473EE0D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa6155p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8DC40C14-3B2D-4E00-9E0F-86E6BDBF2D81"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa6155p:-:*:*:*:*:*:*:*","matchCriteriaId":"0514D433-162C-4680-8912-721D19BE6201"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa7255p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2B651F0A-34DA-400F-A376-B499BFDF8E86"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa7255p:-:*:*:*:*:*:*:*","matchCriteriaId":"4CFF093D-98C8-470F-8330-E5126E06343A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa7775p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6C32CA38-5D48-4108-9858-FD66E20CAF2F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa7775p:-:*:*:*:*:*:*:*","matchCriteriaId":"E1997F8B-17B8-4DE3-BCF7-726928720592"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8145p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A71D74B0-0963-49FD-8E97-148C8993B263"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8145p:-:*:*:*:*:*:*:*","matchCriteriaId":"910CBFA4-50F7-4C7A-B9B9-B88C8A919827"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8150p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"69C1B02F-8D2D-42E7-B70D-41F4D9844FD1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8150p:-:*:*:*:*:*:*:*","matchCriteriaId":"3FEACAA9-C061-4713-9A54-37D8BFC0B00B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8155p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C8648B38-2597-401A-8F53-D582FA911569"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8155p:-:*:*:*:*:*:*:*","matchCriteriaId":"A01CD59B-8F21-4CD6-8A1A-7B37547A8715"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8195p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"51BC0A66-493B-43BE-B51F-640BDF2FF32E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8195p:-:*:*:*:*:*:*:*","matchCriteriaId":"D8DA4D12-7ABF-4A04-B44E-E1D68C8E58AB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8255p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EC6E268D-C4AF-4950-9223-39EA36D538A8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8255p:-:*:*:*:*:*:*:*","matchCriteriaId":"073C1A81-D02B-4F2F-9378-CD1B2DCE0E5B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8295p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2A19659B-A0C3-44B7-8D54-BA21729873A4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8295p:-:*:*:*:*:*:*:*","matchCriteriaId":"F978041A-CE28-4BDF-A7DB-F0360F1A5F14"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8620p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6ACE6D64-A498-482F-8270-718F4884CFFD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8620p:-:*:*:*:*:*:*:*","matchCriteriaId":"B6E016D6-1B83-4261-A27E-1F9873F81E14"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa8770p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"781CCC31-C08F-499B-BE73-6C7DB70437AF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa8770p:-:*:*:*:*:*:*:*","matchCriteriaId":"75AFAA21-0589-4C6A-9418-34EE8A61BBAD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sa9000p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A024AB04-B213-4018-A4C1-FA467C7BA775"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sa9000p:-:*:*:*:*:*:*:*","matchCriteriaId":"A2A8AB7C-5D34-4794-8C06-2193075B323F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sar1165p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D97CD52-4CB0-4F57-9C24-530B326B8D9D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sar1165p:-:*:*:*:*:*:*:*","matchCriteriaId":"582EE932-DDE5-4BE5-837C-523FE3EFBA5D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sar2130p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"95696696-D2AE-4358-AF5D-3ED14F969964"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sar2130p:-:*:*:*:*:*:*:*","matchCriteriaId":"1A6FC469-463F-4EC1-B4EF-010BDB9BAA05"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_8_gen1_5g_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D0567B3-D81A-4EEE-868B-4DC2214C159D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_8_gen1_5g:-:*:*:*:*:*:*:*","matchCriteriaId":"76236C11-4903-4AD4-9134-3EDD3451EE43"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_662_mobile_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"37DF4D73-3ACC-41B3-8CA4-20DAECE6BFB7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_662_mobile_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"FE08D23A-2D0D-4472-8847-27B955F55165"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sdx61_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3125FCBA-94BA-415A-A005-CDC5B2CDBE39"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sdx61:-:*:*:*:*:*:*:*","matchCriteriaId":"BCB09831-632C-4043-B7BE-C02ADA70AACA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6225p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8D2B7D93-4218-4FFF-B1C0-F50EC0B2B934"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6225p:-:*:*:*:*:*:*:*","matchCriteriaId":"00D9DCE1-B3CD-4F45-97DD-637AA27572DD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6450p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEE752CE-2121-477E-A1C9-6A05DF36DFA9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6450p:-:*:*:*:*:*:*:*","matchCriteriaId":"DCA019DB-C24E-4C2B-B4E4-95F61E038FEA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6475p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E32FAA6A-E882-4978-B748-5617BE33F347"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6475p:-:*:*:*:*:*:*:*","matchCriteriaId":"FFFCBBD0-3F52-446F-9A6B-2D138463AB80"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6475q_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03B375DA-4A46-4BC6-B873-99538D53DFBD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6475q:-:*:*:*:*:*:*:*","matchCriteriaId":"ACEA2D75-14DB-4F87-8F3C-A6E9436ECA97"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm6650p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"09020F3F-C869-42DF-BD9C-E78056CC8123"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm6650p:-:*:*:*:*:*:*:*","matchCriteriaId":"E8272228-2D68-45F2-A670-B5D6E90D9C14"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7325p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4BEC725F-19B1-4078-B13D-CE624BE23344"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7325p:-:*:*:*:*:*:*:*","matchCriteriaId":"4EA43E38-A12D-49C3-B05C-A2AF07ED2710"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sm7435_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F7A95A9E-617A-4D3A-9A4E-0C0A29B3C8B5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sm7435:-:*:*:*:*:*:*:*","matchCriteriaId":"3559292E-B5A6-4F88-BC20-F6AA85F07C97"}]}]}],"references":[{"url":"https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2026-bulletin.html","source":"product-security@qualcomm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-57555","sourceIdentifier":"product-security@qualcomm.com","published":"2026-10-06T07:16:58.980","lastModified":"2026-10-09T14:12:46.737","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Memory Corruption when executing system service routines due to improper handling of user input buffers."}],"affected":[{"source":"product-security@qualcomm.com","affectedData":[{"vendor":"Qualcomm, Inc.","product":"Snapdragon","defaultStatus":"unaffected","platforms":["Snapdragon Compute","Snapdragon Industrial IOT"],"versions":[{"version":"Cologne","status":"affected"},{"version":"FastConnect 6700","status":"affected"},{"version":"FastConnect 6900","status":"affected"},{"version":"FastConnect 7800","status":"affected"},{"version":"IQX5121","status":"affected"},{"version":"QCA0000","status":"affected"},{"version":"QCM5430","status":"affected"},{"version":"QCM6490","status":"affected"},{"version":"Qualcomm Dragonwing IQ-X","status":"affected"},{"version":"Qualcomm Video Collaboration VC3 Platform","status":"affected"},{"version":"SC8380XP","status":"affected"},{"version":"Snapdragon X2 Elite","status":"affected"},{"version":"Snapdragon Reality Elite Platform","status":"affected"},{"version":"WCD9370","status":"affected"},{"version":"WCD9375","status":"affected"},{"version":"WCD9378C","status":"affected"},{"version":"WCD9380","status":"affected"},{"version":"WCD9385","status":"affected"},{"version":"WSA8835","status":"affected"},{"version":"WSA8840","status":"affected"},{"version":"WSA8845","status":"affected"},{"version":"WSA8845H","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"product-security@qualcomm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T11:53:26.205220Z","id":"CVE-2026-57555","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"product-security@qualcomm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cologne_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8FF959C0-5AAB-4DC5-AE8F-4EFA21A00B5E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cologne:-:*:*:*:*:*:*:*","matchCriteriaId":"E31E0C48-FB61-47C8-B28B-3A701E85E126"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6700_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"82B82E87-F3F4-466F-A76B-C8809121FF6F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6700:-:*:*:*:*:*:*:*","matchCriteriaId":"419A132E-E42C-4395-B74B-788A39DF1D13"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6900_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E670F500-9B71-4BBE-B5DA-221D35803C89"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6900:-:*:*:*:*:*:*:*","matchCriteriaId":"9ADEB5C5-B79A-4F45-B7D3-75945B38DB6C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_7800_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B3053D68-C5D8-4D47-A4F0-9F3AF2289E1D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_7800:-:*:*:*:*:*:*:*","matchCriteriaId":"638DBC7F-456F-487D-BED2-2214DFF8BEE2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iqx5121_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"499A2520-436C-4B12-849D-98B94088CCDE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iqx5121:-:*:*:*:*:*:*:*","matchCriteriaId":"4C34A825-C928-4F8F-B076-19F8787A3440"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iqx7181_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F58C10B5-2BB1-4A8F-AF4B-2EC791C9FBBE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iqx7181:-:*:*:*:*:*:*:*","matchCriteriaId":"9EE22328-BBF8-473C-8F89-58AEF8CC9D75"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca0000_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CC941093-1A7C-47B2-AB3B-05AE4AE2FBE4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca0000:-:*:*:*:*:*:*:*","matchCriteriaId":"7A2AA834-C17C-4E0E-A510-795818041E47"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm5430_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4EC5F81B-AA24-4E3C-9FC8-53E010AC977E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm5430:-:*:*:*:*:*:*:*","matchCriteriaId":"B5C66DAD-0D85-46B8-92D7-6D68B9429E9A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm6490_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"ADD6D51E-5787-42A6-8A02-4EBBAFFF9C94"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm6490:-:*:*:*:*:*:*:*","matchCriteriaId":"99AA0291-B822-4CAD-BA17-81B632FC3FEF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:video_collaboration_vc3_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DD4946C6-778F-4542-AB77-C9B86AF25C05"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:video_collaboration_vc3_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"6F1D604A-4530-42B3-80A0-58A82D658DDD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sc8380xp_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14E3FE58-7F1C-4F5C-B62D-0CF124E14AB2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sc8380xp:-:*:*:*:*:*:*:*","matchCriteriaId":"FFCB0BBA-3F81-4FCA-B3DE-190C46DA50DB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_x2_elite_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7FEA3409-34AF-4FFB-AB58-ABE600FBA9FC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_x2_elite:-:*:*:*:*:*:*:*","matchCriteriaId":"025C1550-D3DC-434A-91E4-EBFE004F3628"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_reality_elite_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"08ACBE23-DBE3-4AE0-B9EA-F3A73290D5F0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_reality_elite_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"3F82A885-4CAB-44F2-85FA-3D581283A936"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9370_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1295D869-F4DD-4766-B4AA-3513752F43B4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9370:-:*:*:*:*:*:*:*","matchCriteriaId":"B98784DC-3143-4D38-AD28-DBBDCCAB4272"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9375_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"34143ABA-7D09-429F-A65C-3A33438BF62C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9375:-:*:*:*:*:*:*:*","matchCriteriaId":"9D56DFE3-5EF1-4B23-BBD5-0203FBF9CCEC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9378c_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"95D79E3A-1978-4B23-B60B-2BD47FEDF5C2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9378c:-:*:*:*:*:*:*:*","matchCriteriaId":"91B32C89-3238-4FDF-BB3F-F6BAE829769B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"70292B01-617F-44AD-AF77-1AFC1450523D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9380:-:*:*:*:*:*:*:*","matchCriteriaId":"FA94C6D6-85DB-4031-AAF4-C399019AE16D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"92B17201-8185-47F1-9720-5AB4ECD11B22"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9385:-:*:*:*:*:*:*:*","matchCriteriaId":"E1FA2EB9-416F-4D69-8786-386CC73978AE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F80BC68E-7476-4A40-9F48-53722FE9A5BF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8835:-:*:*:*:*:*:*:*","matchCriteriaId":"6B36F4B2-BAA3-45AD-9967-0EB482C99708"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8840_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA33DE15-C177-43B3-AD50-FF797753D12E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8840:-:*:*:*:*:*:*:*","matchCriteriaId":"AE1A5841-5BCB-4033-ACB9-23F3FCA65309"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8845_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5B47BF35-3AA0-4667-842E-19B0FE30BF3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8845:-:*:*:*:*:*:*:*","matchCriteriaId":"8A071672-9405-4418-9141-35CEADBB65AF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8845h_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB7CF473-8B25-4851-91F2-1BD693CCDC85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8845h:-:*:*:*:*:*:*:*","matchCriteriaId":"91E591F2-8F72-4A5A-9264-2742EB2DABDA"}]}]}],"references":[{"url":"https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2026-bulletin.html","source":"product-security@qualcomm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-57559","sourceIdentifier":"product-security@qualcomm.com","published":"2026-10-06T07:16:59.123","lastModified":"2026-10-09T14:12:53.593","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Memory corruption while processing service requests."}],"affected":[{"source":"product-security@qualcomm.com","affectedData":[{"vendor":"Qualcomm, Inc.","product":"Snapdragon","defaultStatus":"unaffected","platforms":["Snapdragon Compute","Snapdragon Industrial IOT"],"versions":[{"version":"Cologne","status":"affected"},{"version":"FastConnect 6700","status":"affected"},{"version":"FastConnect 6900","status":"affected"},{"version":"FastConnect 7800","status":"affected"},{"version":"IQX5121","status":"affected"},{"version":"QCA0000","status":"affected"},{"version":"QCM5430","status":"affected"},{"version":"QCM6490","status":"affected"},{"version":"Qualcomm Dragonwing IQ-X","status":"affected"},{"version":"Qualcomm Video Collaboration VC3 Platform","status":"affected"},{"version":"SC8380XP","status":"affected"},{"version":"Snapdragon X2 Elite","status":"affected"},{"version":"Snapdragon Reality Elite Platform","status":"affected"},{"version":"WCD9370","status":"affected"},{"version":"WCD9375","status":"affected"},{"version":"WCD9378C","status":"affected"},{"version":"WCD9380","status":"affected"},{"version":"WCD9385","status":"affected"},{"version":"WSA8835","status":"affected"},{"version":"WSA8840","status":"affected"},{"version":"WSA8845","status":"affected"},{"version":"WSA8845H","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"product-security@qualcomm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T11:50:55.414818Z","id":"CVE-2026-57559","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"product-security@qualcomm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:cologne_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8FF959C0-5AAB-4DC5-AE8F-4EFA21A00B5E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:cologne:-:*:*:*:*:*:*:*","matchCriteriaId":"E31E0C48-FB61-47C8-B28B-3A701E85E126"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6700_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"82B82E87-F3F4-466F-A76B-C8809121FF6F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6700:-:*:*:*:*:*:*:*","matchCriteriaId":"419A132E-E42C-4395-B74B-788A39DF1D13"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_6900_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E670F500-9B71-4BBE-B5DA-221D35803C89"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_6900:-:*:*:*:*:*:*:*","matchCriteriaId":"9ADEB5C5-B79A-4F45-B7D3-75945B38DB6C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:fastconnect_7800_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B3053D68-C5D8-4D47-A4F0-9F3AF2289E1D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:fastconnect_7800:-:*:*:*:*:*:*:*","matchCriteriaId":"638DBC7F-456F-487D-BED2-2214DFF8BEE2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iqx5121_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"499A2520-436C-4B12-849D-98B94088CCDE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iqx5121:-:*:*:*:*:*:*:*","matchCriteriaId":"4C34A825-C928-4F8F-B076-19F8787A3440"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:iqx7181_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F58C10B5-2BB1-4A8F-AF4B-2EC791C9FBBE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:iqx7181:-:*:*:*:*:*:*:*","matchCriteriaId":"9EE22328-BBF8-473C-8F89-58AEF8CC9D75"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qca0000_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CC941093-1A7C-47B2-AB3B-05AE4AE2FBE4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qca0000:-:*:*:*:*:*:*:*","matchCriteriaId":"7A2AA834-C17C-4E0E-A510-795818041E47"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm5430_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4EC5F81B-AA24-4E3C-9FC8-53E010AC977E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm5430:-:*:*:*:*:*:*:*","matchCriteriaId":"B5C66DAD-0D85-46B8-92D7-6D68B9429E9A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:qcm6490_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"ADD6D51E-5787-42A6-8A02-4EBBAFFF9C94"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:qcm6490:-:*:*:*:*:*:*:*","matchCriteriaId":"99AA0291-B822-4CAD-BA17-81B632FC3FEF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:video_collaboration_vc3_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DD4946C6-778F-4542-AB77-C9B86AF25C05"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:video_collaboration_vc3_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"6F1D604A-4530-42B3-80A0-58A82D658DDD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:sc8380xp_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14E3FE58-7F1C-4F5C-B62D-0CF124E14AB2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:sc8380xp:-:*:*:*:*:*:*:*","matchCriteriaId":"FFCB0BBA-3F81-4FCA-B3DE-190C46DA50DB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_x2_elite_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7FEA3409-34AF-4FFB-AB58-ABE600FBA9FC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_x2_elite:-:*:*:*:*:*:*:*","matchCriteriaId":"025C1550-D3DC-434A-91E4-EBFE004F3628"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:snapdragon_reality_elite_platform_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"08ACBE23-DBE3-4AE0-B9EA-F3A73290D5F0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:snapdragon_reality_elite_platform:-:*:*:*:*:*:*:*","matchCriteriaId":"3F82A885-4CAB-44F2-85FA-3D581283A936"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9370_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1295D869-F4DD-4766-B4AA-3513752F43B4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9370:-:*:*:*:*:*:*:*","matchCriteriaId":"B98784DC-3143-4D38-AD28-DBBDCCAB4272"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9375_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"34143ABA-7D09-429F-A65C-3A33438BF62C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9375:-:*:*:*:*:*:*:*","matchCriteriaId":"9D56DFE3-5EF1-4B23-BBD5-0203FBF9CCEC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9378c_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"95D79E3A-1978-4B23-B60B-2BD47FEDF5C2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9378c:-:*:*:*:*:*:*:*","matchCriteriaId":"91B32C89-3238-4FDF-BB3F-F6BAE829769B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9380_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"70292B01-617F-44AD-AF77-1AFC1450523D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9380:-:*:*:*:*:*:*:*","matchCriteriaId":"FA94C6D6-85DB-4031-AAF4-C399019AE16D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wcd9385_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"92B17201-8185-47F1-9720-5AB4ECD11B22"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wcd9385:-:*:*:*:*:*:*:*","matchCriteriaId":"E1FA2EB9-416F-4D69-8786-386CC73978AE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F80BC68E-7476-4A40-9F48-53722FE9A5BF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8835:-:*:*:*:*:*:*:*","matchCriteriaId":"6B36F4B2-BAA3-45AD-9967-0EB482C99708"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8840_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA33DE15-C177-43B3-AD50-FF797753D12E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8840:-:*:*:*:*:*:*:*","matchCriteriaId":"AE1A5841-5BCB-4033-ACB9-23F3FCA65309"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8845_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5B47BF35-3AA0-4667-842E-19B0FE30BF3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8845:-:*:*:*:*:*:*:*","matchCriteriaId":"8A071672-9405-4418-9141-35CEADBB65AF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qualcomm:wsa8845h_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB7CF473-8B25-4851-91F2-1BD693CCDC85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:wsa8845h:-:*:*:*:*:*:*:*","matchCriteriaId":"91E591F2-8F72-4A5A-9264-2742EB2DABDA"}]}]}],"references":[{"url":"https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2026-bulletin.html","source":"product-security@qualcomm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-59357","sourceIdentifier":"security@vmware.com","published":"2026-10-06T07:16:59.253","lastModified":"2026-10-06T16:00:36.547","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient verification of data authenticity (CWE-345) in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 (inclusive) allows an authenticated UAA user to bypass the OAuth authorization-code exchange and establish an authenticated external-OIDC browser session, via submitting a UAA access token or a cross-client ID token as the callback’s id_token parameter.\n\n\n\nThe issue only manifests when a UAA zone is configured with an OIDC identity provider whose issuer exactly matches that zone’s own /oauth/token endpoint (a “self-UAA” OIDC configuration). In this configuration, the callback takes a supplied id_token directly instead of requiring the authorization code exchange, and does not verify that the token was actually issued as an ID token for the specific self-OIDC relying-party client. An attacker holding any valid UAA JWT for themselves — including a plain access token with only uaa.user scope, or a valid ID token issued to an unrelated client such as cf — can present it as the callback’s id_token and be authenticated into a mapped local (“shadow”) account. Because the resulting session is not verified against the originating token’s true audience or user_id, its effective privilege depends entirely on the shadow account’s group memberships, which can include administrative scopes such as clients.write.\n\n\n\nExploitation requires a valid UAA user JWT, a valid browser login state for the target zone, and the presence of a self-referential OIDC provider configuration — this is not a pre-authentication vulnerability, and does not by itself grant privileges beyond those already held by the mapped shadow account."}],"affected":[{"source":"security@vmware.com","affectedData":[{"vendor":"Cloud Foundry","product":"UAA","repo":"https://github.com/cloudfoundry/uaa","versions":[{"version":"4.5.0","lessThanOrEqual":"79.6.0","versionType":"semver","status":"affected"},{"version":"79.7.0","versionType":"semver","status":"unaffected"}]},{"vendor":"Cloud Foundry","product":"cf-deployment","repo":"https://github.com/cloudfoundry/cf-deployment","versions":[{"version":"0","lessThanOrEqual":"60.4.0","versionType":"semver","status":"affected"},{"version":"60.5.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@vmware.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T11:47:58.110314Z","id":"CVE-2026-59357","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@vmware.com","type":"Secondary","description":[{"lang":"en","value":"CWE-345"}]}],"references":[{"url":"https://www.cloudfoundry.org/blog/cve-2026-59357-self-uaa-oidc-configuration-allows-jwt-injection-to-establish-unauthorized-sessions/","source":"security@vmware.com"}]}},{"cve":{"id":"CVE-2026-59358","sourceIdentifier":"security@vmware.com","published":"2026-10-06T07:16:59.460","lastModified":"2026-10-06T16:00:36.547","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged client_credentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer credential on a client_credentials grant request in place of the client’s configured secret.\n\n\n\nUAA’s client_credentials handling does not verify that the Bearer credential supplied for client authentication is actually a client credential (a client secret or a valid configured client authentication method); it accepts any valid access token whose client_id matches the request. A token obtained by a normal end user through a public authorization_code + PKCE flow — scoped only to uaa.user, carrying a user_id, and recording client_auth_method=none — satisfies this check. That user token cannot itself administer OAuth clients (POST /oauth/clients correctly returns 403), but when replayed as Bearer authentication on a client_credentials request for the same client, UAA issues a new client-only token carrying the client’s full authorities, such as clients.write. An attacker can use that token to create arbitrary new OAuth clients, including clients with attacker-chosen authorities, without ever possessing the client’s actual secret.\n\n\n\nExploitation requires a valid user access token (the attacker’s own) for a client that is configured to support both a public, user-facing authorization flow and the client_credentials grant type on the same client_id — a non-default combination. Practical impact scales with the authorities assigned to that client."}],"affected":[{"source":"security@vmware.com","affectedData":[{"vendor":"Cloud Foundry","product":"UAA","repo":"https://github.com/cloudfoundry/uaa","versions":[{"version":"3.7.0","lessThanOrEqual":"79.6.0","versionType":"semver","status":"affected"},{"version":"79.7.0","versionType":"semver","status":"unaffected"}]},{"vendor":"Cloud Foundry","product":"cf-deployment","repo":"https://github.com/cloudfoundry/cf-deployment","versions":[{"version":"0","lessThanOrEqual":"60.4.0","versionType":"semver","status":"affected"},{"version":"60.5.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@vmware.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:32:48.583303Z","id":"CVE-2026-59358","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@vmware.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://www.cloudfoundry.org/blog/cve-2026-59358-uaa-oauth-token-endpoint-vulnerability-allows-user-access-token-reuse-for-client_credentials-grant-type/","source":"security@vmware.com"}]}},{"cve":{"id":"CVE-2026-86786","sourceIdentifier":"contact@wpscan.com","published":"2026-10-06T07:16:59.620","lastModified":"2026-10-06T15:18:12.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the title, excerpt and permalink of non-public posts, including drafts, pending, scheduled, private and trashed posts, as well as post revisions and media metadata."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Slider Pro","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"1.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:31:34.152612Z","id":"CVE-2026-86786","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/0645bcad-740e-452e-9d73-3e47ddd83f8b/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-89289","sourceIdentifier":"contact@wpscan.com","published":"2026-10-06T07:16:59.737","lastModified":"2026-10-06T15:18:12.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Fast Courier  WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Fast Courier","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"5.2.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:31:58.417839Z","id":"CVE-2026-89289","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/716b6d58-a816-43f2-8a1a-b9fe4f2f9d1d/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-94270","sourceIdentifier":"contact@wpscan.com","published":"2026-10-06T07:16:59.857","lastModified":"2026-10-06T15:18:12.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and ships with that verification disabled by default, allowing unauthenticated attackers to mark an unpaid order as paid, or to cancel or refund an existing order."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Deema Payment Gateway","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"1.1.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:31:23.678492Z","id":"CVE-2026-94270","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://wpscan.com/vulnerability/9db2eff1-d605-44c3-aa3e-f65410f8e87b/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-94271","sourceIdentifier":"contact@wpscan.com","published":"2026-10-06T07:16:59.973","lastModified":"2026-10-06T15:18:12.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does not check the payment status or amount, allowing unauthenticated users to have orders marked as paid without any payment being taken."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Deema Payment Gateway","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"1.1.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:32:22.366721Z","id":"CVE-2026-94271","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://wpscan.com/vulnerability/9455978a-b406-4456-9054-a516c117bdbf/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-94278","sourceIdentifier":"contact@wpscan.com","published":"2026-10-06T07:17:00.080","lastModified":"2026-10-06T15:18:12.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored site data that referenced the old file path."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"File Media Renamer","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"1.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:31:47.678465Z","id":"CVE-2026-94278","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://wpscan.com/vulnerability/4967e8c2-ee27-4d26-955c-f7dfb6cd6942/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-94293","sourceIdentifier":"info@cert.vde.com","published":"2026-10-06T07:17:00.193","lastModified":"2026-10-06T18:16:58.550","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints."}],"affected":[{"source":"info@cert.vde.com","affectedData":[{"vendor":"Murrelektronik","product":"Software AAS Edge Client all versions","defaultStatus":"unaffected","versions":[{"version":"0.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"info@cert.vde.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"info@cert.vde.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:20:08.746845Z","id":"CVE-2026-94293","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"info@cert.vde.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://www.certvde.com/en/advisories/VDE-2026-108/","source":"info@cert.vde.com"}]}},{"cve":{"id":"CVE-2026-94299","sourceIdentifier":"contact@wpscan.com","published":"2026-10-06T07:17:00.360","lastModified":"2026-10-06T15:18:12.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where that secret has been left at its default empty value."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"elegro Crypto Payment","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"1.0.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:32:08.762478Z","id":"CVE-2026-94299","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://wpscan.com/vulnerability/7eb85c65-8dab-46e1-b1df-e5d966029b18/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-105305","sourceIdentifier":"secalert@redhat.com","published":"2026-10-06T08:16:35.697","lastModified":"2026-10-06T15:09:20.387","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by a client configuration. This allows an attacker who has stolen a user's password to bypass mandatory multi-factor authentication and gain unauthorized access to the Keycloak Admin REST API."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhbk/keycloak-rhel9","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T12:44:09.472814Z","id":"CVE-2026-105305","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-105305","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545801","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-105807","sourceIdentifier":"cna@vuldb.com","published":"2026-10-06T08:16:36.840","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the file searchquery.php. Performing a manipulation results in sql injection. The attack can be initiated remotely."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Simple Student Information System","cpes":["cpe:2.3:a:sourcecodester:simple_student_information_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T12:54:11.940111Z","id":"CVE-2026-105807","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/lshhhhh318/cve/issues/1","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105807","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/992606","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413812","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413812/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-85153","sourceIdentifier":"vdisclose@cert-in.org.in","published":"2026-10-06T08:16:37.227","lastModified":"2026-10-06T15:03:59.427","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker could exploit this vulnerability by decompiling the distributed application package and extracting the embedded credentials and cryptographic keys.\n\n\nSuccessful exploitation of this vulnerability could allow the attacker to gain unauthorized access to backend and cloud resources and forge client requests on the targeted system."}],"affected":[{"source":"vdisclose@cert-in.org.in","affectedData":[{"vendor":"Schmooze","product":"Schmooze dating mobile Application","defaultStatus":"unaffected","versions":[{"version":"Android versions 5.2.7 (build 452) and prior","status":"affected"},{"version":"iOS versions 5.2.1 and prior","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vdisclose@cert-in.org.in","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T11:46:54.410367Z","id":"CVE-2026-85153","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vdisclose@cert-in.org.in","type":"Secondary","description":[{"lang":"en","value":"CWE-321"}]}],"references":[{"url":"https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0489","source":"vdisclose@cert-in.org.in"}]}},{"cve":{"id":"CVE-2026-100518","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:37.283","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WebFactory","product":"Advanced Google reCAPTCHA","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"advanced-google-recaptcha","versions":[{"version":"n/a","lessThanOrEqual":"5.40","versionType":"custom","status":"affected","changes":[{"at":"5.41","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:10:25.262382Z","id":"CVE-2026-100518","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-288"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/advanced-google-recaptcha/vulnerability/wordpress-advanced-google-recaptcha-plugin-5-40-broken-authentication-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-102387","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:37.463","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"XServer","product":"Xserver Migrator","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"xserver-migrator","versions":[{"version":"n/a","lessThanOrEqual":"1.6.6","versionType":"custom","status":"affected","changes":[{"at":"1.6.7","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:10:20.680579Z","id":"CVE-2026-102387","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-497"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/xserver-migrator/vulnerability/wordpress-xserver-migrator-plugin-1-6-6-sensitive-data-exposure-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-102915","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:37.617","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Broken Access Control in WPO365 <= 44.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Marco van Wieren","product":"WPO365","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wpo365-login","versions":[{"version":"n/a","lessThanOrEqual":"44.1","versionType":"custom","status":"affected","changes":[{"at":"45.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:10:15.471881Z","id":"CVE-2026-102915","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wpo365-login/vulnerability/wordpress-wpo365-plugin-44-1-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-103346","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:37.760","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects Payflex Payment Gateway: from n/a through 2.7.1."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Tomlister","product":"Payflex Payment Gateway","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"payflex-payment-gateway","versions":[{"version":"0","lessThanOrEqual":"2.7.1","versionType":"custom","status":"affected","changes":[{"at":"2.8.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:15:11.996269Z","id":"CVE-2026-103346","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/payflex-payment-gateway/vulnerability/wordpress-payflex-payment-gateway-plugin-2-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-104385","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:37.917","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Adrian Tobey","product":"Groundhogg","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"groundhogg","versions":[{"version":"n/a","lessThanOrEqual":"4.8.3","versionType":"custom","status":"affected","changes":[{"at":"4.9","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:10:05.003476Z","id":"CVE-2026-104385","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-201"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/groundhogg/vulnerability/wordpress-groundhogg-plugin-4-8-3-sensitive-data-exposure-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-104387","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:38.077","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"blubrry","product":"PowerPress Podcasting","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"powerpress","versions":[{"version":"n/a","lessThanOrEqual":"11.17.9","versionType":"custom","status":"affected","changes":[{"at":"11.17.11","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:09:58.259812Z","id":"CVE-2026-104387","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/powerpress/vulnerability/wordpress-powerpress-podcasting-plugin-11-17-9-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-104394","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:38.230","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Syed Balkhi","product":"Charitable","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"charitable","versions":[{"version":"n/a","lessThanOrEqual":"1.8.12.3","versionType":"custom","status":"affected","changes":[{"at":"1.8.13","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:09:53.046561Z","id":"CVE-2026-104394","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/charitable/vulnerability/wordpress-charitable-plugin-1-8-12-3-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-104395","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:38.570","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"picu","product":"picu","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"picu","versions":[{"version":"n/a","lessThanOrEqual":"3.10.1","versionType":"custom","status":"affected","changes":[{"at":"3.10.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:18:41.642913Z","id":"CVE-2026-104395","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/picu/vulnerability/wordpress-picu-plugin-3-10-1-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-104399","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:38.860","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data.\n\nThis issue affects Motors: from n/a through 1.4.124."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"StylemixThemes","product":"Motors","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"motors-car-dealership-classified-listings","versions":[{"version":"n/a","lessThanOrEqual":"1.4.124","versionType":"custom","status":"affected","changes":[{"at":"1.4.125","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:08:51.212518Z","id":"CVE-2026-104399","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-201"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/motors-car-dealership-classified-listings/vulnerability/wordpress-motors-plugin-1-4-124-sensitive-data-exposure-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-104405","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:39.013","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Nexcess","product":"GiveWP","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"give","versions":[{"version":"n/a","lessThanOrEqual":"4.17.0","versionType":"custom","status":"affected","changes":[{"at":"4.18.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:18:23.575277Z","id":"CVE-2026-104405","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-4-17-0-privilege-escalation-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-104406","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:39.163","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Broken Access Control in picu <= 3.10.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"picu","product":"picu","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"picu","versions":[{"version":"n/a","lessThanOrEqual":"3.10.1","versionType":"custom","status":"affected","changes":[{"at":"3.10.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:18:18.380833Z","id":"CVE-2026-104406","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/picu/vulnerability/wordpress-picu-plugin-3-10-1-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-104670","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:39.317","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThimPress","product":"LearnPress","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"learnpress","versions":[{"version":"n/a","lessThanOrEqual":"4.4.9","versionType":"custom","status":"affected","changes":[{"at":"4.4.9.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:18:13.383576Z","id":"CVE-2026-104670","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/learnpress/vulnerability/wordpress-learnpress-plugin-4-4-9-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-104672","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:39.483","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Nexcess","product":"GiveWP","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"give","versions":[{"version":"n/a","lessThanOrEqual":"4.17.0","versionType":"custom","status":"affected","changes":[{"at":"4.18.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:18:09.619948Z","id":"CVE-2026-104672","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-4-17-0-cross-site-scripting-xss-vulnerability-2?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-104747","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:39.643","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated PHP Object Injection in Haaken <= 1.5 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Edge-Themes","product":"Haaken","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/themes","packageName":"haaken","versions":[{"version":"n/a","lessThanOrEqual":"1.5","versionType":"custom","status":"affected","changes":[{"at":"1.6","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:18:36.316233Z","id":"CVE-2026-104747","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/haaken/vulnerability/wordpress-haaken-theme-1-5-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-104757","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:39.810","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Javier Carazo","product":"Import and export users and customers","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"import-users-from-csv-with-meta","versions":[{"version":"n/a","lessThanOrEqual":"2.5.5","versionType":"custom","status":"affected","changes":[{"at":"2.5.7","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:09:49.955086Z","id":"CVE-2026-104757","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/import-users-from-csv-with-meta/vulnerability/wordpress-import-and-export-users-and-customers-plugin-2-5-5-privilege-escalation-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-104814","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:39.973","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"epiphyt","product":"Form Block","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"form-block","versions":[{"version":"n/a","lessThanOrEqual":"1.8.1","versionType":"custom","status":"affected","changes":[{"at":"1.8.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:09:45.461345Z","id":"CVE-2026-104814","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/form-block/vulnerability/wordpress-form-block-plugin-1-8-1-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-105057","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:40.133","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Ben Marshall","product":"Zero Spam","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"zero-spam","versions":[{"version":"n/a","lessThanOrEqual":"5.7.11","versionType":"custom","status":"affected","changes":[{"at":"5.7.12","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:09:40.887656Z","id":"CVE-2026-105057","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-290"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/zero-spam/vulnerability/wordpress-zero-spam-plugin-5-7-11-bypass-vulnerability-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-105058","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:40.293","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"John James Jacoby","product":"WP User Profiles","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-user-profiles","versions":[{"version":"n/a","lessThanOrEqual":"2.7.3","versionType":"custom","status":"affected","changes":[{"at":"2.7.4","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:09:33.546800Z","id":"CVE-2026-105058","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-user-profiles/vulnerability/wordpress-wp-user-profiles-plugin-2-7-3-privilege-escalation-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-105059","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:40.440","lastModified":"2026-10-12T15:17:06.773","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in royalnavneet Delete All Comments of wordpress delete-all-comments-of-website allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Delete All Comments of wordpress: from n/a through 7.1."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"royalnavneet","product":"Delete All Comments of wordpress","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"delete-all-comments-of-website","versions":[{"version":"0","lessThanOrEqual":"7.1","versionType":"custom","status":"affected","changes":[{"at":"7.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:09:26.028121Z","id":"CVE-2026-105059","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/delete-all-comments-of-website/vulnerability/wordpress-delete-all-comments-of-wordpress-plugin-7-1-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-105061","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:40.597","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Bởi brandtoss","product":"WP Mailster","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-mailster","versions":[{"version":"n/a","lessThanOrEqual":"1.9.0.0","versionType":"custom","status":"affected","changes":[{"at":"1.9.1.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:09:02.345703Z","id":"CVE-2026-105061","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-mailster/vulnerability/wordpress-wp-mailster-plugin-1-9-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-105070","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:40.743","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Dimitri Grassi","product":"Salon booking system","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"salon-booking-system","versions":[{"version":"n/a","lessThanOrEqual":"10.31.7","versionType":"custom","status":"affected","changes":[{"at":"10.31.9","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:09:11.972393Z","id":"CVE-2026-105070","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/salon-booking-system/vulnerability/wordpress-salon-booking-system-plugin-10-31-7-privilege-escalation-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-105071","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:40.893","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration &amp; Cloning <= 1.5.17 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Royal Plugins","product":"SiteVault – Backup, Restore, Migration &amp; Cloning","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"sitevault-backup-restore-migration","versions":[{"version":"n/a","lessThanOrEqual":"1.5.17","versionType":"custom","status":"affected","changes":[{"at":"1.5.18","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:09:20.576620Z","id":"CVE-2026-105071","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-201"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/sitevault-backup-restore-migration/vulnerability/wordpress-sitevault-backup-restore-migration-cloning-plugin-1-5-17-sensitive-data-exposure-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-105317","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:41.043","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Cozmoslabs","product":"Paid Member Subscriptions","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"paid-member-subscriptions","versions":[{"version":"n/a","lessThanOrEqual":"3.1.1","versionType":"custom","status":"affected","changes":[{"at":"3.1.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:08:55.608259Z","id":"CVE-2026-105317","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/paid-member-subscriptions/vulnerability/wordpress-paid-member-subscriptions-plugin-3-1-1-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-105808","sourceIdentifier":"cna@vuldb.com","published":"2026-10-06T09:17:41.193","lastModified":"2026-10-09T02:16:55.230","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in SourceCodester Simple Student Information System 1.0. This vulnerability affects the function clean of the file searchresults.php. Executing a manipulation of the argument searchbox can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Simple Student Information System","cpes":["cpe:2.3:a:sourcecodester:simple_student_information_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T00:57:07.392658Z","id":"CVE-2026-105808","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/wsx138/cve/issues/6","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105808","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/992608","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/992613","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413813","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413813/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105809","sourceIdentifier":"cna@vuldb.com","published":"2026-10-06T09:17:41.410","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file /register.php of the component Profile Field Handler. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Simple Student Information System","cpes":["cpe:2.3:a:sourcecodester:simple_student_information_system:*:*:*:*:*:*:*:*"],"modules":["Profile Field Handler"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T11:43:35.736578Z","id":"CVE-2026-105809","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/wsx138/cve/issues/7","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105809","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/992609","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413814","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413814/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105879","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:41.620","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.2."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Crocoblock","product":"JetElements For Elementor","defaultStatus":"unaffected","collectionURL":"https://crocoblock.com","packageName":"jet-elements","versions":[{"version":"0","lessThanOrEqual":"2.9.2.2","versionType":"custom","status":"affected","changes":[{"at":"2.9.2.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:15:06.995292Z","id":"CVE-2026-105879","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/jet-elements/vulnerability/wordpress-jetelements-for-elementor-plugin-2-9-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-25433","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:41.777","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Tobias @Saleswonder.biz","product":"WP2LEADS","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp2leads","versions":[{"version":"n/a","lessThanOrEqual":"3.5.7","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:14:57.119679Z","id":"CVE-2026-25433","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp2leads/vulnerability/wordpress-wp2leads-plugin-3-5-7-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-25434","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:41.930","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Tobias @Saleswonder.biz","product":"WP2LEADS","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp2leads","versions":[{"version":"n/a","lessThanOrEqual":"3.5.7","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:15:00.586380Z","id":"CVE-2026-25434","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp2leads/vulnerability/wordpress-wp2leads-plugin-3-5-7-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-32557","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:42.080","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated SQL Injection in WooCommerce Appointments <= 5.3.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Bot Verification bookingwp.com: Verifying that you are not a robot...","product":"WooCommerce Appointments","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"woocommerce-appointments","versions":[{"version":"n/a","lessThanOrEqual":"5.3.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:21:55.625553Z","id":"CVE-2026-32557","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/woocommerce-appointments/vulnerability/wordpress-woocommerce-appointments-plugin-5-3-2-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-32568","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:42.230","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"JMAPlugins","product":"WooCommerce Designer Pro","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wc-designer-pro","versions":[{"version":"n/a","lessThanOrEqual":"1.9.33","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:21:27.902037Z","id":"CVE-2026-32568","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wc-designer-pro/vulnerability/wordpress-woocommerce-designer-pro-plugin-1-9-33-remote-code-execution-rce-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-32569","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:42.397","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Joomunited","product":"WP Media folder","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-media-folder","versions":[{"version":"n/a","lessThanOrEqual":"6.2.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:24:34.980352Z","id":"CVE-2026-32569","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-media-folder/vulnerability/wordpress-wp-media-folder-plugin-6-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-32570","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:42.550","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App (PWA) <= 1.6.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"DaftPlug","product":"Progressify - Progressive Web App (PWA)","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"daftplug-progressify","versions":[{"version":"n/a","lessThanOrEqual":"1.6.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:24:21.893009Z","id":"CVE-2026-32570","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/daftplug-progressify/vulnerability/wordpress-progressify-progressive-web-app-pwa-plugin-1-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-32571","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:42.703","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Colabrio","product":"Ohio Extra","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"ohio-extra","versions":[{"version":"n/a","lessThanOrEqual":"3.6.8","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:24:25.532412Z","id":"CVE-2026-32571","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/ohio-extra/vulnerability/wordpress-ohio-extra-plugin-3-6-8-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-32572","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:42.847","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"weDevs","product":"WP User Frontend Pro","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-user-frontend-pro","versions":[{"version":"n/a","lessThanOrEqual":"4.2.13","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:24:10.388109Z","id":"CVE-2026-32572","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-user-frontend-pro/vulnerability/wordpress-wp-user-frontend-pro-plugin-4-2-13-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-32574","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:43.000","lastModified":"2026-10-13T17:17:40.257","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EDGARROJAS Smart Forms smart-forms allows DOM-Based XSS.This issue affects Smart Forms: from n/a through 2.6.104."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"EDGARROJAS","product":"Smart Forms","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"smart-forms","versions":[{"version":"0","lessThanOrEqual":"2.6.104","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:24:14.623002Z","id":"CVE-2026-32574","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/smart-forms/vulnerability/wordpress-smart-forms-plugin-2-6-104-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-32575","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:43.150","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Fantastic Plugins","product":"SUMO Affiliates Pro","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"affs","versions":[{"version":"n/a","lessThanOrEqual":"11.7.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:24:18.314530Z","id":"CVE-2026-32575","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/affs/vulnerability/wordpress-sumo-affiliates-pro-plugin-11-7-0-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-32577","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:43.297","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"N-Media","product":"Frontend File Manager","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"nmedia-user-file-uploader","versions":[{"version":"n/a","lessThanOrEqual":"23.6","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:24:07.135926Z","id":"CVE-2026-32577","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/nmedia-user-file-uploader/vulnerability/wordpress-frontend-file-manager-plugin-23-6-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-32578","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:43.460","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"techsupport","product":"ECPay Ecommerce for WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"ecpay-ecommerce-for-woocommerce","versions":[{"version":"n/a","lessThanOrEqual":"1.1.2606090","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:24:30.472799Z","id":"CVE-2026-32578","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/ecpay-ecommerce-for-woocommerce/vulnerability/wordpress-ecpay-ecommerce-for-woocommerce-plugin-1-1-2606090-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-32579","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:43.613","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.9 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"kognetiks","product":"Kognetiks Chatbot for WordPress","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"chatbot-chatgpt","versions":[{"version":"n/a","lessThanOrEqual":"2.4.9","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:21:49.717916Z","id":"CVE-2026-32579","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/chatbot-chatgpt/vulnerability/wordpress-kognetiks-chatbot-for-wordpress-plugin-2-4-8-arbitrary-file-upload-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-32580","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:43.780","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"wpgenie","product":"WooCommerce Lottery","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wc-lottery","versions":[{"version":"n/a","lessThanOrEqual":"2.2.9","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:14:44.671384Z","id":"CVE-2026-32580","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wc-lottery/vulnerability/wordpress-woocommerce-lottery-plugin-2-2-9-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-32581","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:43.930","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"mooberrydreams","product":"Mooberry Book Manager","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"mooberry-book-manager","versions":[{"version":"4.16.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:14:39.078274Z","id":"CVE-2026-32581","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/mooberry-book-manager/vulnerability/wordpress-mooberry-book-manager-plugin-4-16-2-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39719","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:44.077","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"DeKnows","product":"PDF Smart Viewer for Elementor","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"pdf-smart-viewer-for-elementor","versions":[{"version":"n/a","lessThanOrEqual":"1.0.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:14:30.962169Z","id":"CVE-2026-39719","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/pdf-smart-viewer-for-elementor/vulnerability/wordpress-pdf-smart-viewer-for-elementor-plugin-1-0-4-server-side-request-forgery-ssrf-vulnerability-2?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39720","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:44.227","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"mapster","product":"Mapster WP Maps","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"mapster-wp-maps","versions":[{"version":"n/a","lessThanOrEqual":"2.0.4","versionType":"custom","status":"affected","changes":[{"at":"2.0.5","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:14:25.931569Z","id":"CVE-2026-39720","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/mapster-wp-maps/vulnerability/wordpress-mapster-wp-maps-plugin-2-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39722","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:44.380","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in WPLMS  <= 4.972 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"VibeThemes","product":"WPLMS","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/themes","packageName":"wplms","versions":[{"version":"n/a","lessThanOrEqual":"4.972","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:14:22.637005Z","id":"CVE-2026-39722","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/wplms/vulnerability/wordpress-wplms-theme-4-972-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39724","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:44.533","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"veppa","product":"HTTP Requests Manager","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"http-requests-manager","versions":[{"version":"n/a","lessThanOrEqual":"1.3.11","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:14:18.839013Z","id":"CVE-2026-39724","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/http-requests-manager/vulnerability/wordpress-http-requests-manager-plugin-1-3-11-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39725","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:44.683","lastModified":"2026-10-09T11:17:02.597","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-1829."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-39726","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:44.833","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Lumise Product Designer <= 2.1.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Lumise NEO","product":"Lumise Product Designer","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"lumise","versions":[{"version":"n/a","lessThanOrEqual":"2.1.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:14:11.029765Z","id":"CVE-2026-39726","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/lumise/vulnerability/wordpress-lumise-product-designer-plugin-2-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39727","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:44.987","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Saravana Kumar K","product":"WC Fields Factory","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wc-fields-factory","versions":[{"version":"n/a","lessThanOrEqual":"4.1.12","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:14:06.440520Z","id":"CVE-2026-39727","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wc-fields-factory/vulnerability/wordpress-wc-fields-factory-plugin-4-1-12-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39728","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:45.140","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Server Side Request Forgery (SSRF) in Instapage Plugin <= 3.7.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"instapagedev","product":"Instapage Plugin","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"instapage","versions":[{"version":"n/a","lessThanOrEqual":"3.7.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:13:52.371845Z","id":"CVE-2026-39728","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/instapage/vulnerability/wordpress-instapage-plugin-plugin-3-7-2-server-side-request-forgery-ssrf-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39729","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:45.287","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Sensitive Data Exposure in Edwiser Bridge <= 4.3.4 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WisdmLabs","product":"Edwiser Bridge","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"edwiser-bridge","versions":[{"version":"n/a","lessThanOrEqual":"4.3.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:13:45.472645Z","id":"CVE-2026-39729","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-201"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/edwiser-bridge/vulnerability/wordpress-edwiser-bridge-plugin-4-3-4-sensitive-data-exposure-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39730","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:45.433","lastModified":"2026-10-07T16:17:47.827","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wise Chat: from n/a through 3.4.3."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Marcin","product":"Wise Chat","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wise-chat","versions":[{"version":"0","lessThanOrEqual":"3.4.3","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:13:38.171053Z","id":"CVE-2026-39730","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wise-chat/vulnerability/wordpress-wise-chat-plugin-3-4-1-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39731","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:45.583","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"code4life","product":"Database for CF7","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"database-for-cf7","versions":[{"version":"n/a","lessThanOrEqual":"1.2.6","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:13:02.713382Z","id":"CVE-2026-39731","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/database-for-cf7/vulnerability/wordpress-database-for-cf7-plugin-1-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39745","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:45.730","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"bestweblayout","product":"Contact Form to DB by BestWebSoft","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"contact-form-to-db","versions":[{"version":"n/a","lessThanOrEqual":"1.7.6","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:12:58.575551Z","id":"CVE-2026-39745","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/contact-form-to-db/vulnerability/wordpress-contact-form-to-db-by-bestwebsoft-plugin-1-7-6-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39746","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:45.883","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated SQL Injection in Booknetic <= 4.8.5 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"fs-code","product":"Booknetic","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"booknetic","versions":[{"version":"n/a","lessThanOrEqual":"4.8.5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:13:10.363990Z","id":"CVE-2026-39746","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/booknetic/vulnerability/wordpress-booknetic-plugin-4-8-5-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39747","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:46.033","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber SQL Injection in Woffice <= 5.4.35 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WofficeIO","product":"Woffice","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/themes","packageName":"woffice","versions":[{"version":"n/a","lessThanOrEqual":"5.4.35","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:13:15.780768Z","id":"CVE-2026-39747","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/woffice/vulnerability/wordpress-woffice-theme-5-4-35-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39748","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:46.180","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemeMove","product":"EduMall","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/themes","packageName":"edumall","versions":[{"version":"n/a","lessThanOrEqual":"4.5.3","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:12:53.200120Z","id":"CVE-2026-39748","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/edumall/vulnerability/wordpress-edumall-theme-4-5-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39749","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:46.333","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"digitalpoint","product":"App for Cloudflare®","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"app-for-cf","versions":[{"version":"n/a","lessThanOrEqual":"1.10.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:13:20.248321Z","id":"CVE-2026-39749","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/app-for-cf/vulnerability/wordpress-app-for-cloudflare-plugin-1-10-1-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39750","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:46.487","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"weDevs","product":"StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"storegrowth-sales-booster","versions":[{"version":"n/a","lessThanOrEqual":"2.0.6","versionType":"custom","status":"affected","changes":[{"at":"2.1.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:12:48.651168Z","id":"CVE-2026-39750","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/storegrowth-sales-booster/vulnerability/wordpress-storegrowth-smart-sales-booster-for-woocommerce-bogo-upsells-direct-checkout-quick-view-side-cart-plugin-2-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39751","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:46.640","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Broken Access Control in PayPlug for WooCommerce (Official) <= 3.1.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Payplug","product":"PayPlug for WooCommerce (Official)","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"payplug","versions":[{"version":"n/a","lessThanOrEqual":"3.1.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:13:26.741460Z","id":"CVE-2026-39751","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/payplug/vulnerability/wordpress-payplug-for-woocommerce-official-plugin-3-1-0-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39752","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:46.790","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Arbitrary File Deletion in Jobs for WordPress <= 2.8.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"BlueGlass Interactive AG","product":"Jobs for WordPress","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"job-postings","versions":[{"version":"n/a","lessThanOrEqual":"2.8.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:21:42.608828Z","id":"CVE-2026-39752","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/job-postings/vulnerability/wordpress-jobs-for-wordpress-plugin-2-8-2-arbitrary-file-deletion-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39753","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:46.940","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Privilege Escalation in Taskbot <= 6.6 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"AmentoTech","product":"Taskbot","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"taskbot","versions":[{"version":"n/a","lessThanOrEqual":"6.6","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:21:15.547780Z","id":"CVE-2026-39753","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/taskbot/vulnerability/wordpress-taskbot-plugin-6-6-privilege-escalation-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39754","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:47.087","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Arbitrary File Download in Piotnet Addons For Elementor <= 7.1.71 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"About Piotnet","product":"Piotnet Addons For Elementor","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"piotnet-addons-for-elementor","versions":[{"version":"n/a","lessThanOrEqual":"7.1.71","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:21:21.217876Z","id":"CVE-2026-39754","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/piotnet-addons-for-elementor/vulnerability/wordpress-piotnet-addons-for-elementor-plugin-7-1-71-arbitrary-file-download-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39755","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:47.237","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"revmakx","product":"WP Duplicate","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"local-sync","versions":[{"version":"n/a","lessThanOrEqual":"1.1.11","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:21:02.532547Z","id":"CVE-2026-39755","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/local-sync/vulnerability/wordpress-wp-duplicate-plugin-1-1-11-arbitrary-file-upload-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39756","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:47.387","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Insecure Direct Object References (IDOR) in Wappointment <= 2.7.7 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Wappointment team","product":"Wappointment","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wappointment","versions":[{"version":"n/a","lessThanOrEqual":"2.7.7","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:20:56.032671Z","id":"CVE-2026-39756","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wappointment/vulnerability/wordpress-wappointment-plugin-2-7-7-insecure-direct-object-references-idor-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39757","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:47.553","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"AmentoTech","product":"Taskbot","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"taskbot","versions":[{"version":"n/a","lessThanOrEqual":"6.6","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:20:51.027715Z","id":"CVE-2026-39757","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/taskbot/vulnerability/wordpress-taskbot-plugin-6-6-arbitrary-file-upload-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39758","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:47.707","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Midtrans-WooCommerce <= 2.32.3 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Midtrans","product":"Midtrans-WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"midtrans-woocommerce","versions":[{"version":"n/a","lessThanOrEqual":"2.32.3","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:20:45.419615Z","id":"CVE-2026-39758","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/midtrans-woocommerce/vulnerability/wordpress-midtrans-woocommerce-plugin-2-32-3-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39759","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:47.853","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"AmentoTech","product":"Workreap Core","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"workreap_core","versions":[{"version":"n/a","lessThanOrEqual":"3.4.5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:20:27.558541Z","id":"CVE-2026-39759","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/workreap_core/vulnerability/wordpress-workreap-core-plugin-3-4-5-arbitrary-file-upload-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39761","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:48.010","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"eLightUp","product":"Meta Box AIO","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"meta-box-aio","versions":[{"version":"n/a","lessThanOrEqual":"3.7.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:20:20.375981Z","id":"CVE-2026-39761","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/meta-box-aio/vulnerability/wordpress-meta-box-aio-plugin-3-7-1-privilege-escalation-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39762","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:48.160","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through 2.17.1."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Patterns In The Cloud","product":"Autoship Cloud for WooCommerce Subscription Products","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"autoship-cloud","versions":[{"version":"0","lessThanOrEqual":"2.17.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:24:03.207576Z","id":"CVE-2026-39762","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/autoship-cloud/vulnerability/wordpress-autoship-cloud-for-woocommerce-subscription-products-plugin-2-17-0-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39764","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:48.310","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments &amp; Services <= 1.0.19 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"RadiusTheme","product":"Radius Booking — Booking Calendar for Appointments &amp; Services","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"radius-booking","versions":[{"version":"n/a","lessThanOrEqual":"1.0.19","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:23:35.288938Z","id":"CVE-2026-39764","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/radius-booking/vulnerability/wordpress-radius-booking-booking-calendar-for-appointments-services-plugin-1-0-19-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39765","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:48.457","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Shop Manager Privilege Escalation in Challan <= 3.7.88 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WebAppick","product":"Challan","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"webappick-pdf-invoice-for-woocommerce","versions":[{"version":"n/a","lessThanOrEqual":"3.7.88","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:25:15.392948Z","id":"CVE-2026-39765","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/webappick-pdf-invoice-for-woocommerce/vulnerability/wordpress-challan-plugin-3-7-88-privilege-escalation-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39766","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:48.610","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"reputeinfosystems","product":"ARForms","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"arforms","versions":[{"version":"n/a","lessThanOrEqual":"7.1.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:25:10.369231Z","id":"CVE-2026-39766","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/arforms/vulnerability/wordpress-arforms-plugin-7-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39767","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:48.763","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Denial of Service Attack in WPBase Cache <= 5.5.6 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"baseapp","product":"WPBase Cache","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wpbase-cache","versions":[{"version":"n/a","lessThanOrEqual":"5.5.6","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:24:59.133875Z","id":"CVE-2026-39767","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wpbase-cache/vulnerability/wordpress-wpbase-cache-plugin-5-5-6-denial-of-service-attack-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39768","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:49.080","lastModified":"2026-10-07T19:17:37.183","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. False positive."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-39769","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:49.280","lastModified":"2026-10-23T09:17:07.247","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic Designs Graphina – Charts and Graphs For Elementor graphina-elementor-charts-and-graphs allows Password Recovery Exploitation.This issue affects Graphina – Charts and Graphs For Elementor: from n/a through 3.1.12."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Iqonic Designs","product":"Graphina – Charts and Graphs For Elementor","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"graphina-elementor-charts-and-graphs","versions":[{"version":"0","lessThanOrEqual":"3.1.12","versionType":"custom","status":"affected","changes":[{"at":"3.1.13","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:25:32.789382Z","id":"CVE-2026-39769","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-288"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/graphina-elementor-charts-and-graphs/vulnerability/wordpress-graphina-plugin-3-1-12-broken-authentication-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39770","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:49.427","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"AmentoTech","product":"Doctreat","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/themes","packageName":"doctreat","versions":[{"version":"n/a","lessThanOrEqual":"1.7.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:24:47.877795Z","id":"CVE-2026-39770","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/doctreat/vulnerability/wordpress-doctreat-theme-1-7-0-arbitrary-file-upload-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39771","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:49.590","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber SQL Injection in Buddyboss Platform <= 3.1.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"MightyNetworks vs BuddyBoss","product":"Buddyboss Platform","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"buddyboss-platform","versions":[{"version":"n/a","lessThanOrEqual":"3.1.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:20:14.524812Z","id":"CVE-2026-39771","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/buddyboss-platform/vulnerability/wordpress-buddyboss-platform-plugin-3-1-0-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39772","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:49.740","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Bypass Vulnerability in Captcha by BestWebSoft <= 5.2.8 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"bestwebsoft","product":"Captcha by BestWebSoft","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"captcha-bws","versions":[{"version":"n/a","lessThanOrEqual":"5.2.8","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:20:11.067173Z","id":"CVE-2026-39772","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-290"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/captcha-bws/vulnerability/wordpress-captcha-by-bestwebsoft-plugin-5-2-8-bypass-vulnerability-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39773","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:49.900","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"AmentoTech","product":"Doctreat Core","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"doctreat_core","versions":[{"version":"n/a","lessThanOrEqual":"1.7.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:20:00.561218Z","id":"CVE-2026-39773","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/doctreat_core/vulnerability/wordpress-doctreat-core-plugin-1-7-0-privilege-escalation-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39774","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:50.053","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Tourfic AI Studio","product":"Tourfic Pro","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"tourfic-pro","versions":[{"version":"n/a","lessThanOrEqual":"1.17.3","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:19:52.980167Z","id":"CVE-2026-39774","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/tourfic-pro/vulnerability/wordpress-tourfic-pro-plugin-1-17-3-privilege-escalation-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39775","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:50.200","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"DexignZone","product":"JobZilla - Job Board WordPress Theme","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/themes","packageName":"jobzilla","versions":[{"version":"n/a","lessThanOrEqual":"2.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:19:43.596563Z","id":"CVE-2026-39775","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/jobzilla/vulnerability/wordpress-jobzilla-job-board-wordpress-theme-theme-2-2-privilege-escalation-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39776","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:50.347","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Editor Remote Code Execution (RCE) in Tabs <= 2.5 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"wpshopmart","product":"Tabs","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"tabs-responsive","versions":[{"version":"n/a","lessThanOrEqual":"2.5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:19:39.233962Z","id":"CVE-2026-39776","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/tabs-responsive/vulnerability/wordpress-tabs-plugin-2-5-remote-code-execution-rce-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39778","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:50.503","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor &amp; Themes <= 2.1.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"themeansar","product":"Ansar Import – One Click Starter Sites – for Elementor &amp; Themes","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"ansar-import","versions":[{"version":"n/a","lessThanOrEqual":"2.1.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:19:32.784376Z","id":"CVE-2026-39778","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/ansar-import/vulnerability/wordpress-ansar-import-one-click-starter-sites-for-elementor-themes-plugin-2-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39780","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:50.647","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Youzify","product":"Youzify","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"youzify","versions":[{"version":"n/a","lessThanOrEqual":"1.3.7","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:12:38.187819Z","id":"CVE-2026-39780","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/youzify/vulnerability/wordpress-youzify-plugin-1-3-7-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39781","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:50.793","lastModified":"2026-10-15T09:17:17.570","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Document Gallery document-gallery allows Reflected XSS.This issue affects Document Gallery: from n/a through 5.1.1."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Dan Rossiter","product":"Document Gallery","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"document-gallery","versions":[{"version":"0","lessThanOrEqual":"5.1.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:12:43.910040Z","id":"CVE-2026-39781","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/document-gallery/vulnerability/wordpress-document-gallery-plugin-5-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39784","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:50.940","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"nicdark","product":"Hotel Booking","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"nd-booking","versions":[{"version":"n/a","lessThanOrEqual":"3.8","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:12:33.931725Z","id":"CVE-2026-39784","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/nd-booking/vulnerability/wordpress-hotel-booking-plugin-3-8-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39785","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:51.100","lastModified":"2026-10-13T17:17:40.523","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Blind SQL Injection.This issue affects Gmedia Photo Gallery: from n/a through 1.25.1."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Serhii Pasyuk","product":"Gmedia Photo Gallery","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"grand-media","versions":[{"version":"0","lessThanOrEqual":"1.25.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:12:25.423486Z","id":"CVE-2026-39785","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/grand-media/vulnerability/wordpress-gmedia-photo-gallery-plugin-1-25-1-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39787","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:51.267","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"10Web","product":"10Web Social Photo Feed","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wd-instagram-feed","versions":[{"version":"n/a","lessThanOrEqual":"1.4.35","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:12:14.499945Z","id":"CVE-2026-39787","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wd-instagram-feed/vulnerability/wordpress-10web-social-photo-feed-plugin-1-4-35-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39788","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:51.627","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Cross Site Scripting (XSS) in Front End PM <= 11.4.6 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Shamim Hasan","product":"Front End PM","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"front-end-pm","versions":[{"version":"n/a","lessThanOrEqual":"11.4.6","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:12:08.337761Z","id":"CVE-2026-39788","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/front-end-pm/vulnerability/wordpress-front-end-pm-plugin-11-4-6-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39790","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:51.777","lastModified":"2026-10-08T17:17:16.947","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a through 1.4.7."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"e4jvikwp","product":"VikRentCar","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"vikrentcar","versions":[{"version":"0","lessThanOrEqual":"1.4.7","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:12:04.537751Z","id":"CVE-2026-39790","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/vikrentcar/vulnerability/wordpress-vikrentcar-plugin-1-4-6-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39791","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:51.930","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing <= 6.2.3 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Mailjet","product":"Mailjet Email Marketing","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"mailjet-for-wordpress","versions":[{"version":"n/a","lessThanOrEqual":"6.2.3","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:11:59.879583Z","id":"CVE-2026-39791","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-201"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/mailjet-for-wordpress/vulnerability/wordpress-mailjet-email-marketing-plugin-6-2-3-sensitive-data-exposure-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39792","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:52.080","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Arbitrary File Deletion in Simple File List <= 6.3.11 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Mitchell Bennis","product":"Simple File List","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"simple-file-list","versions":[{"version":"n/a","lessThanOrEqual":"6.3.11","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:11:55.146173Z","id":"CVE-2026-39792","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/simple-file-list/vulnerability/wordpress-simple-file-list-plugin-6-3-11-arbitrary-file-deletion-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39793","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:52.237","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Broken Authentication in Simple JWT Login 4.0.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Nicu Micle","product":"Simple JWT Login","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"simple-jwt-login","versions":[{"version":"4.0.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:11:48.053366Z","id":"CVE-2026-39793","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-288"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/simple-jwt-login/vulnerability/wordpress-simple-jwt-login-plugin-4-0-0-broken-authentication-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39794","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:52.387","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API <= 1.6.3 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WC Lovers","product":"WooCommerce Multivendor Marketplace – REST API","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wcfm-marketplace-rest-api","versions":[{"version":"n/a","lessThanOrEqual":"1.6.3","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:19:23.594524Z","id":"CVE-2026-39794","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wcfm-marketplace-rest-api/vulnerability/wordpress-woocommerce-multivendor-marketplace-rest-api-plugin-1-6-3-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39795","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:52.540","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated SQL Injection in SendPress Newsletters <= 1.26.1.20 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"brewlabs","product":"SendPress Newsletters","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"sendpress","versions":[{"version":"n/a","lessThanOrEqual":"1.26.1.20","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:19:28.681561Z","id":"CVE-2026-39795","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/sendpress/vulnerability/wordpress-sendpress-newsletters-plugin-1-26-1-20-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39796","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:52.697","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily <= 1.0.8 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Flipper Code – WordPress Development Company","product":"Advanced Posts Listing – Show Post List Easily","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"advanced-posts-listing","versions":[{"version":"n/a","lessThanOrEqual":"1.0.8","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:19:18.668768Z","id":"CVE-2026-39796","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/advanced-posts-listing/vulnerability/wordpress-advanced-posts-listing-show-post-list-easily-plugin-1-0-8-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39797","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:52.843","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Data443 Risk Mitigation, Inc.","product":"GDPR Framework By Data443","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"gdpr-framework","versions":[{"version":"n/a","lessThanOrEqual":"2.5.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:23:43.955566Z","id":"CVE-2026-39797","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/gdpr-framework/vulnerability/wordpress-gdpr-framework-by-data443-plugin-2-5-0-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39798","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:52.990","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Settings Change in TrueBooker <= 1.2.9 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemetechMount","product":"TrueBooker","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"truebooker-appointment-booking","versions":[{"version":"n/a","lessThanOrEqual":"1.2.9","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:23:55.291569Z","id":"CVE-2026-39798","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/truebooker-appointment-booking/vulnerability/wordpress-truebooker-plugin-1-2-9-settings-change-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-40806","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:53.140","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter for Elementor <= 2.1.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Plugin Devs","product":"Blog, Posts and Category Filter for Elementor","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"blog-posts-and-category-for-elementor","versions":[{"version":"n/a","lessThanOrEqual":"2.1.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:23:48.100935Z","id":"CVE-2026-40806","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/blog-posts-and-category-for-elementor/vulnerability/wordpress-blog-posts-and-category-filter-for-elementor-plugin-2-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-40807","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:53.287","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in CF7 Views &#8211; Complete Entry Management for Contact Form 7 <= 3.2.6 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Aman","product":"CF7 Views &#8211; Complete Entry Management for Contact Form 7","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"cf7-views","versions":[{"version":"n/a","lessThanOrEqual":"3.2.6","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:23:29.861696Z","id":"CVE-2026-40807","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/cf7-views/vulnerability/wordpress-cf7-views-complete-entry-management-for-contact-form-7-plugin-3-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-41555","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:53.433","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Weblizar – WordPress Themes & Plugin","product":"Newsletter Subscription Form – User Subscriptions Form, Capture Email","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"newsletter-subscription-form","versions":[{"version":"n/a","lessThanOrEqual":"1.5.9","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:23:13.774319Z","id":"CVE-2026-41555","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/newsletter-subscription-form/vulnerability/wordpress-newsletter-subscription-form-user-subscriptions-form-capture-email-plugin-1-5-9-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-41559","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:53.583","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup &amp; Restore <= 2.1.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Pluginjoy","product":"SafeSnap – Verified WordPress Backup &amp; Restore","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"safesnap","versions":[{"version":"n/a","lessThanOrEqual":"2.1.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:23:19.901355Z","id":"CVE-2026-41559","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-201"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/safesnap/vulnerability/wordpress-safesnap-verified-wordpress-backup-restore-plugin-2-1-2-sensitive-data-exposure-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-41560","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:53.730","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Broken Access Control in WXD Backup Lite <= 1.0.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"wxdlabs","product":"WXD Backup Lite","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wxd-backup-lite","versions":[{"version":"n/a","lessThanOrEqual":"1.0.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:23:25.239840Z","id":"CVE-2026-41560","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wxd-backup-lite/vulnerability/wordpress-wxd-backup-lite-plugin-1-0-2-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-41561","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:53.873","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.276 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Adrian Lin","product":"Museder RestoreOne","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"museder-restoreone","versions":[{"version":"n/a","lessThanOrEqual":"2.7.276","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:11:40.407141Z","id":"CVE-2026-41561","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-201"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/museder-restoreone/vulnerability/wordpress-museder-restoreone-plugin-2-7-276-sensitive-data-exposure-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-41562","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:54.023","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"norvisgabriel","product":"Norvis Backup","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"norvis-backup","versions":[{"version":"n/a","lessThanOrEqual":"1.1.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:11:29.848576Z","id":"CVE-2026-41562","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-201"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/norvis-backup/vulnerability/wordpress-norvis-backup-plugin-1-1-0-sensitive-data-exposure-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-42413","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:54.170","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Sensitive Data Exposure in Snapshotify &#8211; All-in-One Backup &amp; Restore &amp; Migrate <= 1.3.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"DaftPlug","product":"Snapshotify &#8211; All-in-One Backup &amp; Restore &amp; Migrate","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"snapshotify","versions":[{"version":"n/a","lessThanOrEqual":"1.3.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:11:23.787866Z","id":"CVE-2026-42413","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-201"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/snapshotify/vulnerability/wordpress-snapshotify-all-in-one-backup-restore-migrate-plugin-1-3-2-sensitive-data-exposure-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-42414","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:54.320","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber SQL Injection in ListingPro <= 2.9.12 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"CridioStudio","product":"ListingPro","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"listingpro-plugin","versions":[{"version":"n/a","lessThanOrEqual":"2.9.12","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:11:18.195644Z","id":"CVE-2026-42414","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/listingpro-plugin/vulnerability/wordpress-listingpro-plugin-2-9-12-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-42415","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:54.463","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"p-themes","product":"Porto Theme - Functionality","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"porto-functionality","versions":[{"version":"n/a","lessThanOrEqual":"3.9.3","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:11:14.284427Z","id":"CVE-2026-42415","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/porto-functionality/vulnerability/wordpress-porto-theme-functionality-plugin-3-9-3-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-42416","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:54.610","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber SQL Injection in UDesign Core <= 4.15.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"AndonDesign","product":"UDesign Core","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"u-design-core","versions":[{"version":"n/a","lessThanOrEqual":"4.15.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:11:08.896324Z","id":"CVE-2026-42416","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/u-design-core/vulnerability/wordpress-udesign-core-plugin-4-15-0-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-42417","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:54.757","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"reputeinfosystems","product":"ARMember Premium","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"armember","versions":[{"version":"n/a","lessThanOrEqual":"7.8","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:11:05.274805Z","id":"CVE-2026-42417","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/armember/vulnerability/wordpress-armember-premium-plugin-7-8-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-42418","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:54.900","lastModified":"2026-10-07T08:16:57.203","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Socialrocket Social Rocket social-rocket allows Reflected XSS.This issue affects Social Rocket: from n/a through 1.3.5."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Socialrocket","product":"Social Rocket","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"social-rocket","versions":[{"version":"0","lessThanOrEqual":"1.3.5","versionType":"custom","status":"affected","changes":[{"at":"1.3.6","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:10:56.381082Z","id":"CVE-2026-42418","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/social-rocket/vulnerability/wordpress-social-rocket-plugin-1-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-42634","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:55.047","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"bPlugins","product":"Video Background Block – Use video as background in the section.","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"video-background-block","versions":[{"version":"n/a","lessThanOrEqual":"2.0.3","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:10:52.910237Z","id":"CVE-2026-42634","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/video-background-block/vulnerability/wordpress-video-background-block-use-video-as-background-in-the-section-plugin-2-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-42635","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:55.193","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"wpgenie","product":"WooCommerce Simple Auctions","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"woocommerce-simple-auctions","versions":[{"version":"n/a","lessThanOrEqual":"3.0.10","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:10:48.985484Z","id":"CVE-2026-42635","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/woocommerce-simple-auctions/vulnerability/wordpress-woocommerce-simple-auctions-plugin-3-0-10-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-42636","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:55.333","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WP Legal Pages","product":"WP Cookie Notice for GDPR, CCPA & ePrivacy Consent","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"gdpr-cookie-consent","versions":[{"version":"n/a","lessThanOrEqual":"4.4.6","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:23:02.926792Z","id":"CVE-2026-42636","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/gdpr-cookie-consent/vulnerability/wordpress-wp-cookie-notice-for-gdpr-ccpa-eprivacy-consent-plugin-4-4-6-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-42637","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:55.480","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Payplug","product":"PayPlug for WooCommerce (Official)","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"payplug","versions":[{"version":"n/a","lessThanOrEqual":"3.1.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:22:57.414182Z","id":"CVE-2026-42637","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/payplug/vulnerability/wordpress-payplug-for-woocommerce-official-plugin-3-1-0-settings-change-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-42638","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:55.627","lastModified":"2026-10-07T08:16:57.320","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.7.1."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Awesomemotive","product":"Easy Digital Downloads","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"easy-digital-downloads","versions":[{"version":"0","lessThanOrEqual":"3.7.1","versionType":"custom","status":"affected","changes":[{"at":"3.7.1.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:22:50.706037Z","id":"CVE-2026-42638","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/easy-digital-downloads/vulnerability/wordpress-easy-digital-downloads-plugin-3-7-1-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-48197","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:55.777","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"PublishPress","product":"PublishPress Capabilities","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"capability-manager-enhanced","versions":[{"version":"0","lessThanOrEqual":"2.45.0","versionType":"custom","status":"affected","changes":[{"at":"2.50.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:19:03.323841Z","id":"CVE-2026-48197","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/capability-manager-enhanced/vulnerability/wordpress-publishpress-capabilities-plugin-2-45-0-privilege-escalation-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-48199","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:55.930","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Beplusthemes","product":"Sermon'e","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"sermone","versions":[{"version":"n/a","lessThanOrEqual":"1.0.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:19:08.289303Z","id":"CVE-2026-48199","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/sermone/vulnerability/wordpress-sermon-e-plugin-1-0-2-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-4889","sourceIdentifier":"cve-coordination@incibe.es","published":"2026-10-06T09:17:56.317","lastModified":"2026-10-06T15:18:12.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an attacker to discover the platform's database engine and cause delays in database queries."}],"affected":[{"source":"cve-coordination@incibe.es","affectedData":[{"vendor":"RDL Technologies","product":"eLoanApp Platform","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"06/10/2026","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@incibe.es","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T11:41:15.392898Z","id":"CVE-2026-4889","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve-coordination@incibe.es","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-sqli-eloanapp-platform-rdl-technologies","source":"cve-coordination@incibe.es"}]}},{"cve":{"id":"CVE-2026-62072","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:56.500","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Progress Planner","product":"Progress Planner","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"progress-planner","versions":[{"version":"n/a","lessThanOrEqual":"1.10.0","versionType":"custom","status":"affected","changes":[{"at":"1.10.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:18:49.119145Z","id":"CVE-2026-62072","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/progress-planner/vulnerability/wordpress-progress-planner-plugin-1-10-0-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-66588","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:56.660","lastModified":"2026-10-13T07:16:32.340","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. False-positive."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-94206","sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","published":"2026-10-06T09:17:56.813","lastModified":"2026-10-06T15:03:59.427","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured.\n\nThe dump/1 callback that Cloak.Ecto.PBKDF2 (Cloak.Fields.PBKDF2 in cloak before the Ecto code moved to cloak_ecto) injects into a field module calls :pbkdf2.pbkdf2/4 with config[:size] in the iteration-count position. The :iterations setting is validated but never used. With the cloak_ecto defaults (iterations: 600_000, size: 32) each hash runs 32 PBKDF2 rounds instead of 600,000, so offline guessing of values such as email addresses costs about 18,750 times less than configured.\n\nThis issue affects cloak_ecto: from 1.0.0-alpha.0 onward; cloak: from 0.7.0 before 1.0.0-alpha.0."}],"affected":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","affectedData":[{"vendor":"danielberkompas","product":"cloak_ecto","defaultStatus":"unaffected","collectionURL":"https://repo.hex.pm","packageName":"cloak_ecto","cpes":["cpe:2.3:a:danielberkompas:cloak_ecto:*:*:*:*:*:*:*:*"],"modules":["'Elixir.Cloak.Ecto.PBKDF2'"],"programFiles":["lib/cloak_ecto/types/pbkdf2.ex"],"repo":"https://github.com/danielberkompas/cloak_ecto","packageURL":"pkg:hex/cloak_ecto","versions":[{"version":"1.0.0-alpha.0","lessThan":"*","versionType":"semver","status":"affected"}]},{"vendor":"danielberkompas","product":"cloak_ecto","defaultStatus":"unaffected","collectionURL":"https://github.com","packageName":"danielberkompas/cloak_ecto","cpes":["cpe:2.3:a:danielberkompas:cloak_ecto:*:*:*:*:*:*:*:*"],"modules":["'Elixir.Cloak.Ecto.PBKDF2'"],"programFiles":["lib/cloak_ecto/types/pbkdf2.ex"],"repo":"https://github.com/danielberkompas/cloak_ecto","packageURL":"pkg:github/danielberkompas/cloak_ecto","versions":[{"version":"a8fa1642b02f1c445a1ee8794c9095eb0921f8f3","lessThan":"*","versionType":"git","status":"affected"}]},{"vendor":"danielberkompas","product":"cloak","defaultStatus":"unaffected","collectionURL":"https://repo.hex.pm","packageName":"cloak","cpes":["cpe:2.3:a:danielberkompas:cloak:*:*:*:*:*:*:*:*"],"modules":["'Elixir.Cloak.Fields.PBKDF2'"],"programFiles":["lib/cloak/fields/pbkdf2.ex"],"repo":"https://github.com/danielberkompas/cloak","packageURL":"pkg:hex/cloak","versions":[{"version":"0.7.0","lessThan":"1.0.0-alpha.0","versionType":"semver","status":"affected"}]},{"vendor":"danielberkompas","product":"cloak","defaultStatus":"unaffected","collectionURL":"https://github.com","packageName":"danielberkompas/cloak","cpes":["cpe:2.3:a:danielberkompas:cloak:*:*:*:*:*:*:*:*"],"modules":["'Elixir.Cloak.Fields.PBKDF2'"],"programFiles":["lib/cloak/fields/pbkdf2.ex"],"repo":"https://github.com/danielberkompas/cloak","packageURL":"pkg:github/danielberkompas/cloak","versions":[{"version":"8699e6417a162c39d9f0ef63511bd23d3f38d1d2","lessThan":"681c9702b7cd9afe0e5a840751ab009f550c69a9","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T11:34:00.942993Z","id":"CVE-2026-94206","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary","description":[{"lang":"en","value":"CWE-916"}]}],"references":[{"url":"https://cna.erlef.org/cves/CVE-2026-94206.html","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/danielberkompas/cloak/commit/681c9702b7cd9afe0e5a840751ab009f550c69a9","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/danielberkompas/cloak/commit/8699e6417a162c39d9f0ef63511bd23d3f38d1d2","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/danielberkompas/cloak_ecto/commit/a8fa1642b02f1c445a1ee8794c9095eb0921f8f3","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-94206","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}]}},{"cve":{"id":"CVE-2026-94675","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:57.047","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Fluent Forms Free vs Pro","product":"Fluent Forms Pro Add On Pack","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"fluentformpro","versions":[{"version":"n/a","lessThanOrEqual":"6.2.13","versionType":"custom","status":"affected","changes":[{"at":"6.2.14","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:10:45.711707Z","id":"CVE-2026-94675","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/fluentformpro/vulnerability/wordpress-fluent-forms-pro-add-on-pack-plugin-6-2-13-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-95105","sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","published":"2026-10-06T09:17:57.200","lastModified":"2026-10-06T15:03:59.427","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking vulnerability in danielberkompas cloak allows an attacker with write access to stored ciphertext to make it decrypt to a chosen value via bit flipping.\n\nCloak.Ciphers.AES.CTR encrypts with AES-256 in CTR mode and stores the key tag, the IV and the ciphertext with no MAC. decrypt/2 checks only the key tag and the minimum length before it returns the plaintext, and Cloak.Ciphers.Deprecated.AES.CTR decrypts the legacy format the same way. CTR is a stream cipher, so a value XORed into the stored ciphertext is XORed into the plaintext at the same offset. An attacker who can write to the encrypted store (for example through SQL injection or a compromised replica) and who knows or can guess a stored plaintext can replace it with any value of the same length. The application receives that value with no error.\n\nThis issue affects cloak: from 0.1.0-pre onward."}],"affected":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","affectedData":[{"vendor":"danielberkompas","product":"cloak","defaultStatus":"unaffected","collectionURL":"https://repo.hex.pm","packageName":"cloak","cpes":["cpe:2.3:a:danielberkompas:cloak:*:*:*:*:*:*:*:*"],"modules":["'Elixir.Cloak.Ciphers.AES.CTR'","'Elixir.Cloak.Ciphers.Deprecated.AES.CTR'"],"programFiles":["lib/cloak/ciphers/aes_ctr.ex","lib/cloak/ciphers/deprecated/aes_ctr.ex"],"programRoutines":[{"name":"'Elixir.Cloak.Ciphers.AES.CTR':encrypt/2"},{"name":"'Elixir.Cloak.Ciphers.AES.CTR':decrypt/2"},{"name":"'Elixir.Cloak.Ciphers.Deprecated.AES.CTR':decrypt/2"}],"repo":"https://github.com/danielberkompas/cloak","packageURL":"pkg:hex/cloak","versions":[{"version":"0.1.0-pre","lessThan":"*","versionType":"semver","status":"affected"}]},{"vendor":"danielberkompas","product":"cloak","defaultStatus":"unaffected","collectionURL":"https://github.com","packageName":"danielberkompas/cloak","cpes":["cpe:2.3:a:danielberkompas:cloak:*:*:*:*:*:*:*:*"],"modules":["'Elixir.Cloak.Ciphers.AES.CTR'","'Elixir.Cloak.Ciphers.Deprecated.AES.CTR'"],"programFiles":["lib/cloak/ciphers/aes_ctr.ex","lib/cloak/ciphers/deprecated/aes_ctr.ex"],"programRoutines":[{"name":"'Elixir.Cloak.Ciphers.AES.CTR':encrypt/2"},{"name":"'Elixir.Cloak.Ciphers.AES.CTR':decrypt/2"},{"name":"'Elixir.Cloak.Ciphers.Deprecated.AES.CTR':decrypt/2"}],"repo":"https://github.com/danielberkompas/cloak","packageURL":"pkg:github/danielberkompas/cloak","versions":[{"version":"2bd17019e285b55c5c218cc842537bf9280f24c3","lessThan":"*","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T11:37:58.212117Z","id":"CVE-2026-95105","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary","description":[{"lang":"en","value":"CWE-649"}]}],"references":[{"url":"https://cna.erlef.org/cves/CVE-2026-95105.html","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/danielberkompas/cloak/commit/2bd17019e285b55c5c218cc842537bf9280f24c3","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-95105","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://cna.erlef.org/cves/CVE-2026-95105.html","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-95526","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:57.430","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"RealMag777","product":"BEAR","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"woo-bulk-editor","versions":[{"version":"n/a","lessThanOrEqual":"1.2.2","versionType":"custom","status":"affected","changes":[{"at":"1.2.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:10:40.469844Z","id":"CVE-2026-95526","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/woo-bulk-editor/vulnerability/wordpress-bear-plugin-1-2-2-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-95594","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:57.577","lastModified":"2026-10-12T14:17:13.577","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Privilege Escalation.This issue affects SMS Alert Order Notifications: from n/a through 4.0.0."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Cozy Vision Technologies Pvt. Ltd.","product":"SMS Alert Order Notifications","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"sms-alert","versions":[{"version":"0","lessThanOrEqual":"4.0.0","versionType":"custom","status":"affected","changes":[{"at":"4.0.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:10:34.766880Z","id":"CVE-2026-95594","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/sms-alert/vulnerability/wordpress-sms-alert-order-notifications-plugin-4-0-0-privilege-escalation-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97308","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T09:17:57.740","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Bypass Vulnerability in Login Lockdown <= 2.17 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WebFactory","product":"Login Lockdown","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"login-lockdown","versions":[{"version":"n/a","lessThanOrEqual":"2.17","versionType":"custom","status":"affected","changes":[{"at":"2.18","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:10:29.684888Z","id":"CVE-2026-97308","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-290"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/login-lockdown/vulnerability/wordpress-login-lockdown-plugin-2-17-bypass-vulnerability-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-98165","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:17:57.887","lastModified":"2026-10-19T15:17:09.983","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-98166","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:17:58.033","lastModified":"2026-10-19T10:18:16.820","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/ttm: fix swapped-out resources never leaving their bulk_move range\n\nttm_tt_swapout() returns the number of pages swapped out on success and\na negative error code on failure; for a populated ttm it never returns\nzero. Commit b2ed01e7ad3d (\"drm/ttm: Fix ttm_bo_swapout() infinite LRU\nwalk on swapout failure\") moved the bulk_move bookkeeping in\nttm_bo_swapout_cb() under \"if (!ret)\", so the\nttm_resource_del_bulk_move_unevictable() / ttm_resource_move_to_lru_tail()\npair is now skipped on every successful swapout. The equivalent change\nfor the shrinker in commit 1d59f36e95f7 (\"drm/ttm: Fix ttm_bo_shrink()\ninfinite LRU walk on backup failure\") tests \"lret > 0\", which is what\nwas intended here as well.\n\nBefore b2ed01e7ad3d the resource was taken off the bulk_move before the\nswapout; since then a swapped-out resource stays inside its BO's\nbulk_move range (and on the manager LRU) although it is unevictable.\nWhen it is later freed or the BO leaves the bulk_move\n(ttm_resource_free(), ttm_bo_set_bulk_move() via amdgpu_vm_bo_del()),\nttm_resource_del_bulk_move() skips it because of its\n!ttm_resource_unevictable() guard, so a range endpoint in pos->first /\npos->last is left pointing at freed memory. The next\nttm_lru_bulk_move_tail() or ttm_resource_add_bulk_move() on that cursor\nis a use-after-free, seen as the resv WARN in ttm_lru_bulk_move_add(),\n\"list_del corruption\" in ttm_resource_move_to_lru_tail() or a NULL\ndereference in ttm_resource_manager_next() -- minutes to hours after a\nhibernation, or at process exit / reboot following one. Samuel\nAinsworth's analysis of drm/amd issue 5387 (see Link) identified the\ndangling cursor; the missing removal at swapout time is the reason it\ndangles.\n\nTesting the condition for success restores the removal. On an AMD\nPhoenix APU (ASUS UM3406GA, gfx1103) running suspend-then-hibernate on\na 7.0.y stable kernel carrying the backport (Ubuntu 7.0.0-31) the bug\ncrashed 5 of 18 hibernation cycles; a function profile of one\nhibernation showed 336 ttm_tt_swapout() calls and zero\nttm_resource_del_bulk_move_unevictable() calls. With this change the\nremoval happens for every swapped-out resource and 12 further cycles\nwere clean."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/ttm/ttm_bo.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b2ed01e7ad3de80333e9b962a44024b094bc0b2b","lessThan":"1169fe8c11ca45e3f91d59a73eb271d0ca8a7fb0","versionType":"git","status":"affected"},{"version":"b2ed01e7ad3de80333e9b962a44024b094bc0b2b","lessThan":"3db7d7d583419f7b1f2e141e36418802dbb25cf8","versionType":"git","status":"affected"},{"version":"060f8f3020516d71bc4d6159d4d0beef85606a74","versionType":"git","status":"affected"},{"version":"0124a09e3e5f5f6080efe9663b27af27933f8382","versionType":"git","status":"affected"},{"version":"6.18.57","lessThan":"6.19","versionType":"semver","status":"affected"},{"version":"7.0.10","lessThan":"7.1","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/ttm/ttm_bo.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1169fe8c11ca45e3f91d59a73eb271d0ca8a7fb0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3db7d7d583419f7b1f2e141e36418802dbb25cf8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98167","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:17:58.177","lastModified":"2026-10-19T10:18:16.950","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix server->total_read for compound encrypted PDUs\n\nIn receive_encrypted_standard(), server->total_read is left at the\nfull decrypted frame size when walking sub-PDUs of a compound encrypted\nframe. As a result, cifs_handle_standard() passes this full size\nto smb2_check_message(), causing the PDU length guards to incorrectly\nvalidate the entire compound frame instead of the current sub-PDU.\n\nThis allows truncated non-last sub-PDUs to bypass length validation,\nleading to out-of-bounds reads in smb2_get_data_area_len().\n\nFix this by setting server->total_read to the true length of the\ncurrent sub-PDU: next_cmd for non-last sub-PDUs, and the remaining\npdu_length for the last one."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/smb2ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b24df3e30cbf48255db866720fb71f14bf9d2f39","lessThan":"8703539d22fdbc13dd2db090ee199c3a427b8ea0","versionType":"git","status":"affected"},{"version":"b24df3e30cbf48255db866720fb71f14bf9d2f39","lessThan":"e78fc1d240b27349b45a0f1c3e3c2c401d7e230d","versionType":"git","status":"affected"},{"version":"b24df3e30cbf48255db866720fb71f14bf9d2f39","lessThan":"a46eb242e9eef3a3897d166748b23303c516e870","versionType":"git","status":"affected"},{"version":"b24df3e30cbf48255db866720fb71f14bf9d2f39","lessThan":"ebb8a075fdc7af3d196a4f158a0e18dbc394c0e3","versionType":"git","status":"affected"},{"version":"b24df3e30cbf48255db866720fb71f14bf9d2f39","lessThan":"282b72f9a7ef31296c48366db4128882999cc048","versionType":"git","status":"affected"},{"version":"b24df3e30cbf48255db866720fb71f14bf9d2f39","lessThan":"f73726b83e4756fdaa099e1bc1143293bd57ad79","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/smb2ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.19","status":"affected"},{"version":"0","lessThan":"4.19","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/282b72f9a7ef31296c48366db4128882999cc048","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8703539d22fdbc13dd2db090ee199c3a427b8ea0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a46eb242e9eef3a3897d166748b23303c516e870","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e78fc1d240b27349b45a0f1c3e3c2c401d7e230d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ebb8a075fdc7af3d196a4f158a0e18dbc394c0e3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f73726b83e4756fdaa099e1bc1143293bd57ad79","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98168","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:17:58.333","lastModified":"2026-10-21T13:21:24.917","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix reparse buffer bounds in cifs_query_reparse_point()\n\nIn cifs_query_reparse_point(), the start >= end check before casting to\nstruct reparse_data_buffer * only ensures the start pointer is within the\nresponse. It fails to verify that there is enough space remaining for the\nfixed 8-byte header of the structure.\n\nIf a server provides a DataOffset that leaves less than 8 bytes remaining,\nthe check passes, but subsequent reads of ReparseTag and ReparseDataLength\nwill occur out-of-bounds.\n\nFix this by ensuring the remaining space is at least the size of the\nreparse_data_buffer structure before accessing its fields."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/cifssmb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"848d78e3625f15de09d34a562dc49a98b78a62f3","lessThan":"aa00eead258e4fe8158a3a3e2d65facf06274abd","versionType":"git","status":"affected"},{"version":"48ca7139ab7f0bbed95ff7a901ea497017769657","lessThan":"3d67f155fe5813cfb02a551a9a12d6ea06a902e9","versionType":"git","status":"affected"},{"version":"56e84c64fc257a95728ee73165456b025c48d408","lessThan":"d1152c96a3002e3df6b9a5b007cecaa7b19b4f79","versionType":"git","status":"affected"},{"version":"56e84c64fc257a95728ee73165456b025c48d408","lessThan":"8dc5db3a0e583ea8d31d0613cefd99e93e095c3c","versionType":"git","status":"affected"},{"version":"56e84c64fc257a95728ee73165456b025c48d408","lessThan":"5f0306e731e2f46e91419eae57eee3a241c055e0","versionType":"git","status":"affected"},{"version":"c13b779d26b3702fba8f7d5fe757aba5bda85fd0","versionType":"git","status":"affected"},{"version":"6.6.94","lessThan":"6.6.160","versionType":"semver","status":"affected"},{"version":"6.12.34","lessThan":"6.12.112","versionType":"semver","status":"affected"},{"version":"6.15.3","lessThan":"6.16","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/cifssmb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3d67f155fe5813cfb02a551a9a12d6ea06a902e9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5f0306e731e2f46e91419eae57eee3a241c055e0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8dc5db3a0e583ea8d31d0613cefd99e93e095c3c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aa00eead258e4fe8158a3a3e2d65facf06274abd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d1152c96a3002e3df6b9a5b007cecaa7b19b4f79","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98169","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:17:58.480","lastModified":"2026-10-19T10:18:17.160","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential OOB read in smb3_enum_snapshots()\n\nIf snapshot_array_size is smaller than GMT_TOKEN_SIZE,\nsmb3_enum_snapshots() sets ret_data_len to\nsizeof(struct smb_snapshot_array) without verifying the actual length\nof the server's reply.\n\nBecause SMB2_ioctl() places no lower bound on the server-supplied\nOutputCount and allocates retbuf to exactly that length, a short reply\nresults in ret_data_len exceeding the size of retbuf. The subsequent\ncopy_to_user() then reads past the end of retbuf, leaking adjacent slab\nmemory to userspace.  The subsequent clamp check is ineffective as it\nonly reduces ret_data_len.\n\nFix this by rejecting replies shorter than\nsizeof(struct smb_snapshot_array) with -EIO. Note that the bound is set\nto the 12-byte struct size rather than the 16-byte\nMIN_SNAPSHOT_ARRAY_SIZE defined in MS-SMB2 3.3.5.15.1, because 12 bytes\nis exactly what copy_to_user() attempts to read."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/smb2ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e02789a53d71334b067ad72eee5d4e88a0158083","lessThan":"15a221c734b9d044ab769e7e3606b2cab96fb65a","versionType":"git","status":"affected"},{"version":"e02789a53d71334b067ad72eee5d4e88a0158083","lessThan":"74995ee8305a7c4d76ee70d6acd996a75eda3c03","versionType":"git","status":"affected"},{"version":"e02789a53d71334b067ad72eee5d4e88a0158083","lessThan":"210f0f1f67817e7d2348b86b5115a9b85ef5c98b","versionType":"git","status":"affected"},{"version":"e02789a53d71334b067ad72eee5d4e88a0158083","lessThan":"1cdf0d304d820fb13bf0faf532c3459600f9ea43","versionType":"git","status":"affected"},{"version":"e02789a53d71334b067ad72eee5d4e88a0158083","lessThan":"dbe452a905dfe2804647530a9ff3d7e3826ed04d","versionType":"git","status":"affected"},{"version":"e02789a53d71334b067ad72eee5d4e88a0158083","lessThan":"4775c3b7a597907e0b97556c7986fda238a377ae","versionType":"git","status":"affected"},{"version":"a94703ff8e3647f8a9a3a92a468450299a7b77e9","versionType":"git","status":"affected"},{"version":"82a856f527334ffd69aae26e7dd9e03b19c4a520","versionType":"git","status":"affected"},{"version":"25b981bfe192fd208ba04c81f4aa30ffb5141660","versionType":"git","status":"affected"},{"version":"4.9.125","lessThan":"4.10","versionType":"semver","status":"affected"},{"version":"4.14.68","lessThan":"4.15","versionType":"semver","status":"affected"},{"version":"4.18.6","lessThan":"4.19","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/smb2ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.19","status":"affected"},{"version":"0","lessThan":"4.19","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":4.2}]},"references":[{"url":"https://git.kernel.org/stable/c/15a221c734b9d044ab769e7e3606b2cab96fb65a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1cdf0d304d820fb13bf0faf532c3459600f9ea43","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/210f0f1f67817e7d2348b86b5115a9b85ef5c98b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4775c3b7a597907e0b97556c7986fda238a377ae","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/74995ee8305a7c4d76ee70d6acd996a75eda3c03","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dbe452a905dfe2804647530a9ff3d7e3826ed04d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98170","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:17:58.640","lastModified":"2026-10-21T13:21:25.037","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()\n\nIn move_smb2_ea_to_cifs(), the while (src_size > 0) loop condition is\ninsufficient. It allows iteration to continue even if the remaining\nsrc_size is too small to contain a complete smb2_ea_info structure.\nConsequently, reads of ea_name_length and ea_value_length can occur\nout-of-bounds.\n\nFix this by ensuring src_size >= sizeof(*src) before attempting to read\nany structure fields. Additionally, reject any next_entry_offset that is\nsmaller than sizeof(*src) or that would advance the pointer beyond the\navailable buffer.\n\nNote that for calls where the server returns a malformed EA list, the\nerror returned to userspace changes from -ENODATA (getxattr) or\n-ERANGE (listxattr) to -EIO. This correctly signals a server protocol\nerror rather than misleadingly indicating \"attribute not present\" or\n\"output buffer too small\"."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/smb2ops.c","fs/smb/client/trace.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"95907fea4fd8ccc736e0a428e52159b4d42b9958","lessThan":"61812323c037a94e2e7f0db7ee740c34b126bffe","versionType":"git","status":"affected"},{"version":"95907fea4fd8ccc736e0a428e52159b4d42b9958","lessThan":"d3546cecbf81d98bf3b472d341f981eb48c04f47","versionType":"git","status":"affected"},{"version":"95907fea4fd8ccc736e0a428e52159b4d42b9958","lessThan":"34a3942e787b9c59758115bd65fe1ec89d68c7a4","versionType":"git","status":"affected"},{"version":"95907fea4fd8ccc736e0a428e52159b4d42b9958","lessThan":"13efcd37a9b3d6ffa1579c3dda3e29c893ed9bca","versionType":"git","status":"affected"},{"version":"95907fea4fd8ccc736e0a428e52159b4d42b9958","lessThan":"eeb5ef6083e1cefa2ef75041b5597ff228b8d7bb","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/smb2ops.c","fs/smb/client/trace.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.14","status":"affected"},{"version":"0","lessThan":"4.14","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/13efcd37a9b3d6ffa1579c3dda3e29c893ed9bca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/34a3942e787b9c59758115bd65fe1ec89d68c7a4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/61812323c037a94e2e7f0db7ee740c34b126bffe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d3546cecbf81d98bf3b472d341f981eb48c04f47","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eeb5ef6083e1cefa2ef75041b5597ff228b8d7bb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98171","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:17:58.773","lastModified":"2026-10-19T10:18:17.380","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs\n\nFix several related bounds checking and pointer lifecycle issues in\nreceive_encrypted_standard()'s handling of compound encrypted frames:\n\n- Clear next_buffer after assigning it to server->bigbuf. A stale\n  next_buffer pointer can lead to a use-after-free on subsequent\n  error paths.\n- Update pdu_length to the decrypted plaintext size (buf_size). Using\n  the pre-decryption length allows NextCommand to point into stale\n  ciphertext residue.\n- Reject next_cmd values smaller than MID_HEADER_SIZE(server).\n- Fix an integer overflow in the upper bound check by verifying\n  pdu_length - next_cmd < MID_HEADER_SIZE(server), ensuring the\n  trailing slice is large enough for a header."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/smb2ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b24df3e30cbf48255db866720fb71f14bf9d2f39","lessThan":"72eaef1f37a3b6bec11c342736834dc3707be3e4","versionType":"git","status":"affected"},{"version":"b24df3e30cbf48255db866720fb71f14bf9d2f39","lessThan":"491e33144dee872cffda207f6fcb09260728f803","versionType":"git","status":"affected"},{"version":"b24df3e30cbf48255db866720fb71f14bf9d2f39","lessThan":"8749946579708ea0d339034bb7f423a67dbe89cf","versionType":"git","status":"affected"},{"version":"b24df3e30cbf48255db866720fb71f14bf9d2f39","lessThan":"96c436e4b010711452b2872558938f4ef276492a","versionType":"git","status":"affected"},{"version":"b24df3e30cbf48255db866720fb71f14bf9d2f39","lessThan":"858d5ac22cb889266993e7670f9f0c4f4aeedd78","versionType":"git","status":"affected"},{"version":"b24df3e30cbf48255db866720fb71f14bf9d2f39","lessThan":"05762c5bc1cfdcac36747994fde2c04387a457f1","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/smb2ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.19","status":"affected"},{"version":"0","lessThan":"4.19","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/05762c5bc1cfdcac36747994fde2c04387a457f1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/491e33144dee872cffda207f6fcb09260728f803","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/72eaef1f37a3b6bec11c342736834dc3707be3e4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/858d5ac22cb889266993e7670f9f0c4f4aeedd78","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8749946579708ea0d339034bb7f423a67dbe89cf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/96c436e4b010711452b2872558938f4ef276492a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98172","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:17:58.920","lastModified":"2026-10-19T10:18:17.507","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix smbd_connection leak on cifs_get_tcp_session() error\n\nWhen an RDMA connection is successfully established via\nsmbd_get_connection() but cifs_get_tcp_session() later fails (e.g.\nkthread_create() returns an error), the error path frees tcp_ses\nwithout first destroying the smbd_connection.\n\nFix this by calling smbd_destroy() in the out_err cleanup path before\nkfree(tcp_ses).  smbd_destroy() safely handles the case where\nsmbd_conn is NULL, so it can be called unconditionally."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/connect.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2f8946464b11822169b9f10c7cf58a2440b51d54","lessThan":"3164402c58940ff58a3cecdb026405f07b0253af","versionType":"git","status":"affected"},{"version":"2f8946464b11822169b9f10c7cf58a2440b51d54","lessThan":"e3344bb0ff5ec8a276f42239e140f5442841ef23","versionType":"git","status":"affected"},{"version":"2f8946464b11822169b9f10c7cf58a2440b51d54","lessThan":"5c908e49d349266dff0c86dda6a05df0ff19b824","versionType":"git","status":"affected"},{"version":"2f8946464b11822169b9f10c7cf58a2440b51d54","lessThan":"928edc4bd6a617caabeb575fc13c254d9df623c4","versionType":"git","status":"affected"},{"version":"2f8946464b11822169b9f10c7cf58a2440b51d54","lessThan":"b26a3fcf2f1c2cadba400290b639f01395db8fc8","versionType":"git","status":"affected"},{"version":"2f8946464b11822169b9f10c7cf58a2440b51d54","lessThan":"e75c96157d45e498970158c8f7373d90102e33b9","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/connect.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.16","status":"affected"},{"version":"0","lessThan":"4.16","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3164402c58940ff58a3cecdb026405f07b0253af","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5c908e49d349266dff0c86dda6a05df0ff19b824","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/928edc4bd6a617caabeb575fc13c254d9df623c4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b26a3fcf2f1c2cadba400290b639f01395db8fc8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e3344bb0ff5ec8a276f42239e140f5442841ef23","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e75c96157d45e498970158c8f7373d90102e33b9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98173","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:17:59.060","lastModified":"2026-10-21T13:21:25.150","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free of iface in cifs_try_adding_channels()\n\ncifs_try_adding_channels() iterates ses->iface_list with\nlist_for_each_entry_safe_from(), which captures the next entry\n(niface) under iface_lock.  The loop body then drops iface_lock for\nthe whole duration of cifs_ses_add_channel().\n\nA concurrent interface refresh (SMB3_request_interfaces() ->\nparse_server_interfaces()) marks all ifaces inactive and removes and\nfrees any that are not re-advertised via list_del() + kref_put(),\nwhere release_iface() is a bare kfree().  Since niface typically has\nno channel holding a reference, the list reference is its last and it\ncan be freed inside the unlocked window.  On continue, the iterator\nadvance step then dereferences niface->iface_head.next, and the loop\nbody reads iface->rdma_capable/is_active, both on freed memory.\n\nFix this by never keeping an unreferenced list pointer across the\nunlocked window.  Each channel attempt now re-scans the list from the\nhead under iface_lock, takes a kref on the selected candidate, and\npasses only that referenced candidate to cifs_ses_add_channel().\nweight_fulfilled still tracks selection progress, so restarting the\nscan preserves the original weighted distribution and the\nweight_fulfilled-before-kref_put ordering on the failure path.\n\nAdd a per-pass attempts cap so a flapping interface refresh cannot\nkeep the inner loop spinning within a single tries increment."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/sess.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"aa45dadd34e44fcd6a9df4b395bee5b5633b4cec","lessThan":"ee0d8f83d68f6e6509f092c997ccab3c8c801538","versionType":"git","status":"affected"},{"version":"aa45dadd34e44fcd6a9df4b395bee5b5633b4cec","lessThan":"c941f1ebfd26f683de81091473f3596a218abff0","versionType":"git","status":"affected"},{"version":"aa45dadd34e44fcd6a9df4b395bee5b5633b4cec","lessThan":"e99040e5e9c60441e6b4725e1a7b88c3106ae903","versionType":"git","status":"affected"},{"version":"aa45dadd34e44fcd6a9df4b395bee5b5633b4cec","lessThan":"ec36b38e65596950e6c29bed7dfc90b98707c19c","versionType":"git","status":"affected"},{"version":"aa45dadd34e44fcd6a9df4b395bee5b5633b4cec","lessThan":"d034e836eefd7ce75e588f7031cffbeec594f5ac","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/sess.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.19","status":"affected"},{"version":"0","lessThan":"5.19","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/c941f1ebfd26f683de81091473f3596a218abff0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d034e836eefd7ce75e588f7031cffbeec594f5ac","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e99040e5e9c60441e6b4725e1a7b88c3106ae903","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ec36b38e65596950e6c29bed7dfc90b98707c19c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee0d8f83d68f6e6509f092c997ccab3c8c801538","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98174","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:17:59.220","lastModified":"2026-10-19T10:18:17.723","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix rlist race and missing initialization\n\nTCP_Server_Info.rlist is allocated via kzalloc which zeros both ->next\nand ->prev to NULL instead of pointing to itself, making list_empty()\nalways return false and list_add() dereference a NULL ->prev pointer.\n\nAlso, cifs_signal_cifsd_for_reconnect() can be called concurrently\nfrom multiple cifsd threads, allowing the same server's rlist node to\nbe added twice into the local list, corrupting it."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/connect.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"b5f924ffbfa976e4b97f17e8132c595b97482c2d","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"5a8f82f9c5839389cf4036029dd75a9911049e83","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"04082b1833856cb9ed87e0d3d5f04cbf836cf7da","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c037d6bde3dd5fa00b017b6b98a5389ec0ebc02f","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"5f270f091256da1338c3631083e15d7f83cc05e1","versionType":"git","status":"affected"},{"version":"0","lessThan":"6.6.158","versionType":"semver","status":"affected"},{"version":"0","lessThan":"6.12.112","versionType":"semver","status":"affected"},{"version":"0","lessThan":"6.18.54","versionType":"semver","status":"affected"},{"version":"0","lessThan":"7.2.8","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/connect.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/04082b1833856cb9ed87e0d3d5f04cbf836cf7da","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5a8f82f9c5839389cf4036029dd75a9911049e83","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5f270f091256da1338c3631083e15d7f83cc05e1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b5f924ffbfa976e4b97f17e8132c595b97482c2d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c037d6bde3dd5fa00b017b6b98a5389ec0ebc02f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98175","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:17:59.477","lastModified":"2026-10-19T10:18:17.840","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: cancel reconnect work in clean_demultiplex_info()\n\nclean_demultiplex_info() cancels server->echo delayed work but not\nserver->reconnect, which can cause a use-after-free when the\ndemultiplex thread exits while a reconnect work is still queued:\n\n  cifs_demultiplex_thread()\n    cifs_readv_from_socket()\n      cifs_reconnect()\n        __cifs_reconnect()\n          cifs_queue_server_reconn()\n            mod_delayed_work(cifsiod_wq, &server->reconnect, 0)\n    clean_demultiplex_info()\n      cancel_delayed_work_sync(&server->echo)   // echo canceled\n                                                 // reconnect NOT canceled\n      kfree_sensitive(server)                    // server freed\n\n  ...later, on cifsiod_wq:\n\n  smb2_reconnect_server()\n    server->srv_count  // UAF read of freed server\n\nFix this by canceling server->reconnect delayed work in\nclean_demultiplex_info() before the server is freed, the same way\ncifs_put_tcp_session() already does."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/connect.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"53e0e11efe9289535b060a51d4cf37c25e0d0f2b","lessThan":"180380272f116dbd2b0354c5c7872e112e519149","versionType":"git","status":"affected"},{"version":"53e0e11efe9289535b060a51d4cf37c25e0d0f2b","lessThan":"e3f6a779433d13aafb5edab59e4f9313051e8a52","versionType":"git","status":"affected"},{"version":"53e0e11efe9289535b060a51d4cf37c25e0d0f2b","lessThan":"7ab9ceedd860216fb97f2d8574cbe58b8906f42a","versionType":"git","status":"affected"},{"version":"53e0e11efe9289535b060a51d4cf37c25e0d0f2b","lessThan":"2e5103e11a17c274715dd56cf185eeedccf686b8","versionType":"git","status":"affected"},{"version":"53e0e11efe9289535b060a51d4cf37c25e0d0f2b","lessThan":"c65eae6f61d1778ff7a82e4aae4080e26f486af1","versionType":"git","status":"affected"},{"version":"e008a962311a875a828cbae54b43285858aaa6c8","versionType":"git","status":"affected"},{"version":"123b228a09b90b50b0a9d6eb8294cf0c42efc029","versionType":"git","status":"affected"},{"version":"0ba4c6eaaacbcc4b18f51bb3b1567c65a8fecca9","versionType":"git","status":"affected"},{"version":"d0d2a4c82942e2f51e4984beea1f7e5a994bd06c","versionType":"git","status":"affected"},{"version":"15a12fbbf365a483b1c19f9caeb707b3bea77e10","versionType":"git","status":"affected"},{"version":"f0b715409cb9cf7e21e690f9b163047739761962","versionType":"git","status":"affected"},{"version":"ff04da387c10b6bf7b510392742c8cd46c130fd6","versionType":"git","status":"affected"},{"version":"48f9526f4dcb4b132fe0dc2450835311e3b013a6","versionType":"git","status":"affected"},{"version":"3.10.107","lessThan":"3.11","versionType":"semver","status":"affected"},{"version":"3.12.70","lessThan":"3.13","versionType":"semver","status":"affected"},{"version":"3.16.42","lessThan":"3.17","versionType":"semver","status":"affected"},{"version":"3.18.47","lessThan":"3.19","versionType":"semver","status":"affected"},{"version":"4.1.38","lessThan":"4.2","versionType":"semver","status":"affected"},{"version":"4.4.40","lessThan":"4.5","versionType":"semver","status":"affected"},{"version":"4.8.16","lessThan":"4.9","versionType":"semver","status":"affected"},{"version":"4.9.1","lessThan":"4.10","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/connect.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.10","status":"affected"},{"version":"0","lessThan":"4.10","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/180380272f116dbd2b0354c5c7872e112e519149","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2e5103e11a17c274715dd56cf185eeedccf686b8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7ab9ceedd860216fb97f2d8574cbe58b8906f42a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c65eae6f61d1778ff7a82e4aae4080e26f486af1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e3f6a779433d13aafb5edab59e4f9313051e8a52","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98176","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:17:59.653","lastModified":"2026-10-19T10:18:17.983","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc\n\nThe low 6 bits of cp_hqd_eop_control store the base-2 logarithm\nof the EOP ring size. This was calculated as\n\nffs(q->eop_ring_buffer_size / sizeof(unsigned int)) - 1 - 1\n\nBut ffs can in theory return 1 or 0, so this could underflow\n(although in practice the ring buffer size cannot be less than 4096).\n\nChange this to\n\nffs(q->eop_ring_buffer_size / sizeof(unsigned int) / 4)\n\nusing properties of logarithms.\n\n(cherry picked from commit 4f18c56630383c14bfc6b2d65f88f2f895d2121a)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c","drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c","drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12.c","drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12_1.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"14328aa58ce523a59996c5a82681c43ec048cc33","lessThan":"82e1b8299c6da02ce02185c208d2fdf7572b5ea1","versionType":"git","status":"affected"},{"version":"14328aa58ce523a59996c5a82681c43ec048cc33","lessThan":"c883d0a132d430ef7ebb23fd94323be94d0fbdb8","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c","drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c","drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12.c","drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12_1.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.3","status":"affected"},{"version":"0","lessThan":"5.3","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/82e1b8299c6da02ce02185c208d2fdf7572b5ea1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c883d0a132d430ef7ebb23fd94323be94d0fbdb8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98177","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:17:59.787","lastModified":"2026-10-19T10:18:18.070","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Avoid integer underflow in EOP ring size calculation.\n\nThe low 6 bits of cp_hqd_eop_control store the base-2 logarithm\nof the EOP ring size. This was calculated as\n\norder_base_2(q->eop_ring_buffer_size / 4) - 1\n\nBut order_base_2 can in theory return 0, so this could underflow\n(although in practice the ring buffer size cannot be less than 4096).\n\nChange this to\n\norder_base_2(q->eop_ring_buffer_size / 8)\n\nusing properties of logarithms.\n\nAlso add to the above comment to make the mathematics more clear.\n\n(cherry picked from commit f0f43fcf8b2b3a924cad9444340921c96ed5f634)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c","drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_vi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d696d536f0a97ac779d6176107ac4e96d0a2f8b9","lessThan":"287a34c4d712e0bdb67751e21316d9c8d75a528a","versionType":"git","status":"affected"},{"version":"d696d536f0a97ac779d6176107ac4e96d0a2f8b9","lessThan":"8ee521b8b189799e361d4233c5180ba56656d4d4","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c","drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_vi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.3","status":"affected"},{"version":"0","lessThan":"4.3","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/287a34c4d712e0bdb67751e21316d9c8d75a528a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8ee521b8b189799e361d4233c5180ba56656d4d4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98178","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:17:59.930","lastModified":"2026-10-19T10:18:18.153","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Skip KFD mapping clear before initialization\n\namdgpu_amdkfd_clear_kfd_mapping() assumes that a non-NULL kfd_dev\nhas a fully populated node array. This is not true when KFD device\ninitialization fails after probe.\n\nFor example, kgd2kfd_device_init() sets num_nodes before checking\nPCIe atomics support. On Polaris systems without the required atomics,\nit returns before allocating nodes[0], but the kfd_dev remains attached\nto the amdgpu device. A later GPU reset then dereferences nodes[0]->id.\n\nRequire the authoritative KFD initialization flag before walking the\nnode array, matching the existing KFD reset and teardown paths.\n\n(cherry picked from commit 4ac1835823c47903fbb278bbf474773c46f59edc)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"70cadefcc6160c575b04f763ada34c20e868d577","lessThan":"157d3f1db7e7e6f320daa221fae84a4c13555b6f","versionType":"git","status":"affected"},{"version":"70cadefcc6160c575b04f763ada34c20e868d577","lessThan":"7f9caa70aef0950e06d395ca0035831214d88187","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.2","status":"affected"},{"version":"0","lessThan":"7.2","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/157d3f1db7e7e6f320daa221fae84a4c13555b6f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7f9caa70aef0950e06d395ca0035831214d88187","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98179","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:00.123","lastModified":"2026-10-19T10:18:18.240","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix rmmio iounmap skipped on device removal\n\namdgpu_pci_remove() calls drm_dev_unplug() before fini_sw(), so\ndrm_dev_enter() is already false there and the iounmap() guarded by it\nis skipped. This .remove path runs on both hot-unplug and plain rmmod,\nso the register BAR ioremap mapping leaks one instance per unload.\n\nUnmap rmmio unconditionally (guard only on non-NULL) and drop the now\nunused idx.\n\n(cherry picked from commit dd6f86a97260e5207d3329ad03aa89fdad61b1e6)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"62d5f9f7110ad374db67ab4820f4ff2d916c3cdb","lessThan":"e81502d6791df9ecd003bfb2ca44f0d1f1b38439","versionType":"git","status":"affected"},{"version":"62d5f9f7110ad374db67ab4820f4ff2d916c3cdb","lessThan":"cd55dde2b63789a3dafe982c89844f537501d096","versionType":"git","status":"affected"},{"version":"62d5f9f7110ad374db67ab4820f4ff2d916c3cdb","lessThan":"a645584c3ccc493ee835f77155829442bd7578c3","versionType":"git","status":"affected"},{"version":"62d5f9f7110ad374db67ab4820f4ff2d916c3cdb","lessThan":"5155002b03b24ba3ef91c5c313b8cf0171b24904","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.17","status":"affected"},{"version":"0","lessThan":"5.17","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5155002b03b24ba3ef91c5c313b8cf0171b24904","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a645584c3ccc493ee835f77155829442bd7578c3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cd55dde2b63789a3dafe982c89844f537501d096","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e81502d6791df9ecd003bfb2ca44f0d1f1b38439","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98180","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:01.617","lastModified":"2026-10-19T10:18:18.327","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: RCU-free the scheduler-containing ring and VM objects\n\nBoth struct msm_ringbuffer and struct msm_gem_vm embed a struct\ndrm_gpu_scheduler.  msm_ringbuffer_destroy() and the VM free callback\nmsm_gem_vm_free() call drm_sched_fini() on the embedded scheduler and then\nfree the containing object with plain kfree().\n\ndrm_sched_fence_get_timeline_name() returns fence->sched->name, and the\nscheduler fence keeps a .release callback so it is not ops-detached on\nsignalling.  A finished fence exported to userspace (the submit out-fence, or\na VM_BIND fence, via sync_file / drm_syncobj) keeps pointing at the embedded\nscheduler after the ring/VM is freed, so a later get_timeline_name() --\nreachable unprivileged through SYNC_IOC_FILE_INFO -- dereferences freed slab\nmemory (KASAN slab-use-after-free read).\n\nPer the dma-fence lifetime contract the exporter must keep the data backing a\nsignalled fence alive for an RCU grace period.  Free the scheduler-containing\nobjects with kfree_rcu() instead of kfree().\n\nPatchwork: https://patchwork.freedesktop.org/patch/750234/"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/msm/msm_gem.h","drivers/gpu/drm/msm/msm_gem_vma.c","drivers/gpu/drm/msm/msm_ringbuffer.c","drivers/gpu/drm/msm/msm_ringbuffer.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1d8a5ca436ee4a28eec14cb813f790f7cdeeee19","lessThan":"d81bf4581903b0cba0698cd4d1c07fc6be21754a","versionType":"git","status":"affected"},{"version":"1d8a5ca436ee4a28eec14cb813f790f7cdeeee19","lessThan":"713abac5c04ccbae67f9ac68c3921845535388e7","versionType":"git","status":"affected"},{"version":"1d8a5ca436ee4a28eec14cb813f790f7cdeeee19","lessThan":"01c8d1f385f788f1bbbbb7687c4386d614281218","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/msm/msm_gem.h","drivers/gpu/drm/msm/msm_gem_vma.c","drivers/gpu/drm/msm/msm_ringbuffer.c","drivers/gpu/drm/msm/msm_ringbuffer.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/01c8d1f385f788f1bbbbb7687c4386d614281218","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/713abac5c04ccbae67f9ac68c3921845535388e7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d81bf4581903b0cba0698cd4d1c07fc6be21754a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98181","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:02.807","lastModified":"2026-10-19T10:18:18.437","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gud: fix out-of-bounds write in gud_plane_atomic_check()\n\nThe plane property loop uses req->properties[num_properties + i] as write\nindex while simultaneously incrementing `num_properties` inside the loop.\nAt iteration i, num_properties has also incremented by i, so the write\nis done at `initial_num_properties + 2*i`, skipping every other index and\nadvancing by 2 per iteration.\n\nWith just 2 connector and 32 plane properties the last write happens at\nindex 64, one slot past the end of the 64-slot (indices 0–63)\nallocation. A USB device can trigger OOB by advertising the maximum\nnumber of properties.\n\nFix by dropping the redundant `+ i`; num_properties is already the correct\nrunning index, as gud_connector_fill_properties() fills the preceding\nslots."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/gud/gud_pipe.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","lessThan":"ee04903fe6a098160d20dde4fc5af4cb42846735","versionType":"git","status":"affected"},{"version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","lessThan":"4153a9e008f2512bd3cf90a319436865847369b9","versionType":"git","status":"affected"},{"version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","lessThan":"5f5e565410b4987e9663f599f9ab0c350f8338d4","versionType":"git","status":"affected"},{"version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","lessThan":"7e630edb22088df7aa0d55b02237a71e4c9a523d","versionType":"git","status":"affected"},{"version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","lessThan":"2c92af27ad23e2fbc0367b11a9027d36d94ef4b3","versionType":"git","status":"affected"},{"version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","lessThan":"ea57100955c1c2a525ba1a98c18d9a05b25aeedb","versionType":"git","status":"affected"},{"version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","lessThan":"59ced288fcba9e91bd38e61a972ad782c4edb7d0","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/gud/gud_pipe.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2c92af27ad23e2fbc0367b11a9027d36d94ef4b3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4153a9e008f2512bd3cf90a319436865847369b9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/59ced288fcba9e91bd38e61a972ad782c4edb7d0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5f5e565410b4987e9663f599f9ab0c350f8338d4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7e630edb22088df7aa0d55b02237a71e4c9a523d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ea57100955c1c2a525ba1a98c18d9a05b25aeedb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee04903fe6a098160d20dde4fc5af4cb42846735","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98182","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:02.967","lastModified":"2026-10-19T10:18:18.537","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: refuse to make a monitor active when it has no queue\n\nA monitor interface only gets a TXQ if it's created active, and one can't\nbe added later. Setting the flag on a down interface is still allowed, so\nthe driver is handed a monitor with no queue. ath9k dereferences it:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000066\n  RIP: 0010:ath_tx_node_init+0x49/0x170 [ath9k]\n   ath9k_add_interface+0x10c/0x140 [ath9k]\n   drv_add_interface+0x54/0x250 [mac80211]\n   ieee80211_do_open+0x32f/0x800 [mac80211]\n\nReached with CAP_NET_ADMIN by \"iw dev X set monitor active\" followed by\n\"ip link set X up\". RTNL is held, so netlink operations block behind it.\n\nRefuse the flag when there is no queue to give."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/mac80211/cfg.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"79af1f866193de29e65a4dba7d0dab14b0c0ff93","lessThan":"b7b7d46ec4fa127767931938b282c361c0519af6","versionType":"git","status":"affected"},{"version":"79af1f866193de29e65a4dba7d0dab14b0c0ff93","lessThan":"abe15e643e576459469867758ae9c586a7bab95d","versionType":"git","status":"affected"},{"version":"79af1f866193de29e65a4dba7d0dab14b0c0ff93","lessThan":"46c223468537a05a404699771cd3e68532dab5e6","versionType":"git","status":"affected"},{"version":"79af1f866193de29e65a4dba7d0dab14b0c0ff93","lessThan":"2b04d6556964ae9f89819b86a0a7801e39c3aae5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/mac80211/cfg.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.15","status":"affected"},{"version":"0","lessThan":"4.15","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2b04d6556964ae9f89819b86a0a7801e39c3aae5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/46c223468537a05a404699771cd3e68532dab5e6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/abe15e643e576459469867758ae9c586a7bab95d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b7b7d46ec4fa127767931938b282c361c0519af6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98183","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:03.103","lastModified":"2026-10-19T10:18:18.630","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: avoid out-of-bounds read for empty PREQ elements\n\nieee80211_mesh_preq_size_ok() derives the location of the PREQ bottom\nfields before checking whether the element contains even the fixed\nheader. ieee80211_mesh_hwmp_preq_get_bottom() reads the flags byte to\naccount for the optional Address Extension field. Consequently, an\nempty PREQ element causes a one-byte read beyond its declared payload.\n\nMove the helper call after both size checks, so the bottom fields are\nonly accessed when they are present."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/linux/ieee80211-mesh.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8b40b1d24a6099fe9fac8e207d4cb04ab5e0baae","lessThan":"3beddbd56946577478fd5e649f556aaaebe15b0a","versionType":"git","status":"affected"},{"version":"8b40b1d24a6099fe9fac8e207d4cb04ab5e0baae","lessThan":"e6031f02269c0f51cf67886d177f02bc300b47cd","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/linux/ieee80211-mesh.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.2","status":"affected"},{"version":"0","lessThan":"7.2","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3beddbd56946577478fd5e649f556aaaebe15b0a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e6031f02269c0f51cf67886d177f02bc300b47cd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98184","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:03.233","lastModified":"2026-10-19T10:18:18.727","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: prevent authentication frame length truncation\n\nmwifiex_cfg80211_authenticate() derives the authentication frame length\nfrom req->ie_len and req->auth_data_len, both of type size_t, but stores\nit in a u16.\n\nNL80211_ATTR_AUTH_DATA only has a minimum length policy. Since nla_len is\na u16, a single attribute can carry up to 65531 bytes of payload, so the\nsum can exceed U16_MAX before it is assigned to pkt_len. The truncated\npkt_len determines the skb frame area, while the copy length remains\nreq->auth_data_len - 4, resulting in a heap buffer overflow.\n\nFor example, with auth_data_len equal to 65510 and no IEs, the sum is\n65546. It is truncated to 10 and then reduced by four to 6. The driver\nappends only six bytes to the skb with skb_put(), but then copies 65506\nuser-provided bytes into the authentication body.\n\nReaching this path requires CAP_NET_ADMIN in the user namespace owning\nthe network namespace, an up station netdev, and a suitable BSS/SAE\nauthentication request.\n\nCompute the length in size_t, reject values that cannot be represented by\nthe firmware's u16 frame length field, and only then assign it to pkt_len."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/marvell/mwifiex/cfg80211.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"36995892c271cce5e2230bc165a06f109b117222","lessThan":"25c45a2075cc00faed45f92a64bb172fb074a2ee","versionType":"git","status":"affected"},{"version":"36995892c271cce5e2230bc165a06f109b117222","lessThan":"5747eaa38a7fcad48be2fd910b65008198b2b06c","versionType":"git","status":"affected"},{"version":"36995892c271cce5e2230bc165a06f109b117222","lessThan":"877b61a67d5eb3e616478daf3908114b57feff1e","versionType":"git","status":"affected"},{"version":"36995892c271cce5e2230bc165a06f109b117222","lessThan":"fa00193eb991f92b007aefe7afb6a7566976dacf","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/marvell/mwifiex/cfg80211.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.12","status":"affected"},{"version":"0","lessThan":"6.12","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/25c45a2075cc00faed45f92a64bb172fb074a2ee","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5747eaa38a7fcad48be2fd910b65008198b2b06c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/877b61a67d5eb3e616478daf3908114b57feff1e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fa00193eb991f92b007aefe7afb6a7566976dacf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98185","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:03.380","lastModified":"2026-10-19T10:18:18.823","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: validate scan response extents\n\nmwifiex_ret_802_11_scan() subtracts the fixed response fields and the\nfirmware-provided BSS length from resp->size without first proving that\neither extent fits. A short response or oversized BSS length can\ntherefore underflow tlv_buf_size and make the TLV parser walk beyond the\ncommand response.\n\nCompute the fixed extent from the selected normal or background scan\nresponse. Validate that the fixed fields and BSS data fit before deriving\nthe TLV extent and entering the parser."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/marvell/mwifiex/scan.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e","lessThan":"25217c5f6ce0bf3004f80c129464cd35fe9a420f","versionType":"git","status":"affected"},{"version":"5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e","lessThan":"48312f0085aa1577d6d41af2a079b34de17c1a57","versionType":"git","status":"affected"},{"version":"5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e","lessThan":"dccf5ecaad4d8d43c545921f20328e8f91af8698","versionType":"git","status":"affected"},{"version":"5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e","lessThan":"c4943323fda22ef27bb6479b9d328ae48c63f64c","versionType":"git","status":"affected"},{"version":"5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e","lessThan":"cb0008480ed7d5cf76f3ad9668a91bbb7d0b4417","versionType":"git","status":"affected"},{"version":"5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e","lessThan":"9cff2f39ed38a32070b08364c4c9346e85b8f9ec","versionType":"git","status":"affected"},{"version":"5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e","lessThan":"7106ad8b74f50cca1ef36131f327d2c78f556daa","versionType":"git","status":"affected"},{"version":"5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e","lessThan":"3687d7d48070838cc2953431b3a27717cab0aaf6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/marvell/mwifiex/scan.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.0","status":"affected"},{"version":"0","lessThan":"3.0","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/25217c5f6ce0bf3004f80c129464cd35fe9a420f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3687d7d48070838cc2953431b3a27717cab0aaf6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/48312f0085aa1577d6d41af2a079b34de17c1a57","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7106ad8b74f50cca1ef36131f327d2c78f556daa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9cff2f39ed38a32070b08364c4c9346e85b8f9ec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c4943323fda22ef27bb6479b9d328ae48c63f64c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cb0008480ed7d5cf76f3ad9668a91bbb7d0b4417","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dccf5ecaad4d8d43c545921f20328e8f91af8698","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98186","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:03.540","lastModified":"2026-10-19T10:18:18.940","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length\n\nmwifiex_search_oui_in_ie() reads a pairwise-cipher (PTK) count from a\nbeacon/probe-response RSN or WPA information element and then walks that\nmany 4-byte OUIs, comparing each with memcmp(). The count comes straight\nfrom the (attacker-supplied) IE and is never checked against the\nelement's own length, and the callers admit the element on element_id\nalone (has_ieee_hdr() / has_vendor_hdr(), no length check). A crafted\nRSN/WPA IE with a large pairwise count therefore makes the walk read up\nto 255 * 4 bytes past the element -- an out-of-bounds read of the\nkmemdup()'d beacon buffer, reachable from any AP whose beacon/probe\nresponse is processed during scan-result parsing.\n\nPass the number of IE bytes available at the OUI list and bound the walk\nto the element. Keep the length signed and reject a negative value\nbefore any unsigned arithmetic, so a small or zero IE length cannot\nunderflow to a large size_t and defeat the bound.\n\nFound by 0sec automated security-research tooling (https://0sec.ai)."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/marvell/mwifiex/scan.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e","lessThan":"77e642af7f2f6029e12a35c847c56cbd0466e799","versionType":"git","status":"affected"},{"version":"5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e","lessThan":"982b8fcdbb28f63bbbf02f0822c0bbda12ec27ed","versionType":"git","status":"affected"},{"version":"5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e","lessThan":"58767b41f87244eebaa5a475b9d276c83b89b933","versionType":"git","status":"affected"},{"version":"5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e","lessThan":"2402c9e2644b7e10c7aaaf87bf12743d7e363559","versionType":"git","status":"affected"},{"version":"5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e","lessThan":"54a9cc5bd70b0d77a5069d4c46998c679a10c857","versionType":"git","status":"affected"},{"version":"5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e","lessThan":"8bbef2b1ebfbadc0b9c37bbbf9c9e26fe2e41960","versionType":"git","status":"affected"},{"version":"5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e","lessThan":"46cda9d42f0d6ec3057d878ddb1f38c0ab9f51df","versionType":"git","status":"affected"},{"version":"5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e","lessThan":"e667aee1c192d67d27c803007bfa9c6e0873e959","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/marvell/mwifiex/scan.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.0","status":"affected"},{"version":"0","lessThan":"3.0","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2402c9e2644b7e10c7aaaf87bf12743d7e363559","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/46cda9d42f0d6ec3057d878ddb1f38c0ab9f51df","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/54a9cc5bd70b0d77a5069d4c46998c679a10c857","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/58767b41f87244eebaa5a475b9d276c83b89b933","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/77e642af7f2f6029e12a35c847c56cbd0466e799","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8bbef2b1ebfbadc0b9c37bbbf9c9e26fe2e41960","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/982b8fcdbb28f63bbbf02f0822c0bbda12ec27ed","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e667aee1c192d67d27c803007bfa9c6e0873e959","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98187","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:03.707","lastModified":"2026-10-19T10:18:19.057","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: p54: require a full exp_if record in PDR_INTERFACE_LIST\n\nThe PDR_INTERFACE_LIST loop only checks that the record start is within\nthe entry before reading an entire struct exp_if from it. A truncated\ntrailing record makes the if_id/variant reads cross the entry boundary\ninto the heap beyond the EEPROM buffer (verified with a KASAN\nreproducer of the loop). The variant also feeds the synth front-end\nselection, so this is not only a leak.\n\nAdvance only while a full record still fits in the entry."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intersil/p54/eeprom.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"eff1a59c48e3c6a006eb4fe5f2e405a996f2259d","lessThan":"162dbe1c285a621eab6a9f2851086b63a0378928","versionType":"git","status":"affected"},{"version":"eff1a59c48e3c6a006eb4fe5f2e405a996f2259d","lessThan":"70bf34b425fe549a4f6a8d50a319f8f05d1f91c9","versionType":"git","status":"affected"},{"version":"eff1a59c48e3c6a006eb4fe5f2e405a996f2259d","lessThan":"487f966421014de41e835bbce3feb30b35f4f729","versionType":"git","status":"affected"},{"version":"eff1a59c48e3c6a006eb4fe5f2e405a996f2259d","lessThan":"bc83c04be042f53869c315b8e1eb5f124959d1d7","versionType":"git","status":"affected"},{"version":"eff1a59c48e3c6a006eb4fe5f2e405a996f2259d","lessThan":"d44c1badc2dcb042985f7e37f4c448c84548b81f","versionType":"git","status":"affected"},{"version":"eff1a59c48e3c6a006eb4fe5f2e405a996f2259d","lessThan":"d2fb6b588dc5bbab4f603661e41cd60f0d931628","versionType":"git","status":"affected"},{"version":"eff1a59c48e3c6a006eb4fe5f2e405a996f2259d","lessThan":"d82492fd0a3fb61963c236521852763238ad3898","versionType":"git","status":"affected"},{"version":"eff1a59c48e3c6a006eb4fe5f2e405a996f2259d","lessThan":"d8efd84f49379ed28624098821f80e992657d935","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intersil/p54/eeprom.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.24","status":"affected"},{"version":"0","lessThan":"2.6.24","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/162dbe1c285a621eab6a9f2851086b63a0378928","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/487f966421014de41e835bbce3feb30b35f4f729","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/70bf34b425fe549a4f6a8d50a319f8f05d1f91c9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bc83c04be042f53869c315b8e1eb5f124959d1d7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d2fb6b588dc5bbab4f603661e41cd60f0d931628","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d44c1badc2dcb042985f7e37f4c448c84548b81f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d82492fd0a3fb61963c236521852763238ad3898","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d8efd84f49379ed28624098821f80e992657d935","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98188","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:03.867","lastModified":"2026-10-19T10:18:19.167","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: p54: validate curve data length in the calibration curve converters\n\np54_convert_rev0() and p54_convert_rev1() read calibration curve\ndata from the device-supplied EEPROM entry using channel and\npoints-per-channel counts taken verbatim from that same entry, so\nan entry that declares more data than it carries drives an\nout-of-bounds read past the EEPROM buffer (verified with a KASAN\nreproducer of the conversion loop). The sibling converters\np54_convert_output_limits() and p54_convert_db() already validate\ntheir counts against the entry length; this path was missed.\n\nReject the entry when the counts do not fit in the entry data."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intersil/p54/eeprom.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"eff1a59c48e3c6a006eb4fe5f2e405a996f2259d","lessThan":"81084c967c18233b19799a0c3352ebac043f31e2","versionType":"git","status":"affected"},{"version":"eff1a59c48e3c6a006eb4fe5f2e405a996f2259d","lessThan":"41cdf14bf4b52fbe4673a172c2a6ad756cb08111","versionType":"git","status":"affected"},{"version":"eff1a59c48e3c6a006eb4fe5f2e405a996f2259d","lessThan":"03d313e3dfb49a44c10a5c423452967694fb85e2","versionType":"git","status":"affected"},{"version":"eff1a59c48e3c6a006eb4fe5f2e405a996f2259d","lessThan":"42f4b03971f9d6329c4cbd1ea5155210d16ab65b","versionType":"git","status":"affected"},{"version":"eff1a59c48e3c6a006eb4fe5f2e405a996f2259d","lessThan":"4d767d6f8753db22bfc14c2724bd9cee677ffb03","versionType":"git","status":"affected"},{"version":"eff1a59c48e3c6a006eb4fe5f2e405a996f2259d","lessThan":"3bdcc4d61212b001b8752d80036509b4974ce16c","versionType":"git","status":"affected"},{"version":"eff1a59c48e3c6a006eb4fe5f2e405a996f2259d","lessThan":"b0c906107150b16925ee66da09127259864c7f36","versionType":"git","status":"affected"},{"version":"eff1a59c48e3c6a006eb4fe5f2e405a996f2259d","lessThan":"ce858fa6b8a214dee5adb82358885fa024cdd887","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intersil/p54/eeprom.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.24","status":"affected"},{"version":"0","lessThan":"2.6.24","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/03d313e3dfb49a44c10a5c423452967694fb85e2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3bdcc4d61212b001b8752d80036509b4974ce16c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/41cdf14bf4b52fbe4673a172c2a6ad756cb08111","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/42f4b03971f9d6329c4cbd1ea5155210d16ab65b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4d767d6f8753db22bfc14c2724bd9cee677ffb03","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/81084c967c18233b19799a0c3352ebac043f31e2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b0c906107150b16925ee66da09127259864c7f36","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ce858fa6b8a214dee5adb82358885fa024cdd887","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98189","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:04.033","lastModified":"2026-10-19T10:18:19.277","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()\n\nwilc_wlan_handle_isr_ext() takes the RX transfer size from the\ndevice-reported interrupt status register (a 15-bit field shifted left by 2,\nup to 131068 bytes) and reads that many bytes from the device into\nrx_buffer, which is only WILC_RX_BUFF_SIZE (96K) large. The wrap\ncheck only handles the current offset; the size itself is never\ncompared against the buffer, so a bogus SDIO device can make the driver\nOOB-write rx_buffer by up to ~32K with data it controls.\n\nThe oversized transfer also leaves rx_buffer_offset past the end of\nthe buffer, after which the unsigned wrap check stops working and\nthe overflow can repeat.\n\nDrop any transfer whose size exceeds the RX buffer, acknowledging\nthe data interrupt and re-arming the RX engine so the bogus frame is\ndiscarded and reception can continue. This also restores the\nrx_buffer_offset <= WILC_RX_BUFF_SIZE invariant the wrap check\nrelies on.\n\nThis is not expected to change driver behavior in most cases:\nwithout this check, an oversized transfer would most likely\ncorrupt neighboring kernel memory instead of completing anyway, and\nthe drop path performs the same interrupt acknowledgment and RX\nengine re-arming as the normal path, so subsequent transfers are\nreceived unaffected.\n\nDiscovered by Atuin - Automated Vulnerability Discovery Engine."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/microchip/wilc1000/wlan.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c5c77ba18ea66aa05441c71e38473efb787705a4","lessThan":"3ddb88e237bc1e59fd37b1cf369f3b6c2dedae26","versionType":"git","status":"affected"},{"version":"c5c77ba18ea66aa05441c71e38473efb787705a4","lessThan":"9f6a276ade936a8803f9f3df217c2368944dc321","versionType":"git","status":"affected"},{"version":"c5c77ba18ea66aa05441c71e38473efb787705a4","lessThan":"aeb44a456d126d89863230eef0187e77e6441995","versionType":"git","status":"affected"},{"version":"c5c77ba18ea66aa05441c71e38473efb787705a4","lessThan":"612ed9224eae70c53c0c88cb0990e0f9b709280a","versionType":"git","status":"affected"},{"version":"c5c77ba18ea66aa05441c71e38473efb787705a4","lessThan":"304a5d72a04a3979a6434088c8d9c5172c2a908e","versionType":"git","status":"affected"},{"version":"c5c77ba18ea66aa05441c71e38473efb787705a4","lessThan":"4f86fb6f9dce04f697da85806ad96a932fc2f079","versionType":"git","status":"affected"},{"version":"c5c77ba18ea66aa05441c71e38473efb787705a4","lessThan":"14dcf4c3d74c878175b19d3da5986f83f26b1dd5","versionType":"git","status":"affected"},{"version":"c5c77ba18ea66aa05441c71e38473efb787705a4","lessThan":"c1ba7f7f18465e259cf1b4d9c73fc73853d7f790","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/microchip/wilc1000/wlan.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.2","status":"affected"},{"version":"0","lessThan":"4.2","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/14dcf4c3d74c878175b19d3da5986f83f26b1dd5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/304a5d72a04a3979a6434088c8d9c5172c2a908e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3ddb88e237bc1e59fd37b1cf369f3b6c2dedae26","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4f86fb6f9dce04f697da85806ad96a932fc2f079","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/612ed9224eae70c53c0c88cb0990e0f9b709280a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9f6a276ade936a8803f9f3df217c2368944dc321","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aeb44a456d126d89863230eef0187e77e6441995","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c1ba7f7f18465e259cf1b4d9c73fc73853d7f790","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98190","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:04.210","lastModified":"2026-10-19T10:18:19.400","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wilc1000: fix out-of-bounds read in P2P public action frames\n\nwilc_wfi_p2p_rx() and mgmt_tx() start parsing a frame once\nieee80211_is_public_action() returns true. That helper only verifies the\nframe is long enough for the action category field, that is\noffsetofend(struct ieee80211_mgmt, u.action.category), 25 bytes. Both\nfunctions then read the P2P public action header up to oui_subtype at\noffset 30 and pass \"size - ie_offset\" to cfg80211_find_vendor_ie(), where\nie_offset is offsetof(struct ieee80211_mgmt, u) + sizeof(*d), i.e. 32.\n\nA public action frame of 25 to 31 bytes passes the check but is shorter\nthan that 32 byte header, so oui_subtype can be read out of bounds, and\nbecause the length is unsigned, \"size - ie_offset\" underflows to a value\nclose to 4 GiB. cfg80211_find_vendor_ie() takes an unsigned int length,\nso even the size_t subtraction in mgmt_tx() is truncated to the same\nvalue. It then walks far past the buffer searching for a vendor element\nuntil it reaches unmapped memory.\n\nIn the receive path the frame arrives over the air and needs no\nassociation, so a nearby unauthenticated device can crash the host while\nit is in P2P listen. Reject frames shorter than the P2P public action\nheader in both paths before dereferencing it."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/microchip/wilc1000/cfg80211.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4fb8b5aa2a1126783ae00bae544d6f3c519408ef","lessThan":"e98ad9f4c59f2e836f8d971b57763a4277680422","versionType":"git","status":"affected"},{"version":"4fb8b5aa2a1126783ae00bae544d6f3c519408ef","lessThan":"f0c46f8111a479b97b8ab17747c528cade6257f1","versionType":"git","status":"affected"},{"version":"4fb8b5aa2a1126783ae00bae544d6f3c519408ef","lessThan":"a5b827dad8a3037cef04d0240d1c2acb1557101e","versionType":"git","status":"affected"},{"version":"4fb8b5aa2a1126783ae00bae544d6f3c519408ef","lessThan":"491df93b10d76aebaf6aa4bb05a6ba897f4fccfb","versionType":"git","status":"affected"},{"version":"4fb8b5aa2a1126783ae00bae544d6f3c519408ef","lessThan":"cc2ee642ebeac8699b671ddb6d5955a785e5ff43","versionType":"git","status":"affected"},{"version":"4fb8b5aa2a1126783ae00bae544d6f3c519408ef","lessThan":"68b786691ce24c5c94e28811db243e573c50f9c1","versionType":"git","status":"affected"},{"version":"4fb8b5aa2a1126783ae00bae544d6f3c519408ef","lessThan":"6fbe76eb2796d2aee45cc6a2dd16e85d3cc96304","versionType":"git","status":"affected"},{"version":"4fb8b5aa2a1126783ae00bae544d6f3c519408ef","lessThan":"ba6cb7c0868a412c2eb68e8efd5aa38bfb258a14","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/microchip/wilc1000/cfg80211.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.7","status":"affected"},{"version":"0","lessThan":"5.7","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/491df93b10d76aebaf6aa4bb05a6ba897f4fccfb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/68b786691ce24c5c94e28811db243e573c50f9c1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6fbe76eb2796d2aee45cc6a2dd16e85d3cc96304","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a5b827dad8a3037cef04d0240d1c2acb1557101e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ba6cb7c0868a412c2eb68e8efd5aa38bfb258a14","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cc2ee642ebeac8699b671ddb6d5955a785e5ff43","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e98ad9f4c59f2e836f8d971b57763a4277680422","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f0c46f8111a479b97b8ab17747c528cade6257f1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98191","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:04.377","lastModified":"2026-10-19T10:18:19.513","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wlcore: release runtime PM ref on regdomain config failure\n\nwlcore_regdomain_config() gets a runtime PM reference before sending\nthe regulatory-domain command. When\nwlcore_cmd_regdomain_config_locked() fails, the function queues recovery\nand returns without dropping that reference.\n\nRelease the reference after handling the command result so both success\nand failure paths balance the preceding\npm_runtime_resume_and_get(). The recovery worker takes a separate\nruntime PM reference and cannot release the reference held here."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/ti/wlcore/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8","lessThan":"85ec6c451fe681ac3135dfa43a519f1404ae63ad","versionType":"git","status":"affected"},{"version":"fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8","lessThan":"3fbaae01bb7847d8b0124a8bbdb3af865e388d53","versionType":"git","status":"affected"},{"version":"fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8","lessThan":"c02352e2b5a241c8da89b5f5f1a0ae4d403120ed","versionType":"git","status":"affected"},{"version":"fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8","lessThan":"05b5e297bbf46f92c80da4c2ebe67828ca0d0247","versionType":"git","status":"affected"},{"version":"fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8","lessThan":"18eb148105f1af9163f5e9758f0a7bc6ab042423","versionType":"git","status":"affected"},{"version":"fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8","lessThan":"7f1f25b2db14683ab75d0d22c00d6a75ba988b83","versionType":"git","status":"affected"},{"version":"fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8","lessThan":"a6bb6ad517a0d4db33a0cac9448e3ae9f4008fb4","versionType":"git","status":"affected"},{"version":"fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8","lessThan":"8a1f3cf89ddcc700e25afe42cfad333059adcc94","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/ti/wlcore/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.19","status":"affected"},{"version":"0","lessThan":"4.19","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/05b5e297bbf46f92c80da4c2ebe67828ca0d0247","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/18eb148105f1af9163f5e9758f0a7bc6ab042423","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3fbaae01bb7847d8b0124a8bbdb3af865e388d53","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7f1f25b2db14683ab75d0d22c00d6a75ba988b83","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/85ec6c451fe681ac3135dfa43a519f1404ae63ad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8a1f3cf89ddcc700e25afe42cfad333059adcc94","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a6bb6ad517a0d4db33a0cac9448e3ae9f4008fb4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c02352e2b5a241c8da89b5f5f1a0ae4d403120ed","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98192","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:04.537","lastModified":"2026-10-21T13:21:25.300","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown\n\nwcn36xx_dxe_deinit() tears down the TX ack timer with timer_delete(),\nwhich only dequeues the timer and does not wait for a callback that is\nalready executing; the preceding free_irq() calls synchronize the\ninterrupt handlers only. The callback, wcn36xx_dxe_tx_timer(), can\ntherefore be running past the teardown and use the wcn freed along\nwith the ieee80211_hw in wcn36xx_remove(): it takes wcn->dxe_lock,\nreads wcn->tx_ack_skb and passes wcn->hw to\nieee80211_tx_status_irqsafe().\n\nFix this by using timer_shutdown_sync(), which waits for a running\ncallback and also prevents the timer from being rearmed again. The\ntimer is set up again by wcn36xx_dxe_init() on the next start, so the\nstart/stop cycle is unaffected.\n\nThis issue was found by an in-house static analysis tool."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/ath/wcn36xx/dxe.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fdf21cc3714939dd4327f3d664fe5863d15ccb31","lessThan":"15e59e377facc87ce82228279d88efaa89fdbca5","versionType":"git","status":"affected"},{"version":"fdf21cc3714939dd4327f3d664fe5863d15ccb31","lessThan":"3edabc965bcce49cbb2ec1c2b91f8a555a8ec8bd","versionType":"git","status":"affected"},{"version":"fdf21cc3714939dd4327f3d664fe5863d15ccb31","lessThan":"2bddc5d088cf430ecd913020472f1def32a36a3d","versionType":"git","status":"affected"},{"version":"fdf21cc3714939dd4327f3d664fe5863d15ccb31","lessThan":"c0df0878e9110909cf0bec6080d72d36401a0c89","versionType":"git","status":"affected"},{"version":"fdf21cc3714939dd4327f3d664fe5863d15ccb31","lessThan":"d9be5e75530772fc31637070d51e5717d6aeaa2a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/ath/wcn36xx/dxe.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.10","status":"affected"},{"version":"0","lessThan":"5.10","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/15e59e377facc87ce82228279d88efaa89fdbca5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2bddc5d088cf430ecd913020472f1def32a36a3d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3edabc965bcce49cbb2ec1c2b91f8a555a8ec8bd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c0df0878e9110909cf0bec6080d72d36401a0c89","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d9be5e75530772fc31637070d51e5717d6aeaa2a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98193","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:04.670","lastModified":"2026-10-21T13:21:25.423","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libipw: reject TKIP frames without a full MIC\n\nlibipw_michael_mic_verify() assumes that an skb contains an eight-byte\nMichael MIC. A short TKIP frame makes the unsigned payload length wrap,\ncausing michael_mic() to read past the skb.\n\nCheck that the MIC is present before verifying it, and use the existing\nMICHAEL_MIC_LEN constant for all MIC lengths in the verifier."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/ipw2x00/libipw_crypto_tkip.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b453872c35cfcbdbf5a794737817f7d4e7b1b579","lessThan":"f448b267968d0ee985e5927c868c8f858169ab34","versionType":"git","status":"affected"},{"version":"b453872c35cfcbdbf5a794737817f7d4e7b1b579","lessThan":"9a7fb67364817710c96785ff86b71a2711ee92cb","versionType":"git","status":"affected"},{"version":"b453872c35cfcbdbf5a794737817f7d4e7b1b579","lessThan":"ac7c08626f67844336086cf563f417566b76f0d7","versionType":"git","status":"affected"},{"version":"b453872c35cfcbdbf5a794737817f7d4e7b1b579","lessThan":"bb7ae8910cc886885aea95abb7c2e578a2341646","versionType":"git","status":"affected"},{"version":"b453872c35cfcbdbf5a794737817f7d4e7b1b579","lessThan":"06f42accaf3c6aecab1dcc57f68dde6c06c8b380","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/ipw2x00/libipw_crypto_tkip.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.14","status":"affected"},{"version":"0","lessThan":"2.6.14","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/06f42accaf3c6aecab1dcc57f68dde6c06c8b380","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9a7fb67364817710c96785ff86b71a2711ee92cb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ac7c08626f67844336086cf563f417566b76f0d7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bb7ae8910cc886885aea95abb7c2e578a2341646","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f448b267968d0ee985e5927c868c8f858169ab34","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98194","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:04.800","lastModified":"2026-10-19T10:18:19.813","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libertas_tf: fix UAF in lbtf_free_adapter()\n\nlbtf_free_adapter() calls lbtf_free_cmd_buffer() to free the command\nbuffers before calling timer_delete_sync() to wait for the command\ntimer callback.  If the timer callback (command_timer_fn) is already\nrunning when lbtf_free_cmd_buffer() frees the command array, the\ncallback dereferences priv->cur_cmd->cmdbuf which points to freed\nmemory.\n\nSwap the order so that timer_delete_sync() runs first, ensuring any\nin-flight callback has completed before the command buffers are freed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/marvell/libertas_tf/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"06b16ae5319251c26377afcb401e46056d5673f4","lessThan":"3fb3663260ec396f86b733aab9f81fac6669d2fa","versionType":"git","status":"affected"},{"version":"06b16ae5319251c26377afcb401e46056d5673f4","lessThan":"f6c3fa0d17ca0c9e6033bb45f52e33b27a9a40e6","versionType":"git","status":"affected"},{"version":"06b16ae5319251c26377afcb401e46056d5673f4","lessThan":"b4745d6063758c681d33affca9733bbd356b6ea1","versionType":"git","status":"affected"},{"version":"06b16ae5319251c26377afcb401e46056d5673f4","lessThan":"41b1a4d545ec348b7d5324b6d4f4c6a3e0326d46","versionType":"git","status":"affected"},{"version":"06b16ae5319251c26377afcb401e46056d5673f4","lessThan":"2b99bfc5a127ce8cd6a887d82815fc2e712f365b","versionType":"git","status":"affected"},{"version":"06b16ae5319251c26377afcb401e46056d5673f4","lessThan":"e82536aad653e27c8ca7a8e0f6f816bc3f853ec3","versionType":"git","status":"affected"},{"version":"06b16ae5319251c26377afcb401e46056d5673f4","lessThan":"04c837d413dc11a91e0275b08b9e35a6c111175e","versionType":"git","status":"affected"},{"version":"06b16ae5319251c26377afcb401e46056d5673f4","lessThan":"bbb9a0ab96d44a64529aafc7a16de460a1712f6a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/marvell/libertas_tf/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.28","status":"affected"},{"version":"0","lessThan":"2.6.28","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/04c837d413dc11a91e0275b08b9e35a6c111175e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2b99bfc5a127ce8cd6a887d82815fc2e712f365b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3fb3663260ec396f86b733aab9f81fac6669d2fa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/41b1a4d545ec348b7d5324b6d4f4c6a3e0326d46","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b4745d6063758c681d33affca9733bbd356b6ea1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bbb9a0ab96d44a64529aafc7a16de460a1712f6a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e82536aad653e27c8ca7a8e0f6f816bc3f853ec3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f6c3fa0d17ca0c9e6033bb45f52e33b27a9a40e6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98195","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:04.953","lastModified":"2026-10-19T10:18:19.923","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlegacy: fix broadcast stations deallocation\n\nOn the error path of __il4965_up(), il_dealloc_bcast_stations() clears\nonly IL_STA_UCODE_ACTIVE, leaving IL_STA_BCAST set. This causes the\nsame broadcast stations to be deallocated again by __il4965_down().\n\nThis can occur when RF_KILL is toggled during driver startup.\n\nTo fix clear the entire 'used' field, since we will not do any\nother operations on the station."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/iwlegacy/common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c2fd34469d1623111e3c3db65cde533f3bddc26e","lessThan":"275d474a4b4bd4e73b18b1452f12e78806a8843a","versionType":"git","status":"affected"},{"version":"c2fd34469d1623111e3c3db65cde533f3bddc26e","lessThan":"526fdd45548e22eee50ee1062abd88269d9f32e0","versionType":"git","status":"affected"},{"version":"c2fd34469d1623111e3c3db65cde533f3bddc26e","lessThan":"c9a116d691364cd7f59d8329b395adcaf826d5c6","versionType":"git","status":"affected"},{"version":"c2fd34469d1623111e3c3db65cde533f3bddc26e","lessThan":"85d847ff71fe736cbc15ada321256818e630e205","versionType":"git","status":"affected"},{"version":"c2fd34469d1623111e3c3db65cde533f3bddc26e","lessThan":"1d84c2a3de449aceb94ed79eaefecdf1bedb6468","versionType":"git","status":"affected"},{"version":"c2fd34469d1623111e3c3db65cde533f3bddc26e","lessThan":"55d34422c0d91436983028fd3c1546a1c2bee55f","versionType":"git","status":"affected"},{"version":"c2fd34469d1623111e3c3db65cde533f3bddc26e","lessThan":"a9176fe666af1730cab92350f9c8cf67ebf14439","versionType":"git","status":"affected"},{"version":"c2fd34469d1623111e3c3db65cde533f3bddc26e","lessThan":"b5526b780f8b297a76030410b96ba29153afb98f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/iwlegacy/common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.7","status":"affected"},{"version":"0","lessThan":"4.7","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1d84c2a3de449aceb94ed79eaefecdf1bedb6468","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/275d474a4b4bd4e73b18b1452f12e78806a8843a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/526fdd45548e22eee50ee1062abd88269d9f32e0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/55d34422c0d91436983028fd3c1546a1c2bee55f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/85d847ff71fe736cbc15ada321256818e630e205","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a9176fe666af1730cab92350f9c8cf67ebf14439","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b5526b780f8b297a76030410b96ba29153afb98f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c9a116d691364cd7f59d8329b395adcaf826d5c6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98196","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:05.113","lastModified":"2026-10-19T10:18:20.040","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmsmac: fix UAF in brcms_free_timer()\n\nbrcms_free_timer() calls brcms_del_timer() which uses the non-synchronous\ncancel_delayed_work() to cancel the timer's underlying delayed work.  If\nthe work callback (_brcms_timer) is already running, cancel_delayed_work()\nreturns false without waiting, and brcms_free_timer() proceeds to kfree(t)\nwhile the callback still accesses t through container_of().\n\nAdd an explicit cancel_delayed_work_sync() after brcms_del_timer() to\nguarantee that any in-flight callback has completed before the timer\nstructure is freed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5b435de0d786869c95d1962121af0d7df2542009","lessThan":"10eeb0b29fd7f52487c9ae573e8d79c210a0095d","versionType":"git","status":"affected"},{"version":"5b435de0d786869c95d1962121af0d7df2542009","lessThan":"74acccc928851f69184271832d690607877122af","versionType":"git","status":"affected"},{"version":"5b435de0d786869c95d1962121af0d7df2542009","lessThan":"050d2486e8ed2c0a23b87249ccd23e8072721391","versionType":"git","status":"affected"},{"version":"5b435de0d786869c95d1962121af0d7df2542009","lessThan":"856dabd5f2617efb23c043be9e1b22a9e6e97c41","versionType":"git","status":"affected"},{"version":"5b435de0d786869c95d1962121af0d7df2542009","lessThan":"2a4841ff0b74b495cddd31ae324e922217fc2f13","versionType":"git","status":"affected"},{"version":"5b435de0d786869c95d1962121af0d7df2542009","lessThan":"1edb3ddd261e973a4d577c0547e63bfa25a8170d","versionType":"git","status":"affected"},{"version":"5b435de0d786869c95d1962121af0d7df2542009","lessThan":"777cb6bba59e875b16a1d8897a483a5fecfcd5d2","versionType":"git","status":"affected"},{"version":"5b435de0d786869c95d1962121af0d7df2542009","lessThan":"1eeca1d5e0920fbdad6449768fd2d4364e714180","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.2","status":"affected"},{"version":"0","lessThan":"3.2","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/050d2486e8ed2c0a23b87249ccd23e8072721391","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/10eeb0b29fd7f52487c9ae573e8d79c210a0095d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1edb3ddd261e973a4d577c0547e63bfa25a8170d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1eeca1d5e0920fbdad6449768fd2d4364e714180","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2a4841ff0b74b495cddd31ae324e922217fc2f13","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/74acccc928851f69184271832d690607877122af","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/777cb6bba59e875b16a1d8897a483a5fecfcd5d2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/856dabd5f2617efb23c043be9e1b22a9e6e97c41","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98197","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:05.273","lastModified":"2026-10-19T10:18:20.170","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove\n\nWhen the fan/pwm 4-5 pins are not used as GPIO, w83791d_probe()\ncreates the w83791d_group_fanpwm45 sysfs group on the I2C client\ndevice.\n\nThe probe error path removes this group when a later initialization\nstep fails, but the normal remove path only removes w83791d_group.\nAs a result, the optional fan/pwm 4-5 sysfs files can remain after the\ndriver is unbound.\n\nThe callbacks associated with these files access the driver data,\nwhich is devm allocated and released after driver unbind. Leaving the\nsysfs files behind can therefore result in accesses to stale driver\ndata.\n\nRemove w83791d_group_fanpwm45 during normal teardown as well.\n\nThis issue was found by manual code inspection."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/hwmon/w83791d.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6e1ecd9b8f1358ed4d099f0c54434240dc40debe","lessThan":"081e3a78453635fb370b1712809d2af29e60b4c5","versionType":"git","status":"affected"},{"version":"6e1ecd9b8f1358ed4d099f0c54434240dc40debe","lessThan":"b1d419eb3bc41245c3d3d99dfe1a7b6c45989586","versionType":"git","status":"affected"},{"version":"6e1ecd9b8f1358ed4d099f0c54434240dc40debe","lessThan":"2ccf6c512290a288a2d4d7f076430dfb0c6ee476","versionType":"git","status":"affected"},{"version":"6e1ecd9b8f1358ed4d099f0c54434240dc40debe","lessThan":"f6e2ab72f32d16d71a2549c7ea062dd209f71670","versionType":"git","status":"affected"},{"version":"6e1ecd9b8f1358ed4d099f0c54434240dc40debe","lessThan":"2dd37d00f1f1af8e02ffa70ee573c10fd1a76864","versionType":"git","status":"affected"},{"version":"6e1ecd9b8f1358ed4d099f0c54434240dc40debe","lessThan":"2c381e6e0f033f2df13bd64905e7232c42f49009","versionType":"git","status":"affected"},{"version":"6e1ecd9b8f1358ed4d099f0c54434240dc40debe","lessThan":"583e04e88e75b8d57304015d83c38e82a9531600","versionType":"git","status":"affected"},{"version":"6e1ecd9b8f1358ed4d099f0c54434240dc40debe","lessThan":"0ff9c7775e51ac6d47b1bb5c46f06b1434fe58a8","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/hwmon/w83791d.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.28","status":"affected"},{"version":"0","lessThan":"2.6.28","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/081e3a78453635fb370b1712809d2af29e60b4c5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0ff9c7775e51ac6d47b1bb5c46f06b1434fe58a8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2c381e6e0f033f2df13bd64905e7232c42f49009","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2ccf6c512290a288a2d4d7f076430dfb0c6ee476","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2dd37d00f1f1af8e02ffa70ee573c10fd1a76864","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/583e04e88e75b8d57304015d83c38e82a9531600","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b1d419eb3bc41245c3d3d99dfe1a7b6c45989586","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f6e2ab72f32d16d71a2549c7ea062dd209f71670","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98198","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:05.440","lastModified":"2026-10-21T13:21:25.537","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (pwm-fan) Stop RPM timer before freeing tach data\n\nsample_timer() rearms the RPM timer and accesses the devm-managed\nctx->tachs and ctx->pulses_per_revolution arrays. The cleanup action\nwhich stops the timer is registered before those arrays are allocated.\n\nSince devres releases entries in reverse order, driver detach can free\nthe arrays before pwm_fan_cleanup() shuts down the timer. A timer expiry\nin that window accesses the freed tach data.\n\nWith a KASAN kernel, a test-only kprobe delayed entry to\npwm_fan_cleanup() while normal sysfs unbind ran. Each of three runs\nreported three four-byte reads and two four-byte writes in sample_timer()\nafter its backing devm allocations had been freed. The helper did not\ninvoke the timer callback, cleanup actions or free functions.\n\nWith the fix, three matching unbind runs completed without KASAN, BUG,\nWARNING, Oops or panic. Instrumentation confirmed that timer retirement\ncompleted before the first timer backing allocation was released.\n\nSplit timer retirement from the power cleanup and register its devres\naction after the timer backing data and IRQ actions are installed. This\npreserves the early power rollback action while ensuring the timer is\nretired before its backing data is released. Use timer_shutdown_sync()\nbecause the callback can rearm itself."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/hwmon/pwm-fan.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"01695410d4529e38fea6159fa9f1260c598290b0","lessThan":"d073d306e587c1f35aaf9c07c42e54a3d5895d8f","versionType":"git","status":"affected"},{"version":"01695410d4529e38fea6159fa9f1260c598290b0","lessThan":"1e824fdb14a187ce56697e803b02b1e86243a755","versionType":"git","status":"affected"},{"version":"01695410d4529e38fea6159fa9f1260c598290b0","lessThan":"a5ce3fe5335a24d0220958c6866830a6d5fa1cc0","versionType":"git","status":"affected"},{"version":"01695410d4529e38fea6159fa9f1260c598290b0","lessThan":"b48339b0a577783e4590a69e4cd2f2760ce33154","versionType":"git","status":"affected"},{"version":"01695410d4529e38fea6159fa9f1260c598290b0","lessThan":"26d5ff79768548efb1e604bb6e8697c101e06269","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/hwmon/pwm-fan.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.12","status":"affected"},{"version":"0","lessThan":"5.12","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1e824fdb14a187ce56697e803b02b1e86243a755","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/26d5ff79768548efb1e604bb6e8697c101e06269","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a5ce3fe5335a24d0220958c6866830a6d5fa1cc0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b48339b0a577783e4590a69e4cd2f2760ce33154","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d073d306e587c1f35aaf9c07c42e54a3d5895d8f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98199","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:05.597","lastModified":"2026-10-19T10:18:20.450","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (pmbus/core) increase number of phases and add new mask\n\nIncrease the number of phases to 16 as a new upcoming device supports\nsuch a number.\n\nWhile at it, add a new mask for controlling the source of the output\nvoltage.\n\nNote (groeck):\n\nThis patch was meant to prepare for support of MAX20826 and compatible\ndevices, which support more than 10 phases per page. However, Sashiko\nreports that the mp2975 driver already supports up to 14 phases, and the\nmp2856 driver supports up to 12 phases. This already has the potential for\nout-of-bounds writes when probing the affected chips, making this patch a\nbug fix."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/hwmon/pmbus/pmbus.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2c6fcbb211494f1ff6ef384776944b9e04f4c14c","lessThan":"272006a52cbd9c8342cead4d3eb9221ebbe8b985","versionType":"git","status":"affected"},{"version":"2c6fcbb211494f1ff6ef384776944b9e04f4c14c","lessThan":"b32607710a20ad983f9fe4a3051892584c0641a4","versionType":"git","status":"affected"},{"version":"2c6fcbb211494f1ff6ef384776944b9e04f4c14c","lessThan":"66368f682a53f3a3842e20eebb571a59809c52c0","versionType":"git","status":"affected"},{"version":"2c6fcbb211494f1ff6ef384776944b9e04f4c14c","lessThan":"1ec644c94466834f8cb6b7ba12636fd047bdfdda","versionType":"git","status":"affected"},{"version":"2c6fcbb211494f1ff6ef384776944b9e04f4c14c","lessThan":"9558fc1e042ac6b12dd63c37d2c51be4ec86d402","versionType":"git","status":"affected"},{"version":"2c6fcbb211494f1ff6ef384776944b9e04f4c14c","lessThan":"b49f100a15b8876deccf8c59f41af92b8e25fd74","versionType":"git","status":"affected"},{"version":"2c6fcbb211494f1ff6ef384776944b9e04f4c14c","lessThan":"06bd6794b5fd2163880ac3bfe973d4cc61f359f3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/hwmon/pmbus/pmbus.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.10","status":"affected"},{"version":"0","lessThan":"5.10","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/06bd6794b5fd2163880ac3bfe973d4cc61f359f3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1ec644c94466834f8cb6b7ba12636fd047bdfdda","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/272006a52cbd9c8342cead4d3eb9221ebbe8b985","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/66368f682a53f3a3842e20eebb571a59809c52c0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9558fc1e042ac6b12dd63c37d2c51be4ec86d402","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b32607710a20ad983f9fe4a3051892584c0641a4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b49f100a15b8876deccf8c59f41af92b8e25fd74","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98200","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:05.747","lastModified":"2026-10-19T10:18:20.623","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()\n\nnsensor->current_state is dynamically replaced as the sensor's state\nchanges. update_numeric_sensor_from_wobj() does this by freeing the\nold string and installing a new one:\n\n\tif (strcmp(trimmed, nsensor->current_state)) {\n\t\tnew_string = hp_wmi_strdup(dev, trimmed);\n\t\tif (new_string) {\n\t\t\tdevm_kfree(dev, nsensor->current_state);\n\t\t\tnsensor->current_state = new_string;\n\t\t}\n\t}\n\nThis function is only ever called from hp_wmi_update_info() while\nstate->lock is held, so the free-and-replace itself is properly\nserialized against concurrent updates.\n\nfungible_show(), however, reads the same pointer after the lock has\nalready been dropped:\n\n\terr = hp_wmi_update_info(state, info);\n\tif (err)\n\t\treturn err;\n\n\tswitch (prop) {\n\t...\n\tcase HP_WMI_PROPERTY_CURRENT_STATE:\n\t\tseq_printf(seqf, \"%s\\n\", nsensor->current_state);\n\t\tbreak;\n\nhp_wmi_update_info() takes state->lock internally and releases it\nbefore returning, so by the time fungible_show() dereferences\nnsensor->current_state in seq_printf(), no lock is held. Two\nprocesses reading a sensor's current_state debugfs entry at\noverlapping times (or one reading it while another read of the same\nsensor triggers a refresh) can race: one thread's seq_printf() can\nbe part-way through printing the string at the moment another\nthread's call into update_numeric_sensor_from_wobj() frees it with\ndevm_kfree() and installs a new pointer, causing a use-after-free\nread.\n\nTake state->lock around the read in fungible_show() as well, so it\ncan never run concurrently with the free-and-replace in\nupdate_numeric_sensor_from_wobj()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/hwmon/hp-wmi-sensors.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"23902f98f8d4811ab84dde6419569a5b374f8122","lessThan":"b6b2a638aa36c441b2c8d0b6bd8ed2bb9701e795","versionType":"git","status":"affected"},{"version":"23902f98f8d4811ab84dde6419569a5b374f8122","lessThan":"f59ecfd2c58bace39538f3fff7f43788b3fdb539","versionType":"git","status":"affected"},{"version":"23902f98f8d4811ab84dde6419569a5b374f8122","lessThan":"72c85149794a1ccf8d718ffed1521106b5d31968","versionType":"git","status":"affected"},{"version":"23902f98f8d4811ab84dde6419569a5b374f8122","lessThan":"9c1e65bc79ff104914b11e6ad972139296ec86fe","versionType":"git","status":"affected"},{"version":"23902f98f8d4811ab84dde6419569a5b374f8122","lessThan":"e6cb0b4d4ecb8e71fd2200d907ab2e9663356f69","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/hwmon/hp-wmi-sensors.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.5","status":"affected"},{"version":"0","lessThan":"6.5","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/72c85149794a1ccf8d718ffed1521106b5d31968","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9c1e65bc79ff104914b11e6ad972139296ec86fe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b6b2a638aa36c441b2c8d0b6bd8ed2bb9701e795","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e6cb0b4d4ecb8e71fd2200d907ab2e9663356f69","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f59ecfd2c58bace39538f3fff7f43788b3fdb539","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98201","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:05.900","lastModified":"2026-10-19T10:18:20.737","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nInput: zero ff_effect before compat copy in input_ff_effect_from_user\n\nIn the compat path input_ff_effect_from_user() aliases the caller's\nnative struct ff_effect with the smaller struct ff_effect_compat and\ncopies only the compat sized prefix:\n\n\tcompat_effect = (struct ff_effect_compat *)effect;\n\n\tif (copy_from_user(compat_effect, buffer,\n\t\t\t   sizeof(struct ff_effect_compat)))\n\nThe tail of the native structure is never written. Callers pass an\nuninitialized on-stack object, for example evdev_do_ioctl() for\nEVIOCSFF, so those bytes keep their previous stack contents.\ninput_ff_upload() then stores the full native structure in\nff->effects[id], from where a uinput based force feedback daemon can\nread it back via UI_BEGIN_FF_UPLOAD, disclosing kernel stack memory to\nuserspace.\n\nZero the effect before the compat copy."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/input/input-compat.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2d56f3a32c0e62f99c043d2579840f9731fe5855","lessThan":"ed0905fda39682d3da7937184397d3276abbffa8","versionType":"git","status":"affected"},{"version":"2d56f3a32c0e62f99c043d2579840f9731fe5855","lessThan":"ec174c2ab1abb76b20fa167c6db848c3d97aa838","versionType":"git","status":"affected"},{"version":"2d56f3a32c0e62f99c043d2579840f9731fe5855","lessThan":"6c26681c5668c973bd0e951407d670ac60d9cd66","versionType":"git","status":"affected"},{"version":"2d56f3a32c0e62f99c043d2579840f9731fe5855","lessThan":"c5e573bb095d502be7cbbaa99c26a20984111c6d","versionType":"git","status":"affected"},{"version":"2d56f3a32c0e62f99c043d2579840f9731fe5855","lessThan":"b878720e8bcaa4cf7163a5081f904dd6baf11b2c","versionType":"git","status":"affected"},{"version":"2d56f3a32c0e62f99c043d2579840f9731fe5855","lessThan":"0d05b43b55d4784a42ce8fb318175f8ad7d9af5a","versionType":"git","status":"affected"},{"version":"2d56f3a32c0e62f99c043d2579840f9731fe5855","lessThan":"ed0406e490f48ed180df140fe2a81be26bccb1a9","versionType":"git","status":"affected"},{"version":"2d56f3a32c0e62f99c043d2579840f9731fe5855","lessThan":"f84819ef8d66931ee3998fee3c4f03230f4cb6cc","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/input/input-compat.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.29","status":"affected"},{"version":"0","lessThan":"2.6.29","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0d05b43b55d4784a42ce8fb318175f8ad7d9af5a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6c26681c5668c973bd0e951407d670ac60d9cd66","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b878720e8bcaa4cf7163a5081f904dd6baf11b2c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c5e573bb095d502be7cbbaa99c26a20984111c6d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ec174c2ab1abb76b20fa167c6db848c3d97aa838","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ed0406e490f48ed180df140fe2a81be26bccb1a9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ed0905fda39682d3da7937184397d3276abbffa8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f84819ef8d66931ee3998fee3c4f03230f4cb6cc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98202","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:06.067","lastModified":"2026-10-19T10:18:20.847","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - fix GPF in suspend and resume when unbound\n\nTransport drivers (such as rmi_i2c and rmi_spi) invoke\nrmi_driver_suspend() and rmi_driver_resume() on their child rmi_dev\ndevice during system power management events. However, transport drivers\nare fully registered and operational even if the physical RMI driver\nfailed to bind or probe the rmi_dev device.\n\nWhen rmi_driver_suspend() or rmi_driver_resume() is called on an unbound\nrmi_dev, dev_get_drvdata() returns NULL. Calling rmi_disable_irq() or\nrmi_enable_irq() without driver data attached causes a NULL pointer\ndereference and General Protection Fault when attempting to lock\ndata->enabled_mutex.\n\nFix this by checking if driver data is attached to rmi_dev in\nrmi_driver_suspend() and rmi_driver_resume(), exiting early if\nno driver data is present."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/input/rmi4/rmi_driver.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2b6a321da9a2d8725a1d3dbb0b2e96a7618ebe56","lessThan":"7a3d7c68aa36f68e2a4824da4782c0e5d7c4eba4","versionType":"git","status":"affected"},{"version":"2b6a321da9a2d8725a1d3dbb0b2e96a7618ebe56","lessThan":"fafca210631d8c2d4311bdfccc5ec46b9fe65977","versionType":"git","status":"affected"},{"version":"2b6a321da9a2d8725a1d3dbb0b2e96a7618ebe56","lessThan":"84145a4a1dc58f8959811913c5f61f3235dd9f6c","versionType":"git","status":"affected"},{"version":"2b6a321da9a2d8725a1d3dbb0b2e96a7618ebe56","lessThan":"e2b6703465c1ce43edb91c1626604b7092b3c431","versionType":"git","status":"affected"},{"version":"2b6a321da9a2d8725a1d3dbb0b2e96a7618ebe56","lessThan":"30366f507ce3e408caf7f7375bb343df54b9a4f9","versionType":"git","status":"affected"},{"version":"2b6a321da9a2d8725a1d3dbb0b2e96a7618ebe56","lessThan":"fa1713dc3d43d028d6cb66e5659d9d7e83b73362","versionType":"git","status":"affected"},{"version":"2b6a321da9a2d8725a1d3dbb0b2e96a7618ebe56","lessThan":"942b06a19252908d0f952c0590caf20e47f88252","versionType":"git","status":"affected"},{"version":"2b6a321da9a2d8725a1d3dbb0b2e96a7618ebe56","lessThan":"fe10579b6dc3f0dac61e51e1797cacbba5039ac2","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/input/rmi4/rmi_driver.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.6","status":"affected"},{"version":"0","lessThan":"4.6","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/30366f507ce3e408caf7f7375bb343df54b9a4f9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7a3d7c68aa36f68e2a4824da4782c0e5d7c4eba4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/84145a4a1dc58f8959811913c5f61f3235dd9f6c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/942b06a19252908d0f952c0590caf20e47f88252","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e2b6703465c1ce43edb91c1626604b7092b3c431","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fa1713dc3d43d028d6cb66e5659d9d7e83b73362","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fafca210631d8c2d4311bdfccc5ec46b9fe65977","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fe10579b6dc3f0dac61e51e1797cacbba5039ac2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98203","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:06.230","lastModified":"2026-10-19T10:18:20.960","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nInput: soc_button_array - check btns_desc->package.count\n\nCheck that btns_desc->package.count is not 0 before accessing\nbtns_desc->package.elements[0]."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/input/misc/soc_button_array.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4c3362f44980aba8e1e69cd6970effbd9f17dc69","lessThan":"c3a94bfedfa2e4c4d37d1181e8db1ab010f1321a","versionType":"git","status":"affected"},{"version":"4c3362f44980aba8e1e69cd6970effbd9f17dc69","lessThan":"ec0576dabd6bf4f6532c5f0a58c9bf57095e45a4","versionType":"git","status":"affected"},{"version":"4c3362f44980aba8e1e69cd6970effbd9f17dc69","lessThan":"c62c6944c680bc4ae188ca9045daada32fcd10ec","versionType":"git","status":"affected"},{"version":"4c3362f44980aba8e1e69cd6970effbd9f17dc69","lessThan":"42c7afc0e5f5b5e12e9689e9a9815b5824cf0efb","versionType":"git","status":"affected"},{"version":"4c3362f44980aba8e1e69cd6970effbd9f17dc69","lessThan":"eb5563386fb8c5dbb55d902a71a0ce10e4f307eb","versionType":"git","status":"affected"},{"version":"4c3362f44980aba8e1e69cd6970effbd9f17dc69","lessThan":"8a70a192e3e5b3ccbeeaf149c931cf45b8e82155","versionType":"git","status":"affected"},{"version":"4c3362f44980aba8e1e69cd6970effbd9f17dc69","lessThan":"12d80e6351556cfecbdd09416e5e4c73d6ca08ba","versionType":"git","status":"affected"},{"version":"4c3362f44980aba8e1e69cd6970effbd9f17dc69","lessThan":"fb5022278b6ea7f1838e3ef78028d5d5e3375f65","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/input/misc/soc_button_array.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.12","status":"affected"},{"version":"0","lessThan":"4.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/12d80e6351556cfecbdd09416e5e4c73d6ca08ba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/42c7afc0e5f5b5e12e9689e9a9815b5824cf0efb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8a70a192e3e5b3ccbeeaf149c931cf45b8e82155","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c3a94bfedfa2e4c4d37d1181e8db1ab010f1321a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c62c6944c680bc4ae188ca9045daada32fcd10ec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eb5563386fb8c5dbb55d902a71a0ce10e4f307eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ec0576dabd6bf4f6532c5f0a58c9bf57095e45a4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fb5022278b6ea7f1838e3ef78028d5d5e3375f65","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98204","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:06.383","lastModified":"2026-10-19T10:18:21.060","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nInput: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()\n\nWhen chunking writes into SMBus blocks in rmi_smb_write_block(), the\nloop calculates block_len using the original total length (len) instead\nof the remaining length (cur_len).\n\nIf len is greater than 32 bytes (SMB_MAX_COUNT), block_len remains 32\nfor every iteration, even on the final partial chunk where fewer than 32\nbytes remain. This causes smb_block_write() to read 32 bytes from the\nadvanced data buffer pointer, reading past the end of the input buffer.\n\nFix this by calculating block_len using cur_len and advancing the buffer\nand address pointers by block_len."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/input/rmi4/rmi_smbus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"82264d0cf7aef2247563c031ff2ab96579d5d0cc","lessThan":"d01337c0892d1509500c727edf81380777c2dd0f","versionType":"git","status":"affected"},{"version":"82264d0cf7aef2247563c031ff2ab96579d5d0cc","lessThan":"7c800af1c6030a5f27d46ce7d6d5d75f9c1efaf8","versionType":"git","status":"affected"},{"version":"82264d0cf7aef2247563c031ff2ab96579d5d0cc","lessThan":"29fbcf5834f0a7f74bfd017c07da2411b35a4e2a","versionType":"git","status":"affected"},{"version":"82264d0cf7aef2247563c031ff2ab96579d5d0cc","lessThan":"50dd585bee7669eb165e5defcc35d17f3822cfbb","versionType":"git","status":"affected"},{"version":"82264d0cf7aef2247563c031ff2ab96579d5d0cc","lessThan":"e022538e13dd1c82af5ec25ac28f12ca0ab26160","versionType":"git","status":"affected"},{"version":"82264d0cf7aef2247563c031ff2ab96579d5d0cc","lessThan":"dc05ec97b8299e48e31367a9bc412c7e9c0e2b42","versionType":"git","status":"affected"},{"version":"82264d0cf7aef2247563c031ff2ab96579d5d0cc","lessThan":"9f0ce5e162eed8b68345abe839c59768bc60f99a","versionType":"git","status":"affected"},{"version":"82264d0cf7aef2247563c031ff2ab96579d5d0cc","lessThan":"51cfe54f815ae175c7d1126b983d4d7c89715004","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/input/rmi4/rmi_smbus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.10","status":"affected"},{"version":"0","lessThan":"4.10","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/29fbcf5834f0a7f74bfd017c07da2411b35a4e2a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/50dd585bee7669eb165e5defcc35d17f3822cfbb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/51cfe54f815ae175c7d1126b983d4d7c89715004","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7c800af1c6030a5f27d46ce7d6d5d75f9c1efaf8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9f0ce5e162eed8b68345abe839c59768bc60f99a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d01337c0892d1509500c727edf81380777c2dd0f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dc05ec97b8299e48e31367a9bc412c7e9c0e2b42","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e022538e13dd1c82af5ec25ac28f12ca0ab26160","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98205","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:06.547","lastModified":"2026-10-19T10:18:21.170","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nInput: evdev - zero absinfo before partial copy in EVIOCSABS\n\nThe EVIOCSABS handler copies at most the user supplied ioctl size into\nan uninitialized on-stack struct input_absinfo:\n\n\tif (copy_from_user(&abs, p, min_t(size_t,\n\t\t\tsize, sizeof(struct input_absinfo))))\n\nThe size comes from _IOC_SIZE() of the ioctl command and is therefore\nfully controlled by userspace. A short size leaves the trailing part of\nthe structure holding whatever was on the kernel stack, and the whole\nstructure is then stored into the device:\n\n\tdev->absinfo[t] = abs;\n\nEVIOCGABS hands that back to userspace, disclosing the stale stack\nbytes. Only the resolution field is currently cleared, which covers the\nlegacy struct layout but not an arbitrarily short size.\n\nZero the structure before the copy so any part not supplied by the\ncaller reads back as zero. The existing resolution fixup is kept, since\nit also handles a size that partially overlaps that field."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/input/evdev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"448cd1664a573e69f54bfd32f3bb7220212b6cf5","lessThan":"c0aebb57b73c7d06ad21731099afe119b113c403","versionType":"git","status":"affected"},{"version":"448cd1664a573e69f54bfd32f3bb7220212b6cf5","lessThan":"89b6ffa4bc10c436fa9aecc73be105124cd58a35","versionType":"git","status":"affected"},{"version":"448cd1664a573e69f54bfd32f3bb7220212b6cf5","lessThan":"e834e134a32b6a5c600fa539bb49146f617743ab","versionType":"git","status":"affected"},{"version":"448cd1664a573e69f54bfd32f3bb7220212b6cf5","lessThan":"af5f7130cbf39e6e12336d0b7a5f6e76e4e1526b","versionType":"git","status":"affected"},{"version":"448cd1664a573e69f54bfd32f3bb7220212b6cf5","lessThan":"30b853a3d71f16bd0aa66b604bc37dd1254a19b3","versionType":"git","status":"affected"},{"version":"448cd1664a573e69f54bfd32f3bb7220212b6cf5","lessThan":"71e5619db11dd6429101bd967230d0321ec5ea26","versionType":"git","status":"affected"},{"version":"448cd1664a573e69f54bfd32f3bb7220212b6cf5","lessThan":"3dfe48d5307a1ba22c58231d04257737015569ca","versionType":"git","status":"affected"},{"version":"448cd1664a573e69f54bfd32f3bb7220212b6cf5","lessThan":"8b852965b8eaf910c314dc346967ed82c8d4f235","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/input/evdev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.36","status":"affected"},{"version":"0","lessThan":"2.6.36","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/30b853a3d71f16bd0aa66b604bc37dd1254a19b3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3dfe48d5307a1ba22c58231d04257737015569ca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/71e5619db11dd6429101bd967230d0321ec5ea26","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/89b6ffa4bc10c436fa9aecc73be105124cd58a35","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8b852965b8eaf910c314dc346967ed82c8d4f235","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/af5f7130cbf39e6e12336d0b7a5f6e76e4e1526b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c0aebb57b73c7d06ad21731099afe119b113c403","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e834e134a32b6a5c600fa539bb49146f617743ab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98206","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:06.710","lastModified":"2026-10-19T10:18:21.280","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nInput: cyttsp5 - clamp the HID report size before memcpy\n\nThe size field comes from the device and is used as the memcpy()\nlength into response_buf, which is CY_MAX_INPUT bytes."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/input/touchscreen/cyttsp5.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5b0c03e24a061f9c9e8b28fa157b80990c559a37","lessThan":"b172c69e67bc71f71f6e3d8b3258b3dec29e42c6","versionType":"git","status":"affected"},{"version":"5b0c03e24a061f9c9e8b28fa157b80990c559a37","lessThan":"d41a80d852f2948c6d388c520e76c0a72897f003","versionType":"git","status":"affected"},{"version":"5b0c03e24a061f9c9e8b28fa157b80990c559a37","lessThan":"9eb261092d4c967679fa351b7190c6d9082b07c5","versionType":"git","status":"affected"},{"version":"5b0c03e24a061f9c9e8b28fa157b80990c559a37","lessThan":"495955feb57750de4a641da13d7e51fb4d0a9764","versionType":"git","status":"affected"},{"version":"5b0c03e24a061f9c9e8b28fa157b80990c559a37","lessThan":"85f080fb87ed5cd3e46121be677f52c82f26a0ab","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/input/touchscreen/cyttsp5.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.2","status":"affected"},{"version":"0","lessThan":"6.2","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/495955feb57750de4a641da13d7e51fb4d0a9764","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/85f080fb87ed5cd3e46121be677f52c82f26a0ab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9eb261092d4c967679fa351b7190c6d9082b07c5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b172c69e67bc71f71f6e3d8b3258b3dec29e42c6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d41a80d852f2948c6d388c520e76c0a72897f003","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98207","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:06.843","lastModified":"2026-10-19T10:18:21.373","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: spi: reset bytes_xfered before retrying CRC failures\n\nmmc_spi_data_do() updates data->bytes_xfered after each block has been\ntransferred successfully.  If a later block in the same data request\nfails with a CRC error, data->bytes_xfered may therefore contain the\nnumber of bytes completed before the failing block.\n\nmmc_spi_request() has a private recovery path for such CRC failures.  It\nsends STOP_TRANSMISSION, clears data->error and jumps back to\ncrc_recover to issue the same command and data request again.  However,\nit does not clear data->bytes_xfered before the retry.\n\nIf the retry succeeds, the request is completed with the bytes from the\nfailed attempt still included in data->bytes_xfered.  For a multi-block\nrequest this can make the completed request report more bytes than were\ntransferred by the successful retry, and can even exceed the request size\nwhen most blocks completed before the CRC error.\n\nThis is most likely to be observed on MMC-over-SPI systems where long\nmulti-block transfers occasionally hit a data CRC error but the\nmmc_spi-internal retry succeeds.  The data itself is retried, but the\ncompletion accounting is not.\n\nClear data->bytes_xfered together with data->error before repeating the\nrequest so the final completion reports only the bytes transferred by the\nsuccessful attempt."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/mmc/host/mmc_spi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"061c6c847eeb11743e489a16e907b41c6f9042b6","lessThan":"7d2f0ec16b300645f20435a6c3827b15e01419af","versionType":"git","status":"affected"},{"version":"061c6c847eeb11743e489a16e907b41c6f9042b6","lessThan":"d1acf4b9f6e9697406ce84ee9acfb92e094d5c7a","versionType":"git","status":"affected"},{"version":"061c6c847eeb11743e489a16e907b41c6f9042b6","lessThan":"0b8c8504593409954ed1a60db4e437d814e04023","versionType":"git","status":"affected"},{"version":"061c6c847eeb11743e489a16e907b41c6f9042b6","lessThan":"da4929ee78ee701c3717543840798fedff66c430","versionType":"git","status":"affected"},{"version":"061c6c847eeb11743e489a16e907b41c6f9042b6","lessThan":"57f5e29db63f7c80f1805d89234a74dcdbf60231","versionType":"git","status":"affected"},{"version":"061c6c847eeb11743e489a16e907b41c6f9042b6","lessThan":"4885e587f1afa9e1a573ab66f8c4d94d7b836d86","versionType":"git","status":"affected"},{"version":"061c6c847eeb11743e489a16e907b41c6f9042b6","lessThan":"3ae80c1fb7de4d3331427a955a44807745ac5a33","versionType":"git","status":"affected"},{"version":"061c6c847eeb11743e489a16e907b41c6f9042b6","lessThan":"8b0cc8707f65e0f51912e764e1b309b2559db1ec","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/mmc/host/mmc_spi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.37","status":"affected"},{"version":"0","lessThan":"2.6.37","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0b8c8504593409954ed1a60db4e437d814e04023","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3ae80c1fb7de4d3331427a955a44807745ac5a33","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4885e587f1afa9e1a573ab66f8c4d94d7b836d86","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/57f5e29db63f7c80f1805d89234a74dcdbf60231","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7d2f0ec16b300645f20435a6c3827b15e01419af","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8b0cc8707f65e0f51912e764e1b309b2559db1ec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d1acf4b9f6e9697406ce84ee9acfb92e094d5c7a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/da4929ee78ee701c3717543840798fedff66c430","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98208","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:07.017","lastModified":"2026-10-19T10:18:21.490","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: sdio_uart: fix xmit_fifo leak when the port table is full\n\nsdio_uart_add_port() allocates the transmit fifo before claiming a\nslot in sdio_uart_table[].  When all UART_NR slots are taken, it\nreturns -EBUSY with the fifo still allocated, but the probe error\npath only kfree()s the port, leaking the transmit fifo.\n\nFree the fifo in the failure path of sdio_uart_add_port() itself so\nthe function retains nothing on error."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/mmc/core/sdio_uart.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8b197a5ce7a7218bb9fc721647ba0d5734f27348","lessThan":"9e992d59138fcfaa4bad7cc0750265b0a8bca100","versionType":"git","status":"affected"},{"version":"8b197a5ce7a7218bb9fc721647ba0d5734f27348","lessThan":"b97b5b66c93cb4aaf6358727a73fff880a774dfd","versionType":"git","status":"affected"},{"version":"8b197a5ce7a7218bb9fc721647ba0d5734f27348","lessThan":"8a2c1bf209ba04cbd14153a771724bd5aa522fcd","versionType":"git","status":"affected"},{"version":"8b197a5ce7a7218bb9fc721647ba0d5734f27348","lessThan":"72f4c2b7a48423c708f2c348585419a1b71ab04c","versionType":"git","status":"affected"},{"version":"8b197a5ce7a7218bb9fc721647ba0d5734f27348","lessThan":"fd8223c53ad9553b2a349d2a40e19bbc6e60fc48","versionType":"git","status":"affected"},{"version":"8b197a5ce7a7218bb9fc721647ba0d5734f27348","lessThan":"ac866db277a4c73e84b4263773652e3aba326249","versionType":"git","status":"affected"},{"version":"8b197a5ce7a7218bb9fc721647ba0d5734f27348","lessThan":"5e142adbbdc54afbd01fad476c91cded41d22594","versionType":"git","status":"affected"},{"version":"8b197a5ce7a7218bb9fc721647ba0d5734f27348","lessThan":"53823e25793a97d07e6e98e0904bbf74cac8bc76","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/mmc/core/sdio_uart.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.34","status":"affected"},{"version":"0","lessThan":"2.6.34","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/53823e25793a97d07e6e98e0904bbf74cac8bc76","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5e142adbbdc54afbd01fad476c91cded41d22594","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/72f4c2b7a48423c708f2c348585419a1b71ab04c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8a2c1bf209ba04cbd14153a771724bd5aa522fcd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9e992d59138fcfaa4bad7cc0750265b0a8bca100","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ac866db277a4c73e84b4263773652e3aba326249","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b97b5b66c93cb4aaf6358727a73fff880a774dfd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fd8223c53ad9553b2a349d2a40e19bbc6e60fc48","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98209","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:07.173","lastModified":"2026-10-19T10:18:21.600","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: sdhci-of-aspeed: Remove children before releasing SDC resources\n\nProbe failure and removal leave SDHCI child devices registered after the\nparent clock and managed resources are released.\n\nUnregister the OF children in reverse order before disabling the parent\nclock on both paths. Use of_platform_device_destroy() because manual\nchild creation does not set the flag required by of_platform_depopulate().\n\nThis issue was identified during our ongoing static-analysis research\nwhile reviewing kernel code."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/mmc/host/sdhci-of-aspeed.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c","lessThan":"6b22b4d29e4fc1d2de2e4d7174925d68220165fb","versionType":"git","status":"affected"},{"version":"bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c","lessThan":"67e8117df8547433989a6ac1545a68848d0a289f","versionType":"git","status":"affected"},{"version":"bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c","lessThan":"bc5e79a5a5651588f3a93bef7815e4e86f78962c","versionType":"git","status":"affected"},{"version":"bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c","lessThan":"b84d29f2541c8adb768e468388dbaa4bc25ef157","versionType":"git","status":"affected"},{"version":"bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c","lessThan":"7eb896617a6db846b18596c10ca9f8900a73013e","versionType":"git","status":"affected"},{"version":"bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c","lessThan":"15b5ffd8af2dd46856da57467eb6e0f90d8ada51","versionType":"git","status":"affected"},{"version":"bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c","lessThan":"356b4b3b28a8ecd2a6c66d3b9666686315337df1","versionType":"git","status":"affected"},{"version":"bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c","lessThan":"4396d70bb7fec531bcf934fed016b2f3300c670b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/mmc/host/sdhci-of-aspeed.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.4","status":"affected"},{"version":"0","lessThan":"5.4","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/15b5ffd8af2dd46856da57467eb6e0f90d8ada51","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/356b4b3b28a8ecd2a6c66d3b9666686315337df1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4396d70bb7fec531bcf934fed016b2f3300c670b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/67e8117df8547433989a6ac1545a68848d0a289f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b22b4d29e4fc1d2de2e4d7174925d68220165fb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7eb896617a6db846b18596c10ca9f8900a73013e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b84d29f2541c8adb768e468388dbaa4bc25ef157","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bc5e79a5a5651588f3a93bef7815e4e86f78962c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98210","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:07.333","lastModified":"2026-10-19T10:18:21.713","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: mxcmmc: cancel data work and watchdog on remove\n\nmxcmci_remove() frees the host through the devm tail, but neither it nor\nmmc_remove_host() drains the driver's own asynchronous state.\nhost->watchdog, a 10 s timer armed on the DMA path in mxcmci_setup_data(),\nis deleted only by the DMA- and IRQ-complete paths, which the remove path\ndoes not explicitly drain; it can therefore fire after the host is freed\nand dereference it in mxcmci_watchdog().  host->datawork, armed from the\nIRQ handler on the PIO path, is not cancelled by the remove path either.\n\nFree the devm-registered IRQ, then cancel datawork and delete the watchdog\nin mxcmci_remove(), before dma_release_channel().  Freeing the IRQ first\nkeeps a trailing handler from re-arming datawork between the cancel and\nthe host free.  Both callbacks are non-self-rearming.\n\nThis issue was found by an in-house static analysis tool."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/mmc/host/mxcmmc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f6ad0a481342223b2e7ae9f55b154e14f1391ada","lessThan":"740f595f8ad678cb4d79f13edd12851df2492bdd","versionType":"git","status":"affected"},{"version":"f6ad0a481342223b2e7ae9f55b154e14f1391ada","lessThan":"d3641afe6ee76d852834a34ef0669eefced32752","versionType":"git","status":"affected"},{"version":"f6ad0a481342223b2e7ae9f55b154e14f1391ada","lessThan":"314966b490323bdcfd3162a1398b00e587e0ced4","versionType":"git","status":"affected"},{"version":"f6ad0a481342223b2e7ae9f55b154e14f1391ada","lessThan":"ae10838a7cdf0e54caa9d0a4f488704fd04e7f01","versionType":"git","status":"affected"},{"version":"f6ad0a481342223b2e7ae9f55b154e14f1391ada","lessThan":"a1ff367e0dc961d73707add508a95df5c3509bd1","versionType":"git","status":"affected"},{"version":"f6ad0a481342223b2e7ae9f55b154e14f1391ada","lessThan":"23383e0578b58ba2dc0730cf9f7806bd66bf859a","versionType":"git","status":"affected"},{"version":"f6ad0a481342223b2e7ae9f55b154e14f1391ada","lessThan":"e2948c4232209e87c861a680f20f1e3cf8a57fec","versionType":"git","status":"affected"},{"version":"f6ad0a481342223b2e7ae9f55b154e14f1391ada","lessThan":"d3a421c82412344022982d5b91ba23194a0a6f29","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/mmc/host/mxcmmc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.7","status":"affected"},{"version":"0","lessThan":"3.7","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/23383e0578b58ba2dc0730cf9f7806bd66bf859a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/314966b490323bdcfd3162a1398b00e587e0ced4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/740f595f8ad678cb4d79f13edd12851df2492bdd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a1ff367e0dc961d73707add508a95df5c3509bd1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ae10838a7cdf0e54caa9d0a4f488704fd04e7f01","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d3641afe6ee76d852834a34ef0669eefced32752","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d3a421c82412344022982d5b91ba23194a0a6f29","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e2948c4232209e87c861a680f20f1e3cf8a57fec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98211","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:07.497","lastModified":"2026-10-19T10:18:21.827","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: mmci: Fix use-after-free in busy-timeout work\n\nux500_busy_complete() can queue ux500_busy_timeout_work for an R1b\ncommand, but mmci_remove() never cancels it. The work can subsequently\ndereference the devm-allocated mmci_host after it has been released.\n\nMask the controller interrupts and disable the delayed work during\nremoval. This drains any queued instance and stops an IRQ handler that\nis still in progress from queueing the work again once it has been\ndisabled.\n\nThis issue was found by an in-house static analysis tool."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/mmc/host/mmci.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b1a665932dc23cad0b8af2745cd9713f9e930d63","lessThan":"af6fbf72e899932f330c4e5d0b84d985c922c633","versionType":"git","status":"affected"},{"version":"b1a665932dc23cad0b8af2745cd9713f9e930d63","lessThan":"7fecf79f31568de161be14911db10d1251617b01","versionType":"git","status":"affected"},{"version":"b1a665932dc23cad0b8af2745cd9713f9e930d63","lessThan":"432b98c1f5daecf04a33c8e1688d26e7ac221e23","versionType":"git","status":"affected"},{"version":"b1a665932dc23cad0b8af2745cd9713f9e930d63","lessThan":"2b19cf3e50cddaff07b657dae1a8f30f06032852","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/mmc/host/mmci.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.5","status":"affected"},{"version":"0","lessThan":"6.5","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2b19cf3e50cddaff07b657dae1a8f30f06032852","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/432b98c1f5daecf04a33c8e1688d26e7ac221e23","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7fecf79f31568de161be14911db10d1251617b01","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/af6fbf72e899932f330c4e5d0b84d985c922c633","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98212","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:07.627","lastModified":"2026-10-19T10:18:21.920","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: hsq: Fix use-after-free in retry work\n\nmmc_hsq_pump_requests() queues retry_work when request_atomic() returns\n-EBUSY; today sdhci-sprd is the only consumer that implements\nrequest_atomic(). The work is embedded in a devm-allocated mmc_hsq, but\nis never cancelled during driver removal. Work still pending at unbind\ncan therefore run after the devm allocation has been released and\ndereference hsq->mmc and hsq->mrq.\n\nUse devm_work_autocancel() to cancel and drain retry_work before the devm\nallocation is released. By the time devres cleanup begins,\nmmc_remove_host() has already stopped the host, so no new requests can\narm the work.\n\nThis issue was found by an in-house static analysis tool."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/mmc/host/mmc_hsq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6db96e5810e0a6a345b7d78549de7676ae5b2662","lessThan":"c50d6515bffb148c2c12be6d587ec201dfab4c34","versionType":"git","status":"affected"},{"version":"6db96e5810e0a6a345b7d78549de7676ae5b2662","lessThan":"df2eb59fd9eb33663dc1053f5a4ed851e0aa1f67","versionType":"git","status":"affected"},{"version":"6db96e5810e0a6a345b7d78549de7676ae5b2662","lessThan":"8439bf262ce3267bcfee29d3c61605f1731a2271","versionType":"git","status":"affected"},{"version":"6db96e5810e0a6a345b7d78549de7676ae5b2662","lessThan":"45341b341642c377192c95e4d48e0a859cf85f42","versionType":"git","status":"affected"},{"version":"6db96e5810e0a6a345b7d78549de7676ae5b2662","lessThan":"5d132990475f02cfa1debe03d50b479432864ebd","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/mmc/host/mmc_hsq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/45341b341642c377192c95e4d48e0a859cf85f42","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5d132990475f02cfa1debe03d50b479432864ebd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8439bf262ce3267bcfee29d3c61605f1731a2271","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c50d6515bffb148c2c12be6d587ec201dfab4c34","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/df2eb59fd9eb33663dc1053f5a4ed851e0aa1f67","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98213","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:07.770","lastModified":"2026-10-19T10:18:22.010","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: core: Cancel SDIO IRQ work before freeing host\n\nA host controller that uses sdio_signal_irq() schedules host->sdio_irq_work\nfrom its interrupt handler.  That work is only cancelled on the suspend\npath (mmc_sdio_suspend()), not on the remove/free path, so a worker armed\njust before the controller freed its IRQ can run after\nmmc_host_classdev_release() has freed the host and dereference it through\ncontainer_of().\n\nCancel host->sdio_irq_work in mmc_free_host(), like the existing\nhost->detect drain added by commit 1036f69e2513 (\"mmc: core: Cancel\ndelayed work before releasing host\").\n\nThis issue was found by an in-house static analysis tool."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/mmc/core/host.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"682696605c7093d2800c498c04166831e5aedf87","lessThan":"bae1cf4f9902b2065bd78b759c7fe6312855f05e","versionType":"git","status":"affected"},{"version":"682696605c7093d2800c498c04166831e5aedf87","lessThan":"0bf3d168a2cc20b120d6b50f0a8ac5b40ff4d589","versionType":"git","status":"affected"},{"version":"682696605c7093d2800c498c04166831e5aedf87","lessThan":"1d6e7315ee1c992b4ca42c9b11c5ed0e925a00e0","versionType":"git","status":"affected"},{"version":"682696605c7093d2800c498c04166831e5aedf87","lessThan":"4553b5004eca9c9eae29a421f1a9c4d5db2c9114","versionType":"git","status":"affected"},{"version":"682696605c7093d2800c498c04166831e5aedf87","lessThan":"2a863458828ade0671c2bc2e469bbd7f2340eb03","versionType":"git","status":"affected"},{"version":"682696605c7093d2800c498c04166831e5aedf87","lessThan":"6feadbecdae60a6324c967f3b1493741083793a3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/mmc/core/host.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.13","status":"affected"},{"version":"0","lessThan":"4.13","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0bf3d168a2cc20b120d6b50f0a8ac5b40ff4d589","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1d6e7315ee1c992b4ca42c9b11c5ed0e925a00e0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2a863458828ade0671c2bc2e469bbd7f2340eb03","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4553b5004eca9c9eae29a421f1a9c4d5db2c9114","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6feadbecdae60a6324c967f3b1493741083793a3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bae1cf4f9902b2065bd78b759c7fe6312855f05e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98214","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:07.943","lastModified":"2026-10-19T10:18:22.117","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: recheck intermediate backing files on mprotect()\n\nmprotect() can be used to bypass the SELinux checks that mmap() performs\nagainst the intermediate layers of a stacked filesystem.\n\nmmap() checks every backing layer as the request descends through the\nstack.  mprotect() only has the lowest backing file in vma->vm_file, so it\nrechecks the top-level user and the lowest mounter, but skips the mounters\nof every layer in between.  With two nested overlayfs mounts and a policy\ndenying mounter_t -> middle_file_t:file { execute }, a direct\nmmap(PROT_EXEC) is denied:\n\n  avc:  denied  { execute } for  pid=71 comm=\"nested_exec\"\n    path=\"/payload\" dev=\"overlay\" ino=9\n    scontext=user_u:base_r:mounter_t\n    tcontext=user_u:object_r:middle_file_t tclass=file permissive=0\n\nwhile mmap(PROT_NONE) followed by mprotect(PROT_EXEC) succeeds.\n\nPreserve each intermediate path, mounter SID and file-description SID in\nthe backing-file security blob, copying the saved entries when another\nbacking layer is opened.  Allocate the array only for nested backing files,\nand release it and the path references in the backing_file_free hook.\n\nDuring mprotect(), recheck fd { use } and the requested inode permissions\nfor every saved mounter, and include the intermediate layers in the execmod\nchecks.  Policy for nested stacking may then need to grant intermediate\nmounters what a direct mmap() already requires, and execmod on intermediate\nlabels for binaries using text relocations.\n\nTested on arm64 QEMU with a small BusyBox initramfs and a purpose-built\nSELinux policy, on a mainline tree containing\ncommit f2381b546e7e (\"fs: fix user path of nested backing files\").\n\n[PM: subject tweak]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["security/selinux/hooks.c","security/selinux/include/objsec.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bc6c380c1159de52a252ed11f19a42c47f60a735","lessThan":"4d50ebe5a27724e020747ffd61a051dec67cb8ec","versionType":"git","status":"affected"},{"version":"8bacd09f12c27710228562e4d13163e58c5f4a45","lessThan":"89376fbfdcc1a728e1775f98752cdd90b0930a00","versionType":"git","status":"affected"},{"version":"d844702198395d3f80222777030f69db6be6b709","lessThan":"d127c7e1f3e1231d8ac8b2738e3f00bea12afe74","versionType":"git","status":"affected"},{"version":"82544d36b1729153c8aeb179e84750f0c085d3b1","lessThan":"c2bbb905af2293549651b614a52ad91e0b462b60","versionType":"git","status":"affected"},{"version":"82544d36b1729153c8aeb179e84750f0c085d3b1","lessThan":"78fc54b934bfb2c18aad8154c7302067146946f9","versionType":"git","status":"affected"},{"version":"cd0e707a927a70cdfd8bc5a512a9719a87f5ed51","versionType":"git","status":"affected"},{"version":"6.6.144","lessThan":"6.6.158","versionType":"semver","status":"affected"},{"version":"6.12.95","lessThan":"6.12.112","versionType":"semver","status":"affected"},{"version":"6.18.38","lessThan":"6.18.54","versionType":"semver","status":"affected"},{"version":"7.0.4","lessThan":"7.1","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["security/selinux/hooks.c","security/selinux/include/objsec.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/4d50ebe5a27724e020747ffd61a051dec67cb8ec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/78fc54b934bfb2c18aad8154c7302067146946f9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/89376fbfdcc1a728e1775f98752cdd90b0930a00","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c2bbb905af2293549651b614a52ad91e0b462b60","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d127c7e1f3e1231d8ac8b2738e3f00bea12afe74","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98215","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:08.107","lastModified":"2026-10-19T10:18:22.230","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: preserve user SID across nested backing files\n\nSELinux saves the user file SID in a backing-file security blob so it\nremains available after mmap() replaces vma->vm_file with a backing file.\n\nFor nested backing files (overlayfs over overlayfs, or FUSE passthrough\nbacked by overlayfs), user_file may itself be a backing file.  Its\nfsec->sid is the SID of the mounter that opened it, rather than the user\nthat opened the top-level file.  mprotect() then checks fd { use } against\nthe mounter SID.  This can incorrectly deny access without a domain\ntransition, or check the wrong target SID after one.\n\nCopy the saved user SID when user_file is a backing file.  Keep using the\nregular file SID for the first backing layer.\n\nWith two nested overlayfs mounts and SELinux enforcing,\nmprotect(PROT_READ) returns EACCES with an fd { use } denial against the\nmounter SID.  With this change, mprotect() succeeds.\n\nTested on arm64 QEMU with a small BusyBox initramfs and a purpose-built\nSELinux policy.  The original test was also repeated with Fedora Cloud\nBase 44 userspace and gave the same result."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["security/selinux/hooks.c","security/selinux/include/objsec.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bc6c380c1159de52a252ed11f19a42c47f60a735","lessThan":"caa1b913d90d5dc07073733326d2af0f0288f089","versionType":"git","status":"affected"},{"version":"8bacd09f12c27710228562e4d13163e58c5f4a45","lessThan":"6aaeec59aadcd1eafc18b049f1b759fb6b9d9569","versionType":"git","status":"affected"},{"version":"d844702198395d3f80222777030f69db6be6b709","lessThan":"9d99b770e7b67b00bdef9005b928aad13e1d679b","versionType":"git","status":"affected"},{"version":"82544d36b1729153c8aeb179e84750f0c085d3b1","lessThan":"ff20d16b2e8230c034e21540043df47222dcc09b","versionType":"git","status":"affected"},{"version":"82544d36b1729153c8aeb179e84750f0c085d3b1","lessThan":"8c0c602202b9a4909b00bc3354e3c0355bc69e65","versionType":"git","status":"affected"},{"version":"cd0e707a927a70cdfd8bc5a512a9719a87f5ed51","versionType":"git","status":"affected"},{"version":"6.6.144","lessThan":"6.6.158","versionType":"semver","status":"affected"},{"version":"6.12.95","lessThan":"6.12.112","versionType":"semver","status":"affected"},{"version":"6.18.38","lessThan":"6.18.54","versionType":"semver","status":"affected"},{"version":"7.0.4","lessThan":"7.1","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["security/selinux/hooks.c","security/selinux/include/objsec.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/6aaeec59aadcd1eafc18b049f1b759fb6b9d9569","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8c0c602202b9a4909b00bc3354e3c0355bc69e65","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9d99b770e7b67b00bdef9005b928aad13e1d679b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/caa1b913d90d5dc07073733326d2af0f0288f089","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ff20d16b2e8230c034e21540043df47222dcc09b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98216","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:08.260","lastModified":"2026-10-19T10:18:22.337","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nIB/hfi1: Fix the PIO_CRED credit-return mmap\n\nhfi1_file_mmap()'s PIO_CRED case must hand user space the single\ncredit-return page that holds this context's entry.  That page is the\nsecond or third page of the per-node credit-return allocation once the\nhardware send context index reaches 64 or 128, so the failure below is\nintermittent: when the entry lands on the first page the offset is zero\nand everything works.\n\nTwo things are wrong.\n\nFirst, cr_page_offset is a byte offset but .va is a struct\ncredit_return *, so adding it is pointer arithmetic and scales the offset\nby sizeof(struct credit_return) == 64.  memvirt then lands 256 KiB or\n512 KiB past a 10240-byte allocation.  With an IOMMU translating, that\naddress is inside the vmalloc range but in no vm_area, so\ndma_mmap_coherent() -> iommu_dma_mmap() finds no pages, vmalloc_to_pfn()\nreturns page_to_pfn(NULL), and remap_pfn_range() installs a frame above\nMAXPHYADDR.  The first user read then takes:\n\n  psm2_ep_open_pr: Corrupted page table at address 7a14d007e000\n  PGD 800000013886a067 P4D 800000013886a067 PUD 13886b067 PMD 13886c067\n                                            PTE 800049168e911235\n  Oops: Bad pagetable: 000d [#1] SMP PTI\n\nSecond, and still wrong once the arithmetic is corrected,\ndma_mmap_coherent() describes a whole coherent buffer and selects the\npage within it with vma->vm_pgoff.  Offsetting cpu_addr has no effect:\nfor a vmap'd allocation iommu_dma_mmap() uses cpu_addr only to locate the\nvm_area and then maps pages[vm_pgoff], which hfi1_file_mmap() has just\nset to 0.  User space therefore always receives the first credit-return\npage, every credit read is for the wrong context, and send PIO stalls\nforever.\n\nUse the DMA API as intended: pass the base of the allocation with its\nfull length and select the page with vm_pgoff.  A separate length is\nneeded because memlen must keep describing the VMA for the existing size\ncheck.  The dma-direct path stays correct as well, since dma_direct_mmap()\nadds the same vm_pgoff to the base pfn.\n\nTested on a Dell T7610 (Xeon E5-2650 v2, Intel IOMMU in DMA-FQ mode)\nagainst a Threadripper PRO 3995WX peer, both Omni-Path 100.  Before this\nchange psm2_ep_open() Oopses the kernel; with only the arithmetic\ncorrected psm2_ep_open() succeeds but any transfer that uses send PIO\nhangs, PSM2_SDMA=2 (send PIO disabled) completing normally while\nPSM2_SDMA=0 (send PIO only) hangs every time.  With this change send PIO,\nsend DMA and the default mixed mode all work."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/hw/hfi1/file_ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1ec82317a1daac78c04b0c15af89018ccf9fa2b7","lessThan":"535530bb2ea5254e1e9f55280143d262dd065204","versionType":"git","status":"affected"},{"version":"1ec82317a1daac78c04b0c15af89018ccf9fa2b7","lessThan":"dcebe0b0bb080a25fe08011fd6b6e741f7912f01","versionType":"git","status":"affected"},{"version":"1ec82317a1daac78c04b0c15af89018ccf9fa2b7","lessThan":"180752deb7270ad37394ab6ef7cf4978fad040b3","versionType":"git","status":"affected"},{"version":"1ec82317a1daac78c04b0c15af89018ccf9fa2b7","lessThan":"bafeac9ce5d1ce5256bcf7e5702e831e9aaf419b","versionType":"git","status":"affected"},{"version":"1ec82317a1daac78c04b0c15af89018ccf9fa2b7","lessThan":"62f0f34fbd2b2d5653d33d3b9d42fdcabb1c0101","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/hw/hfi1/file_ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.3","status":"affected"},{"version":"0","lessThan":"6.3","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/180752deb7270ad37394ab6ef7cf4978fad040b3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/535530bb2ea5254e1e9f55280143d262dd065204","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/62f0f34fbd2b2d5653d33d3b9d42fdcabb1c0101","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bafeac9ce5d1ce5256bcf7e5702e831e9aaf419b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dcebe0b0bb080a25fe08011fd6b6e741f7912f01","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98217","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:08.423","lastModified":"2026-10-19T10:18:22.473","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nIB/mlx4: Fix use-after-free on pkey sysfs registration failure\n\nregister_pkey_tree() ignores errors from register_one_pkey_tree() and\ncontinues registering the remaining slaves. The per-slave error path has\nalready released the pkey parent kobjects, but their pointers remain\nstored in the device. A later device cleanup therefore passes the stale\npointers to kobject_put(), causing a use-after-free.\n\nClear the parent pointers after releasing a failed slave tree and skip\nunregistered trees during device cleanup. This preserves the existing\nbest-effort registration behavior while preventing a second cleanup of\nthe failed tree."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/hw/mlx4/sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c1e7e466120b80ce49e91af0c9da1ce6dee4844a","lessThan":"791471421d848ce13e84f4b21c9e19973d471c4e","versionType":"git","status":"affected"},{"version":"c1e7e466120b80ce49e91af0c9da1ce6dee4844a","lessThan":"734f066933484f6c7cedea0312763249beed5845","versionType":"git","status":"affected"},{"version":"c1e7e466120b80ce49e91af0c9da1ce6dee4844a","lessThan":"a07bee32127d7c4cd3b1bb9a088e21d0c93634c9","versionType":"git","status":"affected"},{"version":"c1e7e466120b80ce49e91af0c9da1ce6dee4844a","lessThan":"cf20d7476754c00eec04ae23d3e929de33ce0345","versionType":"git","status":"affected"},{"version":"c1e7e466120b80ce49e91af0c9da1ce6dee4844a","lessThan":"0c3482e965b18bc242e54e899d1c4d391ca8e5e3","versionType":"git","status":"affected"},{"version":"c1e7e466120b80ce49e91af0c9da1ce6dee4844a","lessThan":"ffb80872617b5f9b3dd1536ec2909029fa66f228","versionType":"git","status":"affected"},{"version":"c1e7e466120b80ce49e91af0c9da1ce6dee4844a","lessThan":"ced1186fea7c77e16681c7ef4802897885989c3b","versionType":"git","status":"affected"},{"version":"c1e7e466120b80ce49e91af0c9da1ce6dee4844a","lessThan":"1af874e9f4ce22ccf8b10ab5462f32c70d3be21a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/hw/mlx4/sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.7","status":"affected"},{"version":"0","lessThan":"3.7","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0c3482e965b18bc242e54e899d1c4d391ca8e5e3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1af874e9f4ce22ccf8b10ab5462f32c70d3be21a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/734f066933484f6c7cedea0312763249beed5845","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/791471421d848ce13e84f4b21c9e19973d471c4e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a07bee32127d7c4cd3b1bb9a088e21d0c93634c9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ced1186fea7c77e16681c7ef4802897885989c3b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cf20d7476754c00eec04ae23d3e929de33ce0345","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ffb80872617b5f9b3dd1536ec2909029fa66f228","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98218","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:08.590","lastModified":"2026-10-19T10:18:22.583","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: atr: fix dangling adapter pointer on add failure\n\ni2c_atr_add_adapter() stores atr->adapter[chan_id] before\ni2c_add_adapter() so that the I2C bus notifier can match child clients\nduring registration. On failure the channel is freed but the slot was\nleft pointing at freed memory, which can lead to use-after-free in\ni2c_atr_del_adapter() / cleanup and also block reuse with -EEXIST.\n\nClear the slot on the i2c_add_adapter() error path before freeing chan."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/i2c/i2c-atr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a076a860acae77bbdcbd316541e5552e81fb1772","lessThan":"2f5e42edbd232bf705dc5d3a91e06344237e63bb","versionType":"git","status":"affected"},{"version":"a076a860acae77bbdcbd316541e5552e81fb1772","lessThan":"1093835f6aef58a831298d93e0d93f244fa07b84","versionType":"git","status":"affected"},{"version":"a076a860acae77bbdcbd316541e5552e81fb1772","lessThan":"eabf7a3d33cd9fad106d267d00cc842434de8e02","versionType":"git","status":"affected"},{"version":"a076a860acae77bbdcbd316541e5552e81fb1772","lessThan":"a57d9592714506556e30188af72dd3bdb9f647b5","versionType":"git","status":"affected"},{"version":"a076a860acae77bbdcbd316541e5552e81fb1772","lessThan":"ad34235808b63a70ca4989b7a2852923193d06ef","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/i2c/i2c-atr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1093835f6aef58a831298d93e0d93f244fa07b84","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2f5e42edbd232bf705dc5d3a91e06344237e63bb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a57d9592714506556e30188af72dd3bdb9f647b5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ad34235808b63a70ca4989b7a2852923193d06ef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eabf7a3d33cd9fad106d267d00cc842434de8e02","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98219","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:08.730","lastModified":"2026-10-19T10:18:22.677","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Close the pre-enable ops error claim window\n\nscx_alloc_and_add_sched() publishes ops->priv before\nscx_root_enable_workfn() switches the state to SCX_ENABLING. An error\nclaimed via scx_bpf_error_bstr() from an associated BPF program in that\nwindow is consumed by scx_disable_workfn(), which takes the pre-enable\nshortcut in scx_root_disable(). The shortcut returns without any teardown\nand restores SCX_DISABLED with an unconditional scx_set_enable_state() xchg\nracing the enable workfn's own transition. The enable then completes with\nthe claim consumed: the scheduler stays up but can never be disabled again,\nand bpf_scx_unreg() frees it while still in use, resulting in a\nuse-after-free. Both WARN_ON_ONCE()s fire back to back:\n\n  WARNING: kernel/sched/ext/ext.c:7522 at\n  scx_root_enable_workfn+0xeec/0x1be0, CPU#3: scx_enable_help/276\n\n  WARNING: kernel/sched/ext/ext.c:6398 at scx_root_disable+0xb50/0xdb8,\n  CPU#0: sched_ext_helpe/664\n\nscx_root_enable_workfn() switches to SCX_ENABLING before the scheduler\nallocation, so ops->priv is never visible while SCX_DISABLED. The allocation\nfailure path restores SCX_DISABLED."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/sched/ext/ext.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"105dcd005be2ac1d5541921db8feb1d0f98d59d5","lessThan":"959c66dc4a915be306c35691095c787c61dc7df9","versionType":"git","status":"affected"},{"version":"105dcd005be2ac1d5541921db8feb1d0f98d59d5","lessThan":"c7a1c6e8004ab12a9c9bfdcb603f60f9bf4a3cee","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/sched/ext/ext.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/959c66dc4a915be306c35691095c787c61dc7df9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c7a1c6e8004ab12a9c9bfdcb603f60f9bf4a3cee","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98220","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:08.857","lastModified":"2026-10-19T10:18:22.763","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Fix NULL sched deref in kfunc sub-sched error paths\n\nWhen the root scheduler has sub-scheds attached, the COMPAT kfunc\nwrappers scx_bpf_select_cpu_and() and scx_bpf_dsq_insert_vtime() refuse\nthe call and report to @p's scheduler:\n\n\tscx_error(scx_task_sched(p), \"... must be used\");\n\nThe wrappers are reachable with tasks that have no scheduler.\nscx_bpf_select_cpu_and() is in the select_cpu kfunc group, which\nscx_kfunc_context_filter() opens to BPF_PROG_TYPE_SYSCALL programs;\nscx_bpf_dsq_insert_vtime() is in the enqueue_dispatch group, which\nops.enqueue() and ops.dispatch() may call with any KF_RCU task -- the\ngroup has no kf_tasks validation, and scx_dsq_insert_preamble() checks\ntask ownership with scx_task_on_sched() precisely because @p may be an\narbitrary task.\n\nscx_task_sched(p) is p->scx.sched, which is NULL for tasks past\nsched_ext_dead() -- which clears it via scx_disable_and_exit_task() on\nexit -- and for idle tasks, which the enable paths skip as they are\nnever scheduled through SCX. It is also an rcu_dereference_protected()\nthat expects @p's pi_lock or rq lock, which neither wrapper holds.\nPassing NULL to scx_error() reaches scx_vexit(), which dereferences\nsch->exit_info, oopsing the kernel.\n\nOne concrete trigger exercised while developing the fix: a\nBPF_PROG_TYPE_SYSCALL program calling the select_cpu_and wrapper on an\nexited-but-not-reaped task while a sub-scheduler was attached (its pid\nstays findable while the zombie is unreaped; faulting instruction is\nthe scx_vexit() prologue \"mov r15,[rdi+0x398]\" with RDI=NULL and 0x398\nthe offset of sch->exit_info):\n\n  sched_ext: BPF scheduler \"kfunc_subsched_null\" enabled\n  sched_ext: BPF sub-scheduler \"kfunc_subsched_null\" enabled\n  sched_ext: Unassociated program run_select_cpu_ (id 76)\n  BUG: kernel NULL pointer dereference, address: 0000000000000398\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  Oops: Oops: 0000 [#1] SMP NOPTI\n  CPU: 7 UID: 0 PID: 8201 Comm: kfunc_test_runn Tainted: G W\n  RIP: 0010:scx_vexit+0x25/0xa0\n  Code: ... <4c> 8b bf 98 03 00 00 ...\n  CR2: 0000000000000398\n  Call Trace:\n   <TASK>\n   __scx_exit+0x4f/0x70\n   scx_bpf_select_cpu_and+0xab/0xb0\n   bpf_prog_430ed61a7b66e03a_run_select_cpu_and+0x9c/0xe7\n   ? __x64_sys_bpf+0x2c/0x40\n   bpf_prog_test_run_syscall+0x130/0x2f0\n   __sys_bpf+0x930/0x10d0\n   ? __x64_sys_bpf+0x2c/0x40\n   __x64_sys_bpf+0x2c/0x40\n   do_syscall_64+0xbc/0x460\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n   </TASK>\n\nRead @p's scheduler under RCU instead, which the wrappers can do from\ntheir guard(rcu)(): fault it when it can be determined, and when it\ncan't be determined -- @p is a task past sched_ext_dead() or an idle\ntask -- there is nothing obviously wrong to report, so just refuse the\ncall as before without faulting any scheduler.\n\nThese COMPAT wrappers are scheduled for eventual removal once the\ndeprecation grace period elapses, but until then -- and regardless of\ntheir removal timeline -- they must not oops the kernel on a task they\nare handed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/sched/ext/ext.c","kernel/sched/ext/idle.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a5fa0708cbfda4d3c2c6a447de7c4b0b23595527","lessThan":"589f0945bf3ebf0790fd51e28c7f0d04ed3d8b78","versionType":"git","status":"affected"},{"version":"a5fa0708cbfda4d3c2c6a447de7c4b0b23595527","lessThan":"0a85182723b65ad8bee8131bc38fcf0347d6679b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/sched/ext/ext.c","kernel/sched/ext/idle.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0a85182723b65ad8bee8131bc38fcf0347d6679b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/589f0945bf3ebf0790fd51e28c7f0d04ed3d8b78","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98221","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:09.003","lastModified":"2026-10-19T10:18:22.867","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: trusted: Fix tpm2_load_cmd() boundary check\n\ntpm2_load_cmd() does boundary checks against the ASN.1 size i.e.,\npayload->blob_len. Address this by passing the decoded blob size to\ntpm2_load_cmd(), and use it for the boundary checks."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["security/keys/trusted-keys/trusted_tpm2.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f2219745250f388edacabe6cca73654131c67d0a","lessThan":"cc86227fea28aed86c1fb52a884560b4440da198","versionType":"git","status":"affected"},{"version":"f2219745250f388edacabe6cca73654131c67d0a","lessThan":"b020b447338872440142fe8a57350a483da86b7a","versionType":"git","status":"affected"},{"version":"f2219745250f388edacabe6cca73654131c67d0a","lessThan":"3fd487c69ad3161e358c33c170bab0cf02a071b7","versionType":"git","status":"affected"},{"version":"f2219745250f388edacabe6cca73654131c67d0a","lessThan":"5afa57ea91481c6c49f194b0f5a5c4d96a4d7348","versionType":"git","status":"affected"},{"version":"f2219745250f388edacabe6cca73654131c67d0a","lessThan":"9ddbc5f4bb498aff8096a5231574858a4bffee4f","versionType":"git","status":"affected"},{"version":"f2219745250f388edacabe6cca73654131c67d0a","lessThan":"134825dfc971fbf2b1d0f58f0b3bce8332ad0afb","versionType":"git","status":"affected"},{"version":"f2219745250f388edacabe6cca73654131c67d0a","lessThan":"114f00d738f15dd8c7318369edcdc53dd6d08763","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["security/keys/trusted-keys/trusted_tpm2.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/114f00d738f15dd8c7318369edcdc53dd6d08763","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/134825dfc971fbf2b1d0f58f0b3bce8332ad0afb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3fd487c69ad3161e358c33c170bab0cf02a071b7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5afa57ea91481c6c49f194b0f5a5c4d96a4d7348","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9ddbc5f4bb498aff8096a5231574858a4bffee4f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b020b447338872440142fe8a57350a483da86b7a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cc86227fea28aed86c1fb52a884560b4440da198","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98222","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:09.153","lastModified":"2026-10-19T10:18:22.967","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: encrypted: fix integer overflow of datablob_len\n\nencrypted_key_alloc() stores datablob_len in a u16. It is computed from\nmultiple string and payload lengths. If the result exceeds U16_MAX, the\nassignment truncates the allocation size. KASAN reports a 32760-byte\nslab-out-of-bounds write when __ekey_init() copies the master key\ndescription into the undersized buffer.\n\nThe total payload length stored in key->datalen is also a u16. Use\ncheck_add_overflow() to reject values that do not fit either destination,\nand use kzalloc_flex() for the flexible-array allocation."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["security/keys/encrypted-keys/encrypted.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7e70cb4978507cf31d76b90e4cfb4c28cad87f0c","lessThan":"1e720f63dbafc093a8f5d519f05b67724993edd4","versionType":"git","status":"affected"},{"version":"7e70cb4978507cf31d76b90e4cfb4c28cad87f0c","lessThan":"a1a98eca102b1cbbc37ff9eaa197ae4e6a3ea4b0","versionType":"git","status":"affected"},{"version":"7e70cb4978507cf31d76b90e4cfb4c28cad87f0c","lessThan":"cca38f2102a4cd35eda8d48950df4817b4b24757","versionType":"git","status":"affected"},{"version":"7e70cb4978507cf31d76b90e4cfb4c28cad87f0c","lessThan":"8697c431e297eb0d0ab13dda6bc172b48a34f05c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["security/keys/encrypted-keys/encrypted.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.38","status":"affected"},{"version":"0","lessThan":"2.6.38","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1e720f63dbafc093a8f5d519f05b67724993edd4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8697c431e297eb0d0ab13dda6bc172b48a34f05c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a1a98eca102b1cbbc37ff9eaa197ae4e6a3ea4b0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cca38f2102a4cd35eda8d48950df4817b4b24757","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98223","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:09.290","lastModified":"2026-10-19T10:18:23.073","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm: filemap: retain mapped dropbehind folios\n\nFault-around can map ready dropbehind folios without going through the\nnormal page-cache lookup that clears dropbehind.  A mapping represents a\ncompeting cached user, so retain the folio instead of forcibly unmapping\nit when writeback completes.\n\nFor a mapped folio, folio_unmap_invalidate() can call\nunmap_mapping_folio(), which takes i_mmap_rwsem and may sleep.  Retaining\nmapped folios avoids this path when folio_end_dropbehind() runs in\nnon-preemptible task context.\n\nTal was able to trigger a sleeping-in-atomic warning due to this [1].\n\nUnmapped dropbehind folios continue through the existing invalidation path."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["mm/filemap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fb7d3bc4149395c1ae99029c852eab6c28fc3c88","lessThan":"2897601dffe576fcd87a4259102f41f7fb0cbfc8","versionType":"git","status":"affected"},{"version":"fb7d3bc4149395c1ae99029c852eab6c28fc3c88","lessThan":"77c0fade37c80e8aa16ac048a9828249055e3f66","versionType":"git","status":"affected"},{"version":"fb7d3bc4149395c1ae99029c852eab6c28fc3c88","lessThan":"848d2ce2fce15fbdc083fbf9691bfa72911033c4","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["mm/filemap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.14","status":"affected"},{"version":"0","lessThan":"6.14","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2897601dffe576fcd87a4259102f41f7fb0cbfc8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/77c0fade37c80e8aa16ac048a9828249055e3f66","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/848d2ce2fce15fbdc083fbf9691bfa72911033c4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98224","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:09.427","lastModified":"2026-10-19T10:18:23.160","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vma: correctly unaccount on mmap_prepare() failure\n\n__mmap_setup() accounts memory for relevant mappings via:\n\nsecurity_vm_enough_memory_mm()\n  -> __vm_enough_memory()\n    -> vm_acct_memory()\n\nIf __mmap_setup() fails, this indicates that this accounting did not take\nplace, and thus it's appropriate for __mmap_region() to jump to\nabort_munmap.\n\nHowever if call_mmap_prepare() fails, it also jumps there and any accounted\nmemory is not correctly unaccounted.\n\nFix this by handling each error separately."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["mm/vma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c84bf6dd2b836b49bb2662668ff1692350d28236","lessThan":"fb5400bff669c8bad3d4ec09287d9b461e89e5f1","versionType":"git","status":"affected"},{"version":"c84bf6dd2b836b49bb2662668ff1692350d28236","lessThan":"8fdc521d438fbf0d22c13d51d55d5dd82d7202b2","versionType":"git","status":"affected"},{"version":"c84bf6dd2b836b49bb2662668ff1692350d28236","lessThan":"6cc27d82196385fe06853319f74312a7d8019726","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["mm/vma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/6cc27d82196385fe06853319f74312a7d8019726","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8fdc521d438fbf0d22c13d51d55d5dd82d7202b2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fb5400bff669c8bad3d4ec09287d9b461e89e5f1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98225","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:09.587","lastModified":"2026-10-19T10:18:23.243","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/shrinker: fix bogus set_shrinker_bit() with cgroup.memory=nokmem\n\nWith cgroup.memory=nokmem, shrinker_memcg_alloc() bails out early and\nnever allocates an id, so shrinker->id keeps the 0 it got from the\nkzalloc() in shrinker_alloc().  __list_lru_init() then copies that 0 into\nlru->shrinker_id, where it looks like a valid bit index.\n\nNothing calls expand_shrinker_info() on nokmem either, so shrinker_nr_max\nstays 0 and every memcg ends up with an empty map (map_nr_max == 0).\n\ndeferred_split_folio() hands a real memcg to __list_lru_add() regardless\nof whether the lru is memcg aware, so the first THP queued in a cgroup\ndoes set_shrinker_bit(memcg, nid, 0) and trips the bounds check:\n\nWARNING: mm/shrinker.c:212 at set_shrinker_bit+0x7d/0x90, CPU#126\nCall Trace:\n <TASK>\n deferred_split_folio+0x18c/0x220\n map_anon_folio_pmd_nopf+0xdd/0x130\n map_anon_folio_pmd_pf+0x14/0xb0\n do_huge_pmd_anonymous_page+0x1a1/0x620\n __handle_mm_fault+0xea9/0x10d0\n handle_mm_fault+0xe5/0x320\n do_user_addr_fault+0x1cc/0x870\n exc_page_fault+0x81/0x1b0\n asm_exc_page_fault+0x27/0x30\n </TASK>\n\nHarmless, the WARN_ON_ONCE() is what keeps the out of bounds unit[] read\nfrom happening, but the id should not look valid in the first place. \nClear it before returning.\n\nTwo other spots could paper over this: drop the id in __list_lru_init()\nwhen nokmem turns memcg_aware off, or make deferred_split_folio() pass\nNULL like list_lru_add_obj() does.  Both leave shrinker->id lying around\nfor the next caller, so fix it where the id is handed out."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["mm/shrinker.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fafaeceb89a5e2e856ff04c2cacb6cae4a2ecb67","lessThan":"469c12a69ab1842a9090b6c074ffedbfd9584f9c","versionType":"git","status":"affected"},{"version":"fafaeceb89a5e2e856ff04c2cacb6cae4a2ecb67","lessThan":"932cfb25e7ce98d1f93895671ec186a3087e4f80","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["mm/shrinker.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.2","status":"affected"},{"version":"0","lessThan":"7.2","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/469c12a69ab1842a9090b6c074ffedbfd9584f9c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/932cfb25e7ce98d1f93895671ec186a3087e4f80","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98226","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:09.820","lastModified":"2026-10-19T10:18:23.330","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage count\n\nSWAP_USAGE_OFFLIST_BIT is embedded in the si->inuse_pages usage counter,\nand is meant to sit above any value that counter can reach.  However, it\nis defined from BITS_PER_TYPE(atomic_t), so it is bit 30.  On a system\nwith 4 KiB pages the flag collides with the usage count once that count\nreaches 4 TiB.\n\nswap_usage_in_pages() masks bit 30 out, so whenever the real count has\nthat bit set, every caller of it reads 4 TiB low:\n\n* /proc/swaps understates Used by 4 TiB.\n\n* A raw count of exactly 2^30 masks to zero, so try_to_unuse() takes its\n  \"if (!swap_usage_in_pages(si)) goto success;\" early exit and swapoff\n  tears the device down while pages are still swapped out. Nothing in\n  the rest of swapoff aborts the teardown, so those pages are lost.\n\nIndependently of swapoff, the collision also corrupts the counter and the\nplist.  On a device in normal use, a free that leaves bit 30 set in the\ncount makes swap_usage_sub() see the flag where there is only count, and\ncall add_to_avail_list().  It clears the bit with\nfetch_and(~SWAP_USAGE_OFFLIST_BIT), leaving the stored count 4 TiB below\nthe real one, and calls plist_add() on a device that is already listed,\ntripping the WARN_ON(!plist_node_empty(node)) in plist_add() and linking\nthe node a second time.\n\nChange the definition of SWAP_USAGE_OFFLIST_BIT to be based on\natomic_long_t instead.  Note that the usage counter field itself is of\nthis same type, so it is still a valid bit."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["mm/swapfile.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b228386cf237e659cdf5d8037a19db0b0a06f6b5","lessThan":"0a41a46859df0d2bd7ed127197aac7c7389c00ed","versionType":"git","status":"affected"},{"version":"b228386cf237e659cdf5d8037a19db0b0a06f6b5","lessThan":"7c0d0d6de46076b43a2acaf1026b6648f8434c39","versionType":"git","status":"affected"},{"version":"b228386cf237e659cdf5d8037a19db0b0a06f6b5","lessThan":"12e9ac7bc5b254048f886bf421e3a15491106c1f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["mm/swapfile.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.14","status":"affected"},{"version":"0","lessThan":"6.14","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0a41a46859df0d2bd7ed127197aac7c7389c00ed","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/12e9ac7bc5b254048f886bf421e3a15491106c1f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7c0d0d6de46076b43a2acaf1026b6648f8434c39","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98227","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:09.963","lastModified":"2026-10-19T10:18:23.430","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmemstick: ms_block: destroy io_queue workqueue on removal\n\nmsb_init_disk() creates the per-card ordered workqueue msb->io_queue with\nalloc_ordered_workqueue(). It is torn down with destroy_workqueue() only\non the init error path; msb_remove() never destroys it. msb_stop() merely\nflushes the queue, and neither msb_data_clear() nor put_disk() free it. As\na result every card insert/remove cycle leaks the workqueue and its\nkworker, exhausting kernel memory over repeated cycles.\n\nDestroy the workqueue in msb_remove() after the disk has been removed and\nthe queue drained."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/memstick/core/ms_block.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0ab30494bc4f3bc1ea4659b7c5d97c5218554a63","lessThan":"0ff795163f37109a134b5a421558530f8d091544","versionType":"git","status":"affected"},{"version":"0ab30494bc4f3bc1ea4659b7c5d97c5218554a63","lessThan":"19c3da6621a253f1f8b937ed91bc22330a930d9c","versionType":"git","status":"affected"},{"version":"0ab30494bc4f3bc1ea4659b7c5d97c5218554a63","lessThan":"9a2e7cdc0880e735aff0968ee402f2c92a992b9b","versionType":"git","status":"affected"},{"version":"0ab30494bc4f3bc1ea4659b7c5d97c5218554a63","lessThan":"6611f78ec3fd4b33a00bfda20725b254a22979f6","versionType":"git","status":"affected"},{"version":"0ab30494bc4f3bc1ea4659b7c5d97c5218554a63","lessThan":"f222bb8c30cf5699c560b29179ff2bddcac1f950","versionType":"git","status":"affected"},{"version":"0ab30494bc4f3bc1ea4659b7c5d97c5218554a63","lessThan":"90af7fde083e1b22c349c3a8b1626728e44e474c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/memstick/core/ms_block.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.12","status":"affected"},{"version":"0","lessThan":"3.12","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0ff795163f37109a134b5a421558530f8d091544","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/19c3da6621a253f1f8b937ed91bc22330a930d9c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6611f78ec3fd4b33a00bfda20725b254a22979f6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/90af7fde083e1b22c349c3a8b1626728e44e474c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9a2e7cdc0880e735aff0968ee402f2c92a992b9b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f222bb8c30cf5699c560b29179ff2bddcac1f950","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98228","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:10.110","lastModified":"2026-10-19T10:18:23.530","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ\n\nOn I6500 CPU cores, lld and scd give no ordering guarantees (same as all\nother instructions). To respect the assumption that arch_cmpxchg() is\nfully ordered, we must inject sync instructions above and below our\nlld/scd loops using the already in place WEAK_REORDERING_BEYOND_LLSC\ninfrastructure.\n\nOtherwise, bad things can happen:\n\n[   34.054496] CPU 3 Unable to handle kernel paging request at virtual address 0000000000000000, epc == a80000080838e01c, ra == a80000080838dfc4\n[   34.054559] Oops[#1]:\n[   34.069561] CPU: 3 UID: 0 PID: 170 Comm: pipe_race Not tainted 7.2.0-rc6-01553-gb73c35220968-dirty #103 VOLUNTARY\n[   34.079932] Hardware name: Mobile EyeQ5 MP5 Evaluation board\n[   34.085592] $ 0   : 0000000000000000 0000000000000001 0000000000000000 0000000000000000\n[   34.093616] $ 4   : a800000808ee2618 000000000b7a879d 0000000000001000 0000000000000000\n[   34.101638] $ 8   : 0000000000e3f2c9 0000000000000000 a800000808a2a9f8 0000000000000000\n[   34.109660] $12   : a8000008139ffcd8 ffffffff84080018 a80000080837fae0 7878787878787878\n[   34.117682] $16   : a800000807e82940 0000000000001000 0000000000000000 0000000000000000\n[   34.125704] $20   : a800000802920e00 a8000008139ffdf8 a800000802649400 0000000000e3f2c9\n[   34.133726] $24   : 0000000000000006 00000001200406e0\n[   34.141783] $28   : a8000008139fc000 a8000008139ffd10 0000000000e3f2c8 a80000080838dfc4\n[   34.149837] epc   : a80000080838e01c anon_pipe_read+0xd4/0x428\n[   34.155697] ra    : a80000080838dfc4 anon_pipe_read+0x7c/0x428\n[   34.161549] Status: 140000e3  KX SX UX KERNEL EXL IE\n[   34.166551] Cause : 40800408 (ExcCode 02)\n[   34.170574] BadVA : 0000000000000000\n[   34.174161] PrId  : 0001b028 (MIPS I6500)\n[   34.178183] Process pipe_race (pid: 170, threadinfo=000000005ca35720, task=00000000e1013890, tls=000000014ebbb780)\n[   34.188568] Stack : a800000802649400 0000000000000000 0000000000000000 a8000008139ffdd0\n[   34.196623]\t 0000000000000fba a800000808ee0000 0000000000000001 a8000008130c3e80\n[   34.204676]\t a8000008080d1280 a8000008139ffd58 a8000008139ffd58 1dbd2b22ea1dd500\n[   34.212729]\t a800000802649400 a800000808ee0000 ffffffffffffffea 0000000000000001\n[   34.220783]\t 0000000000001000 0000000000000000 00000001200ae518 ffffffffffffffff\n[   34.228836]\t 000000fffbe0e530 a80000080837edf4 000000fffbe0e530 0000000000000000\n[   34.236890]\t 0000000000000000 0000000000000000 000000014ebb55a0 0000000000001000\n[   34.244943]\t 0000000000000001 a800000802649400 0000000000000000 0000000000000000\n[   34.252996]\t 0000000000000000 0000400400000000 0000000000000000 1dbd2b22ea1dd500\n[   34.261049]\t 00000000140000e3 a800000802649400 a800000802649400 a800000808ee0000\n[   34.269103]\t ...\n[   34.271568] Call Trace:\n[   34.274026] [<a80000080838e01c>] anon_pipe_read+0xd4/0x428\n[   34.279533] [<a80000080837edf4>] vfs_read+0x25c/0x318\n[   34.284607] [<a80000080837faac>] ksys_read+0x104/0x138\n[   34.289763] [<a80000080802b9cc>] syscall_common+0x44/0x68\n[   34.295187]\n[   34.296689] Code: f84000cf  02209825  de020010 <dc420000> d8400004  02002825  0040f809  02802025  f84000c3\n[   34.306504]\n[   34.308099] ---[ end trace 0000000000000000 ]---\n\nMy initial reproducer was the xdp-tools test suite. A standalone\nreproducer would be an lld/scd loop that, when the read is reordered by\nthe CPU, triggers a fault. We can achieve this from userspace by\nstressing an anonymous pipe, which uses a mutex. Program used:\n\n\t// SPDX-License-Identifier: GPL-2.0\n\t// pipe_race.c - reproducer for MIPS LL/SC reordering vs fs/pipe.c\n\t//\n\t// Two userspace processes on an anonymous pipe:\n\t//   parent  = writer: tight write() loop\n\t//   child   = reader: tight read() loop\n\n\t#define _GNU_SOURCE\n\t#include <assert.h>\n\t#include <errno.h>\n\t#include <sched.h>\n\t#include <signal.h>\n\t#include <stdio.h>\n\t#include <stdlib.h>\n\t#include <string.h>\n\t#include <sys/types.h>\n\t#include\n---truncated---"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/mips/Kconfig"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fbe0fae601b780622fcb7034a479fa161645b9f4","lessThan":"3f017c2ca8c31a1e135dd87be647096866d6b196","versionType":"git","status":"affected"},{"version":"fbe0fae601b780622fcb7034a479fa161645b9f4","lessThan":"bbc448c541ed90d52f9ec22f17394304e3bf170e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/mips/Kconfig"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/3f017c2ca8c31a1e135dd87be647096866d6b196","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bbc448c541ed90d52f9ec22f17394304e3bf170e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98229","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:10.260","lastModified":"2026-10-19T10:18:23.660","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: save input state data before secpath resets\n\nxfrm_input() stores the current xfrm_state in the skb secpath while it\ncontinues receive-side processing. Some input paths can reset that secpath\nbefore xfrm_input() has finished dereferencing the state.\n\nReceive callback users such as VTI and XFRM interfaces can reset the\nsecpath. The VTI receive path does so before checking whether the packet\ncrosses network namespaces, while the XFRM interface path does so only for\ncross-network-namespace packets. The XFRM_MAX_DEPTH error path can also\nreset the secpath before the final drop callback reports the current\nstate's protocol.\n\nIf secpath_reset() drops the last state reference while the state is\nconcurrently deleted, xfrm_input() can still dereference the freed state\nwhen selecting transport_finish() or reporting the drop callback protocol.\n\nSave the state protocol on the stack while the state is still valid,\nand use the already saved address family for transport_finish(). A larval\nXFRM_STATE_ACQ state has no type, so retain nexthdr as its protocol. This\npreserves the existing drop-path fallback while avoiding the post-reset\nstate dereferences without adding an extra state reference to every\nreceived packet."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/xfrm/xfrm_input.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"df3893c176e9b0bb39b28ab5ec8113fa20ad1ee0","lessThan":"35de97850987b3d022ed17df5b2577242e746daf","versionType":"git","status":"affected"},{"version":"df3893c176e9b0bb39b28ab5ec8113fa20ad1ee0","lessThan":"148db154066b066616b82c12d373e786eba1f96a","versionType":"git","status":"affected"},{"version":"df3893c176e9b0bb39b28ab5ec8113fa20ad1ee0","lessThan":"537a5ae18b2be70f8eb0aca843682e81a69aab91","versionType":"git","status":"affected"},{"version":"df3893c176e9b0bb39b28ab5ec8113fa20ad1ee0","lessThan":"3cf5cdecd99c9c186a5ea518d93bbf3045b6e3aa","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/xfrm/xfrm_input.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.15","status":"affected"},{"version":"0","lessThan":"3.15","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/148db154066b066616b82c12d373e786eba1f96a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/35de97850987b3d022ed17df5b2577242e746daf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3cf5cdecd99c9c186a5ea518d93bbf3045b6e3aa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/537a5ae18b2be70f8eb0aca843682e81a69aab91","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98230","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:10.397","lastModified":"2026-10-19T10:18:23.767","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: use hlist_del_init_rcu for state_cache and state_cache_input\n\nCommit 14acf9652e56 (\"xfrm: defensively unhash xfrm_state lists in\n__xfrm_state_delete\") converted bydst/bysrc/byseq/byspi from\nhlist_del_rcu() to hlist_del_init_rcu() so that a second\n__xfrm_state_delete() on the same object becomes a no-op rather than a\nwrite through LIST_POISON pprev. It missed state_cache and\nstate_cache_input, which kept hlist_del_rcu():\n\n- hlist_del_rcu() leaves pprev = LIST_POISON2 (non-NULL), so\n  hlist_unhashed() returns false.\n- hlist_del_init_rcu() leaves pprev = NULL, so hlist_unhashed()\n  returns true.\n\nA second __xfrm_state_delete() therefore enters __hlist_del() on the\nalready-deleted state_cache/state_cache_input nodes and does\nWRITE_ONCE(*pprev, next) through LIST_POISON2 — a write use-after-free\nonce the slab is reused. The corruption can in turn cause a subsequent\nhlist_for_each_entry_rcu traversal to follow a dangling next pointer,\nproducing the read use-after-free reported in xfrm_input_state_lookup().\n\nSwitch state_cache and state_cache_input to hlist_del_init_rcu() to\nmatch the other four lists, closing the write use-after-free and, with\nit, the read use-after-free it spawns."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/xfrm/xfrm_state.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"aa48a18fdb0911572d133057cd579db704b87da4","lessThan":"fb38fb7420d5f7192f9e2b6ac835ede149cd7ac5","versionType":"git","status":"affected"},{"version":"0045e3d80613cc7174dc15f189ee6fc4e73b9365","lessThan":"4748c27e2e6a1969e02f1df46e62f79d2799b80b","versionType":"git","status":"affected"},{"version":"0045e3d80613cc7174dc15f189ee6fc4e73b9365","lessThan":"9b74a47a4cbd0d29faff4f3b199212c73e6b6220","versionType":"git","status":"affected"},{"version":"0045e3d80613cc7174dc15f189ee6fc4e73b9365","lessThan":"2afb8dc1f4390f164db8352f8e685e126e9db566","versionType":"git","status":"affected"},{"version":"5e4334dc39443645415450163ff5ff1ee7e79784","versionType":"git","status":"affected"},{"version":"6.12.13","lessThan":"6.12.112","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/xfrm/xfrm_state.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.13","status":"affected"},{"version":"0","lessThan":"6.13","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/2afb8dc1f4390f164db8352f8e685e126e9db566","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4748c27e2e6a1969e02f1df46e62f79d2799b80b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9b74a47a4cbd0d29faff4f3b199212c73e6b6220","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fb38fb7420d5f7192f9e2b6ac835ede149cd7ac5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98231","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:10.540","lastModified":"2026-10-19T10:18:23.883","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: serialize state GC with device state flush\n\nThe deferred-device pass in xfrm_dev_state_flush() finds states under\nxfrm_state_dev_gc_lock, but drops the lock before calling\nxfrm_dev_state_free() because the driver callback may sleep.  The device\nGC list does not hold an xfrm_state reference, so the state GC worker can\ndestroy the same state concurrently.\n\nThe race can proceed as follows:\n\n  CPU 0                               CPU 1\n  find x on the device GC list\n  drop xfrm_state_dev_gc_lock\n  read x->xso.dev\n                                      xfrm_state_gc_destroy(x)\n                                      xfrm_dev_state_free(x)\n                                      xfrm_state_free(x)\n  continue xfrm_dev_state_free(x)\n\nBoth paths can invoke the driver callback and drop the device reference.\nCPU 0 can also access the xfrm_state after CPU 1 has freed it.\n\nKASAN reported:\n\n  BUG: KASAN: slab-use-after-free in xfrm_dev_state_free+0x24c/0x2a0\n  Read of size 8 at addr ffff88810bbaa960 by task poc/102\n\n  Call Trace:\n   xfrm_dev_state_free+0x24c/0x2a0\n   xfrm_dev_state_flush+0x353/0x400\n   xfrm_dev_event+0x26d/0x3a0\n   notifier_call_chain+0xc0/0x280\n   __dev_notify_flags+0x169/0x250\n   netif_change_flags+0xe7/0x160\n   dev_change_flags+0x96/0x220\n   devinet_ioctl+0x7f4/0x1880\n\n  Allocated by task 87:\n   xfrm_state_alloc+0x1e/0x5c0\n   xfrm_add_sa+0xe7f/0x5820\n   xfrm_user_rcv_msg+0x4f3/0x940\n\n  Freed by task 57:\n   kmem_cache_free+0xcb/0x3d0\n   xfrm_state_gc_task+0x4a8/0x650\n   process_one_work+0x63a/0x1070\n\nSerialize xfrm_state destruction against the deferred-device pass with a\nmutex.  Keep xfrm_state_dev_gc_lock limited to list operations and retain\nthe existing callback and device-reference release ordering."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/xfrm/xfrm_state.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d5f53edd43daf3e6e1633a49c561387f8f99e13f","lessThan":"937108dc0258d6ac69926b00bc53598c98986ee1","versionType":"git","status":"affected"},{"version":"07b87f9eea0c30675084d50c82532d20168da009","lessThan":"39e41af3653ee45c985190dd97426f318918d201","versionType":"git","status":"affected"},{"version":"07b87f9eea0c30675084d50c82532d20168da009","lessThan":"75fc4561772e2f9811abf39ed10443e6f4a4bc6c","versionType":"git","status":"affected"},{"version":"07b87f9eea0c30675084d50c82532d20168da009","lessThan":"84e378395494963b1e581cf223a7cbeec8c0e2d6","versionType":"git","status":"affected"},{"version":"07b87f9eea0c30675084d50c82532d20168da009","lessThan":"89fefad9f971bc637fb22373078144f2563c4be9","versionType":"git","status":"affected"},{"version":"8ecee44464a4926c9bef989a1490b7394785f584","versionType":"git","status":"affected"},{"version":"6.6.44","lessThan":"6.6.158","versionType":"semver","status":"affected"},{"version":"6.10.3","lessThan":"6.11","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/xfrm/xfrm_state.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/39e41af3653ee45c985190dd97426f318918d201","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/75fc4561772e2f9811abf39ed10443e6f4a4bc6c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/84e378395494963b1e581cf223a7cbeec8c0e2d6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/89fefad9f971bc637fb22373078144f2563c4be9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/937108dc0258d6ac69926b00bc53598c98986ee1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98232","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:10.703","lastModified":"2026-10-19T10:18:23.997","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Validate MODE SENSE lengths in scsi_cdl_enable()\n\nscsi_cdl_enable() uses length fields returned by MODE SENSE to locate\nthe ATA feature mode page in a 64-byte stack buffer. A target can report\na total length shorter than its mode header and block descriptors. The\nunsigned subtraction used for the MODE SELECT length can wrap, and the\nseparately computed buf_data can point beyond buf.\n\nDuring automatic scan, enable is false, so the read-modify-write of\nbuf_data[4] can clear the low two bits of a target-selected\nout-of-bounds stack byte. scsi_mode_select() can then copy up to 64\nbytes from outside the buffer into the outgoing MODE SELECT payload,\ndisclosing stack contents to the target.\n\nThis is reachable while scanning a USB storage device that identifies as\nan ATA device and advertises CDL support. No filesystem mount or\nuserspace access to the block device is required.\n\nOn upstream commit cee9395acd80 (\"Linux 7.3-rc1\"), a build-specific,\none-vCPU QEMU/Raw Gadget proof using QEMU-only multi-UDC allocator\nsampling executed a fixed proof command inside the guest and created a\nUID-0-owned marker during automatic enumeration, with KASLR and NX\nenabled.\n\nThe issue was independently found during security research at Drivesec\nS.r.l.\n\nCap the available length to the buffer size. Validate and consume the\nmode header and block descriptor lengths before using the page, and\nrequire the five bytes needed to access the CDL field."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/scsi/scsi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1b22cfb14142aba7742d307c4f8d7006f919308c","lessThan":"39491a1ae93054fea10b4030180e5c797b2c0343","versionType":"git","status":"affected"},{"version":"1b22cfb14142aba7742d307c4f8d7006f919308c","lessThan":"60b0b8ce803e3c2b2a9e5485ab3f88599fb4c7a4","versionType":"git","status":"affected"},{"version":"1b22cfb14142aba7742d307c4f8d7006f919308c","lessThan":"6233d0b3ef4623df0d6934dc8b93b161e9854f6b","versionType":"git","status":"affected"},{"version":"1b22cfb14142aba7742d307c4f8d7006f919308c","lessThan":"99a6e4a9176da456904b67dcbae6e77d122782b7","versionType":"git","status":"affected"},{"version":"1b22cfb14142aba7742d307c4f8d7006f919308c","lessThan":"3d676e458fe0c566f5a62753dc696b6a862fc412","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/scsi/scsi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.5","status":"affected"},{"version":"0","lessThan":"6.5","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/39491a1ae93054fea10b4030180e5c797b2c0343","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3d676e458fe0c566f5a62753dc696b6a862fc412","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/60b0b8ce803e3c2b2a9e5485ab3f88599fb4c7a4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6233d0b3ef4623df0d6934dc8b93b161e9854f6b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/99a6e4a9176da456904b67dcbae6e77d122782b7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98233","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:10.857","lastModified":"2026-10-19T10:18:24.100","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: clear RX owner on VNET header error\n\nCommit 61fad6816fc1 (\"net/packet: tpacket_rcv: avoid a producer race\ncondition\") added rx_owner_map and made tpacket_rcv() claim a V1 or V2\nring slot before converting the virtio-net header.  If the conversion\nfails, the drop path leaves the slot claimed.\n\nWith a one-frame TPACKET_V2 ring, an unsupported UDP GSO packet leaves\nthe only slot unavailable, so the ring also drops the next valid packet.\n\nClear the ownership bit on this error path.  TPACKET_V3 already clears\nits block state here."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/packet/af_packet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"61fad6816fc10fb8793a925d5c1256d1c3db0cd2","lessThan":"bb10a0084c03a94364aeec542beddc5d49b59f59","versionType":"git","status":"affected"},{"version":"61fad6816fc10fb8793a925d5c1256d1c3db0cd2","lessThan":"b8c0cb3069058c2d67b5c7c833b2833381ecffdc","versionType":"git","status":"affected"},{"version":"61fad6816fc10fb8793a925d5c1256d1c3db0cd2","lessThan":"2daa618e7ff19eefcbda281bc4c5998c4140f9cf","versionType":"git","status":"affected"},{"version":"61fad6816fc10fb8793a925d5c1256d1c3db0cd2","lessThan":"23cd30498891d29a69ec9b75bd92f8a0f21f1342","versionType":"git","status":"affected"},{"version":"61fad6816fc10fb8793a925d5c1256d1c3db0cd2","lessThan":"49a48a5aaf85fe69d2dc3fb334b4854fadf44e39","versionType":"git","status":"affected"},{"version":"61fad6816fc10fb8793a925d5c1256d1c3db0cd2","lessThan":"805edbdcb8681da5f7ee43b3c3c809f7a8c31208","versionType":"git","status":"affected"},{"version":"61fad6816fc10fb8793a925d5c1256d1c3db0cd2","lessThan":"693209a237fc548791cf402441db8b68d1da7d38","versionType":"git","status":"affected"},{"version":"61fad6816fc10fb8793a925d5c1256d1c3db0cd2","lessThan":"33ff111d7ba3beb86e28938d6382bb5beabd865a","versionType":"git","status":"affected"},{"version":"2975472e042e0bbfeeabddc5023cb8c011ec5a07","versionType":"git","status":"affected"},{"version":"6fb0e4385928900ccb8697748555b3f54bba5193","versionType":"git","status":"affected"},{"version":"86137342fd4cf52882842aa8d1318b2661f08e8a","versionType":"git","status":"affected"},{"version":"b06e4d3ed4044c2facf10a511d809f9aa29d960e","versionType":"git","status":"affected"},{"version":"4.14.175","lessThan":"4.15","versionType":"semver","status":"affected"},{"version":"4.19.114","lessThan":"4.20","versionType":"semver","status":"affected"},{"version":"5.4.29","lessThan":"5.5","versionType":"semver","status":"affected"},{"version":"5.5.14","lessThan":"5.6","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/packet/af_packet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.6","status":"affected"},{"version":"0","lessThan":"5.6","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/23cd30498891d29a69ec9b75bd92f8a0f21f1342","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2daa618e7ff19eefcbda281bc4c5998c4140f9cf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/33ff111d7ba3beb86e28938d6382bb5beabd865a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/49a48a5aaf85fe69d2dc3fb334b4854fadf44e39","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/693209a237fc548791cf402441db8b68d1da7d38","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/805edbdcb8681da5f7ee43b3c3c809f7a8c31208","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b8c0cb3069058c2d67b5c7c833b2833381ecffdc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bb10a0084c03a94364aeec542beddc5d49b59f59","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98234","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:11.033","lastModified":"2026-10-19T10:18:24.220","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: hhf: cap hh_flows_limit at change time\n\nhhf_change() stores TCA_HHF_HH_FLOWS_LIMIT with no upper bound. A huge\nhh_flows_limit lets each new heavy-hitter flow pass the\nhh_flows_current_cnt check in alloc_new_hh() and forces a fixed-size\nkzalloc(GFP_ATOMIC) per flow under spoofed traffic, for unbounded memory\ngrowth.\n\nBound the attribute with NLA_POLICY_MAX() at 2*HH_FLOWS_CNT (the\nhhf_init() default) and report the rejected value via extack. The\ndeprecated nested parse is kept: legacy tc does not set NLA_F_NESTED on\nTCA_OPTIONS. Configs relying on hh_limit above the default were relying\non unbounded, unsafe behaviour and are not supported going forward.\n\nhhf_init() also ran hhf_change() before setting the default\nhh_flows_limit, so a user-supplied hh_limit at add time was clobbered\nback to 2048. Set the default before hhf_change() so the configured\nvalue sticks.\n\nThis is a follow-up to commit eb56a495f59b (\"net/sched: hhf: clamp\nquantum in change and init paths\"), which bounded the quantum of the\nsame qdisc; the hh_flows_limit bound is the remaining unbounded knob of\nthat series' scope.\n\nConditions to recreate the bug: CAP_NET_ADMIN in a user namespace;\ntc qdisc change dev X root hhf hh_limit 4294967295 succeeds and the\nvalue is echoed by tc qdisc show, unbounding heavy-hitter flow\nallocations; also tc qdisc add dev X root hhf hh_limit 500 stores 2048\ninstead of 500."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/sched/sch_hhf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"10239edf86f137ce4c39b62ea9575e8053c549a0","lessThan":"7adfd0a42174b85c6bd678858ecd6674f403f336","versionType":"git","status":"affected"},{"version":"10239edf86f137ce4c39b62ea9575e8053c549a0","lessThan":"35fd423a5c5132c6f4321f6c4f0a7b4b90af830c","versionType":"git","status":"affected"},{"version":"10239edf86f137ce4c39b62ea9575e8053c549a0","lessThan":"06d2a101e89063cb0b9b459104db48bdfb0a797d","versionType":"git","status":"affected"},{"version":"10239edf86f137ce4c39b62ea9575e8053c549a0","lessThan":"d8e2f1f0263b7c97b222c06070cccf13e0ab7112","versionType":"git","status":"affected"},{"version":"10239edf86f137ce4c39b62ea9575e8053c549a0","lessThan":"f3f4a5cb4a6e9b1f1f25d34dfc25f836a1601db4","versionType":"git","status":"affected"},{"version":"10239edf86f137ce4c39b62ea9575e8053c549a0","lessThan":"1731ff1d20489afe4cd01b7d16d37f324746ac54","versionType":"git","status":"affected"},{"version":"10239edf86f137ce4c39b62ea9575e8053c549a0","lessThan":"f6547d27ce2093c5627636fb63dd0b7523c466f9","versionType":"git","status":"affected"},{"version":"10239edf86f137ce4c39b62ea9575e8053c549a0","lessThan":"2cef2588c995722a901368def30befeef9ae55c6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/sched/sch_hhf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.14","status":"affected"},{"version":"0","lessThan":"3.14","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/06d2a101e89063cb0b9b459104db48bdfb0a797d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1731ff1d20489afe4cd01b7d16d37f324746ac54","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2cef2588c995722a901368def30befeef9ae55c6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/35fd423a5c5132c6f4321f6c4f0a7b4b90af830c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7adfd0a42174b85c6bd678858ecd6674f403f336","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d8e2f1f0263b7c97b222c06070cccf13e0ab7112","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f3f4a5cb4a6e9b1f1f25d34dfc25f836a1601db4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f6547d27ce2093c5627636fb63dd0b7523c466f9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98235","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:11.203","lastModified":"2026-10-19T10:18:24.340","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_api: release tail references on DELACTION failure\n\nA batched RTM_DELACTION request takes a temporary reference on each\naction before attempting any deletion. tcf_action_delete() clears\neach processed slot and drops its temporary reference before attempting\nthe deletion. If deletion fails, tca_action_gd() calls\ntcf_action_put_many() to release the remaining references, but its\ntcf_act_for_each_action() iterator stops at the first NULL slot.\n\nWhen a batch stops at an action bound to a filter, this leaks a\nreference on each subsequent action. A later delete of an unbound\naction can then return success without removing it from the IDR.\n\nWalk the full array in tcf_action_put_many() and skip NULL slots to\nrelease the references held on the unprocessed actions."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/sched/act_api.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a0e947c9ccffe47d45aca793d9e7fe4f4494e381","lessThan":"9eaba16f1b6ee19b249e6afd82c27f958d441458","versionType":"git","status":"affected"},{"version":"a0e947c9ccffe47d45aca793d9e7fe4f4494e381","lessThan":"1be63e4579af408d596f0f3165faf1a880631d3b","versionType":"git","status":"affected"},{"version":"a0e947c9ccffe47d45aca793d9e7fe4f4494e381","lessThan":"57b477e46ef2df3483f3488cc713c61c4b384aab","versionType":"git","status":"affected"},{"version":"a0e947c9ccffe47d45aca793d9e7fe4f4494e381","lessThan":"6e05e46fa821a5c1b281355f1f622ac76cb6080a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/sched/act_api.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1be63e4579af408d596f0f3165faf1a880631d3b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/57b477e46ef2df3483f3488cc713c61c4b384aab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e05e46fa821a5c1b281355f1f622ac76cb6080a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9eaba16f1b6ee19b249e6afd82c27f958d441458","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98236","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:11.340","lastModified":"2026-10-19T10:18:24.437","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wwan: mhi_wwan_mbim: check skb_copy_bits() return value\n\nmhi_mbim_rx() ignores the return value of skb_copy_bits() when it\ncopies each datagram out of the NTB.  The datagram offset and length\ncome from the DPE, which is only checked to lie within the NTB\nitself, so a modem can point a datagram outside the received skb.\nThe copy then fails and the freshly allocated skbn is passed to\nnetif_rx() with its uninitialized contents still in place, leaking\nkernel heap memory into the network stack.\n\nFree the skb and account an error when the copy fails.\n\n\nVerified in a QEMU guest with a fault injector pointing a DPE\noutside the received NTB: the copy fails, and the unpatched driver\nhands the uninitialized skbn to the network stack (observed as\n\"unknown protocol\" on bytes that were never written).  With this\ncheck the failed datagram is dropped and counted as an rx error.\n\nChanges in v2: factor the free-and-count sequence out into\nmhi_mbim_rx_drop(), shared with the unknown-protocol path, as\nsuggested by Loic Poulain."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wwan/mhi_wwan_mbim.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"aa730a9905b7b079ef2fffdab7f15dbb842f5c7c","lessThan":"650af68435eaee783824457d2ef78cc5c03c1e88","versionType":"git","status":"affected"},{"version":"aa730a9905b7b079ef2fffdab7f15dbb842f5c7c","lessThan":"350fd3125ee26b5243935fd9e2b4d162ffba430a","versionType":"git","status":"affected"},{"version":"aa730a9905b7b079ef2fffdab7f15dbb842f5c7c","lessThan":"dd136f1fdd1059f3bc25ede3a8def8f0ee151ce7","versionType":"git","status":"affected"},{"version":"aa730a9905b7b079ef2fffdab7f15dbb842f5c7c","lessThan":"298659c3677bf622afa9d77549cb4a967f9541e9","versionType":"git","status":"affected"},{"version":"aa730a9905b7b079ef2fffdab7f15dbb842f5c7c","lessThan":"02eba5f36d20283f144f75d47f0354a85e4f78f0","versionType":"git","status":"affected"},{"version":"aa730a9905b7b079ef2fffdab7f15dbb842f5c7c","lessThan":"7e98216e9da08b79e07a514d2a4f7646f8c9ccb9","versionType":"git","status":"affected"},{"version":"aa730a9905b7b079ef2fffdab7f15dbb842f5c7c","lessThan":"31550d585589fde1ae95bf7f7a8188b2d2fdf1c7","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wwan/mhi_wwan_mbim.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/02eba5f36d20283f144f75d47f0354a85e4f78f0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/298659c3677bf622afa9d77549cb4a967f9541e9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/31550d585589fde1ae95bf7f7a8188b2d2fdf1c7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/350fd3125ee26b5243935fd9e2b4d162ffba430a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/650af68435eaee783824457d2ef78cc5c03c1e88","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7e98216e9da08b79e07a514d2a4f7646f8c9ccb9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dd136f1fdd1059f3bc25ede3a8def8f0ee151ce7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98237","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:11.500","lastModified":"2026-10-19T10:18:24.543","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain\n\nThe NDP traversal in mhi_mbim_rx() only stops when wNextNdpIndex is\nzero.  Nothing requires the offsets to advance, so a modem that\npoints an NDP at itself, or at an earlier NDP, keeps the loop\nspinning forever on one CPU.\n\nBreak out when the next NDP offset is not larger than the current\none.\n\n\nVerified in a QEMU guest with a fault injector feeding the driver's\nreceive callback an NTB whose single NDP points at itself: the\nunpatched driver spins in mhi_mbim_rx() with one CPU pinned at 100%\nand the thread never returns.  With this check the loop terminates\nwithin one iteration.\n\nChanges in v2: move the non-increasing check to the wNextNdpIndex\nretrieval site, as suggested by Loic Poulain, instead of tracking\nthe previous offset in a separate variable."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wwan/mhi_wwan_mbim.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"aa730a9905b7b079ef2fffdab7f15dbb842f5c7c","lessThan":"3ed36ee1b29b028f6bc2ebe100152f61a33df05a","versionType":"git","status":"affected"},{"version":"aa730a9905b7b079ef2fffdab7f15dbb842f5c7c","lessThan":"e4b2c7b50d4f4aa1ddfff731b136d65f65b2b526","versionType":"git","status":"affected"},{"version":"aa730a9905b7b079ef2fffdab7f15dbb842f5c7c","lessThan":"19b5e8dd884a530d04482e1a8e547f43cad17ed7","versionType":"git","status":"affected"},{"version":"aa730a9905b7b079ef2fffdab7f15dbb842f5c7c","lessThan":"24ade82d6d993274e99c2c6998848751c35292e7","versionType":"git","status":"affected"},{"version":"aa730a9905b7b079ef2fffdab7f15dbb842f5c7c","lessThan":"8dad70ff7e25cbcfbcb5101fdbf36d98003eb653","versionType":"git","status":"affected"},{"version":"aa730a9905b7b079ef2fffdab7f15dbb842f5c7c","lessThan":"829fec45122da58d77a55a3b7ca514dafab98e77","versionType":"git","status":"affected"},{"version":"aa730a9905b7b079ef2fffdab7f15dbb842f5c7c","lessThan":"5d063822ac5184939c1ed377a339a01d8ae814e8","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wwan/mhi_wwan_mbim.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/19b5e8dd884a530d04482e1a8e547f43cad17ed7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/24ade82d6d993274e99c2c6998848751c35292e7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3ed36ee1b29b028f6bc2ebe100152f61a33df05a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5d063822ac5184939c1ed377a339a01d8ae814e8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/829fec45122da58d77a55a3b7ca514dafab98e77","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8dad70ff7e25cbcfbcb5101fdbf36d98003eb653","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e4b2c7b50d4f4aa1ddfff731b136d65f65b2b526","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98238","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:11.657","lastModified":"2026-10-19T10:18:24.650","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()\n\nThe netif index carried in the DPMAIF PIT header is five bits wide,\nbut ccmni_inst[] only has room for NIC_DEV_MAX (21) entries.\nt7xx_ccmni_recv_skb() indexes the array without a bounds check, so\nindexes 21 to 31 read past it.  The out-of-bounds value lands in the\ncallback table that follows the array, which is never NULL, so the\nexisting !ccmni check does not catch it and the driver dereferences\nwhatever sits there as a struct t7xx_ccmni.\n\nDrop the skb when the index is out of range.\n\n\nVerified in a QEMU guest with a fault injector setting the netif\nindex to 25: the unpatched driver reads a value past ccmni_inst[],\nwhich lands in the callback table, and dereferences it far enough to\nqueue the skb.  With this check the packet is dropped.  Well-formed\ntraffic on index 0 is unaffected.\n\nChanges in v2: none."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wwan/t7xx/t7xx_netdev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"05d19bf500f8281f574713479b04679fa226d0a3","lessThan":"7c2fe308bda5a7e6222d7f0c3c311991372baab4","versionType":"git","status":"affected"},{"version":"05d19bf500f8281f574713479b04679fa226d0a3","lessThan":"fba45070e25abdae08bcaebfadeef050dc39e208","versionType":"git","status":"affected"},{"version":"05d19bf500f8281f574713479b04679fa226d0a3","lessThan":"e1b0609b1a40da03e385be290853a604eb4c3fb9","versionType":"git","status":"affected"},{"version":"05d19bf500f8281f574713479b04679fa226d0a3","lessThan":"9dbf13de4edff6fbc1f7ad9c4040326b6ed599ad","versionType":"git","status":"affected"},{"version":"05d19bf500f8281f574713479b04679fa226d0a3","lessThan":"d28aa2de9654e8024922775520a2665e00c04ad5","versionType":"git","status":"affected"},{"version":"05d19bf500f8281f574713479b04679fa226d0a3","lessThan":"c7ead9704249d57d4693a04697e3bbd285138fa9","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wwan/t7xx/t7xx_netdev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.19","status":"affected"},{"version":"0","lessThan":"5.19","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/7c2fe308bda5a7e6222d7f0c3c311991372baab4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9dbf13de4edff6fbc1f7ad9c4040326b6ed599ad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c7ead9704249d57d4693a04697e3bbd285138fa9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d28aa2de9654e8024922775520a2665e00c04ad5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e1b0609b1a40da03e385be290853a604eb4c3fb9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fba45070e25abdae08bcaebfadeef050dc39e208","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98239","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:11.803","lastModified":"2026-10-19T10:18:24.750","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lan743x: fix RX checksum use-after-free\n\nlan743x_rx_process_buffer() adds each non-first receive buffer to the\nhead skb's frag_list.  On the last descriptor, lan743x_rx_trim_skb()\nlinearizes the head and frees the fragment skb metadata.\n\nThe checksum-success path then writes ip_summed through the local skb\npointer, which still points to the final fragment.  This causes a\nuse-after-free write when a packet spans more than one receive buffer.\n\nSet ip_summed on the surviving head skb instead.  Multi-buffer receive\ncan occur after a live MTU increase because existing ring entries keep\ntheir old buffer size until they are replenished.\n\nA KUnit test invoking lan743x_rx_process_buffer() with a two-buffer\npacket produced a one-byte KASAN use-after-free write before this change.\nThe same test passed after the change.  The driver object also builds\nwith W=1.  This was not tested on physical LAN743x hardware."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/microchip/lan743x_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a","lessThan":"0e52886c4324c9897c2c62f92be3dc8316cee67e","versionType":"git","status":"affected"},{"version":"cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a","lessThan":"a58024835c704419bb46d2a34e5223f65605f958","versionType":"git","status":"affected"},{"version":"cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a","lessThan":"6fe5c3a2503983abb431d93faeadfc7f5e6a7e33","versionType":"git","status":"affected"},{"version":"cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a","lessThan":"5c216bfa9fb7b36804485e67975e9c98055b31ef","versionType":"git","status":"affected"},{"version":"cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a","lessThan":"161a403c8625e152de03d1da22bbf9cda6dc9f9f","versionType":"git","status":"affected"},{"version":"cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a","lessThan":"a9ce4053dc945c5372dedba5017ee675b30dc0c5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/microchip/lan743x_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.1","status":"affected"},{"version":"0","lessThan":"6.1","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0e52886c4324c9897c2c62f92be3dc8316cee67e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/161a403c8625e152de03d1da22bbf9cda6dc9f9f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5c216bfa9fb7b36804485e67975e9c98055b31ef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6fe5c3a2503983abb431d93faeadfc7f5e6a7e33","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a58024835c704419bb46d2a34e5223f65605f958","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a9ce4053dc945c5372dedba5017ee675b30dc0c5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98240","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:11.960","lastModified":"2026-10-19T10:18:24.877","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ip_tunnel: initialize `options_len` before referencing options\n\nThe following command triggers a kernel panic:\n\n  ip link add d0 type dummy; ip link set d0 up\n  ip route add 10.30.0.0/16 \\\n    encap ip id 300 geneve_opts 4660:66:11223344 dev d0\n\n  memcpy: detected buffer overflow: 4 byte write of buffer size 0\n  kernel BUG at lib/string_helpers.c:1044!\n  ...\n  ip_tun_parse_opts.part.0.cold+0x10/0x10\n  ip_tun_build_state+0x116/0x2a0\n\nOn kernels built with GCC 15+ and `CONFIG_FORTIFY_SOURCE`, the fortified\n`memcpy()` got 0 sized destination with request of 4 bytes length:\n\n  static int ip_tun_parse_opts_geneve(...)\n  {\n      ...\n      attr = tb[LWTUNNEL_IP_OPT_GENEVE_DATA];\n      data_len = nla_len(attr); /* == 4 */\n\n      struct geneve_opt *opt = ip_tunnel_info_opts(info) + opts_len;\n      memcpy(opt->opt_data, nla_data(attr), data_len);\n      /*     ^^^^^^^^^^^^^ 0 since options_len is assigned afterwards */\n\nFixed by initializing the counter before the options are referenced.\nMatching what `tunnel_key_opts_set()` already does."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv4/ip_tunnel_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bb5e62f2d547c4de6d1b144cbce2373a76c33f18","lessThan":"9907325257b4b382f26aafd5d9a8d47915907dd5","versionType":"git","status":"affected"},{"version":"bb5e62f2d547c4de6d1b144cbce2373a76c33f18","lessThan":"0f6a6beb01c068fcd5274eabf22c260039749fea","versionType":"git","status":"affected"},{"version":"bb5e62f2d547c4de6d1b144cbce2373a76c33f18","lessThan":"455ebeadf714f51e1dbbd6a022c74c9215b1cd76","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv4/ip_tunnel_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0f6a6beb01c068fcd5274eabf22c260039749fea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/455ebeadf714f51e1dbbd6a022c74c9215b1cd76","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9907325257b4b382f26aafd5d9a8d47915907dd5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98241","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:12.090","lastModified":"2026-10-19T10:18:24.967","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: xfrm: use full sockets in local error paths\n\nxfrm6_local_rxpmtu() and xfrm6_local_error() dereference skb->sk as if it\nalways pointed at a full IPv6 socket.\n\nThat is not guaranteed. TCP SYN-ACK skbs can be owned by a\nTCP_NEW_SYN_RECV request_sock while the output path itself is driven by the\nfull listener. If rerouting selects an IPv6 XFRM tunnel route with a lower\nMTU, the local PMTU/error handling path can reach these callbacks with that\nmini-socket still attached to the skb.\n\nThe callbacks then miscast the request socket as a full inet/IPv6 socket and\ncan read beyond the request_sock allocation when they access inet_sock or\nipv6_pinfo state.\n\nResolve the owner with skb_to_full_sk() in both callbacks and bail out when\nno full socket is attached. This matches the surrounding XFRM IPv6 PMTU/error\nlogic, which already reasons about full sockets with skb_to_full_sk()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv6/xfrm6_output.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"dd767856a36e00b631d65ebc4bb81b19915532d6","lessThan":"b1a88633c36d2cbc3831382f3846754d344276fd","versionType":"git","status":"affected"},{"version":"dd767856a36e00b631d65ebc4bb81b19915532d6","lessThan":"904a0e827d0d7189271a3a2eb648293809f25efc","versionType":"git","status":"affected"},{"version":"dd767856a36e00b631d65ebc4bb81b19915532d6","lessThan":"675919e08ce266b8cac11fd9af29170e762a480f","versionType":"git","status":"affected"},{"version":"dd767856a36e00b631d65ebc4bb81b19915532d6","lessThan":"60459c670329d586a58db5d8f811fa5accfe4862","versionType":"git","status":"affected"},{"version":"dd767856a36e00b631d65ebc4bb81b19915532d6","lessThan":"ca3d68c3213475b53db6647e159dc73bd1af5ab1","versionType":"git","status":"affected"},{"version":"dd767856a36e00b631d65ebc4bb81b19915532d6","lessThan":"4c030a0400ebfd2318361c923a88103b2c67c49f","versionType":"git","status":"affected"},{"version":"dd767856a36e00b631d65ebc4bb81b19915532d6","lessThan":"c21f3f7fbfeda7c5794f606cb0ffcc2d9001eef8","versionType":"git","status":"affected"},{"version":"dd767856a36e00b631d65ebc4bb81b19915532d6","lessThan":"6973a21ee73c5567f883813c8ef414774b45892f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv6/xfrm6_output.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.2","status":"affected"},{"version":"0","lessThan":"3.2","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/4c030a0400ebfd2318361c923a88103b2c67c49f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/60459c670329d586a58db5d8f811fa5accfe4862","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/675919e08ce266b8cac11fd9af29170e762a480f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6973a21ee73c5567f883813c8ef414774b45892f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/904a0e827d0d7189271a3a2eb648293809f25efc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b1a88633c36d2cbc3831382f3846754d344276fd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c21f3f7fbfeda7c5794f606cb0ffcc2d9001eef8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ca3d68c3213475b53db6647e159dc73bd1af5ab1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98242","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:12.253","lastModified":"2026-10-19T10:18:25.103","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndma-buf: Fix silent overflow for phys vec to sgt\n\nIn case MMIO size is bigger than 4G and peer2peer DMA goes\nthrough host bridge, we trigger a code path that assigns the\ntotal linked IOVA (which is greater than 4G) to mapped_len.\n\nPreviously, `mapped_len` was declared as 32-bit `unsigned int`.\nWhen accumulating `size_t` lengths, this leads to a silent wrap-around.\nThis truncation causes truncated lengths to be passed to functions\nlike `fill_sg_entry()`.\n\nFix this by changing `mapped_len` to `size_t` (64-bit). While\nat it, fix similar potential overflow issues in `calc_sg_nents`\nby using `check_add_overflow()` for `nents` and using\n`unsigned int` for the loop iterator in `fill_sg_entry` to match."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/dma-buf/dma-buf-mapping.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3aa31a8bb11e47c0ff2b306988d1756b810c1c3c","lessThan":"6b98fd7106d4e486f432664893dcd4d6fa3a9693","versionType":"git","status":"affected"},{"version":"3aa31a8bb11e47c0ff2b306988d1756b810c1c3c","lessThan":"b344ca94e8cc85796f16ea25e2e5a8e0303fe813","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/dma-buf/dma-buf-mapping.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/6b98fd7106d4e486f432664893dcd4d6fa3a9693","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b344ca94e8cc85796f16ea25e2e5a8e0303fe813","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98243","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:12.383","lastModified":"2026-10-19T10:18:25.193","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3\n\nThe patch \"dma-buf: dma-fence: Fix potential NULL pointer dereference\"\nchanged the check to test for the ops pointer instead of the signaled\nbit to avoid a potential NULL dereference when the ops pointer has been\ncleared.\n\nThe problem is now that the ops pointer is cleared only when neither the\nrelease nor the wait callback is implemented and this isn't true for a lot\nof dma_fence implementations yet. So those implementations lost the RCU\nprotection after signaling of the returned string resulting in potential\nuse after free.\n\nAdd the signaling check additional to the ops pointer check so that we\nhave both the protection against NULL dereference as well as the RCU\nprotection after signaling for the returned string.\n\nv2: improve comments to note RCU protection and explain why we check\n    both signaling state and ops pointer\nv3: some comment improvements suggested by Philip"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/dma-buf/dma-fence.c","include/linux/dma-fence.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"035219a760edb35ae9a9e96beba7f122e26a997b","lessThan":"a4db25b8949d6ff9c1a685a1273a015e8bab29db","versionType":"git","status":"affected"},{"version":"035219a760edb35ae9a9e96beba7f122e26a997b","lessThan":"3ed11c671ff7ec58c8fd96410233c677df23f407","versionType":"git","status":"affected"},{"version":"15ecfdf0ef6f6d874d0a26690d300857b39ebfd0","versionType":"git","status":"affected"},{"version":"7.1.5","lessThan":"7.2","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/dma-buf/dma-fence.c","include/linux/dma-fence.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.2","status":"affected"},{"version":"0","lessThan":"7.2","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/3ed11c671ff7ec58c8fd96410233c677df23f407","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a4db25b8949d6ff9c1a685a1273a015e8bab29db","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98244","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:12.510","lastModified":"2026-10-19T10:18:25.303","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: clear free space tree creation state on rebuild failure\n\nbtrfs_rebuild_free_space_tree() sets BTRFS_FS_CREATING_FREE_SPACE_TREE\nbefore rebuilding the free space tree.  Several error paths return\nwithout clearing this flag.\n\nThe transaction restart failure path can leave the flag set on a live\nfilesystem, causing delayed reference processing to be skipped. Clear it\non all free space tree rebuild failure paths. Keep\nBTRFS_FS_FREE_SPACE_TREE_UNTRUSTED set, since a failed rebuild leaves\nthe free space tree untrusted. Callers must fall back to extent-tree\ncaching."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/btrfs/free-space-tree.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"882af9f13e830c0a4ef696bb72cd5998a5067a93","lessThan":"a32bedab8ece9d1f90a1476a5b486a1804dc78ba","versionType":"git","status":"affected"},{"version":"882af9f13e830c0a4ef696bb72cd5998a5067a93","lessThan":"b1df2997d0cd2be7bef7b4ab64ccfd1019dedc81","versionType":"git","status":"affected"},{"version":"882af9f13e830c0a4ef696bb72cd5998a5067a93","lessThan":"3565893cc72cdf6b795cf6a33e7ff9605322334d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/btrfs/free-space-tree.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.14","status":"affected"},{"version":"0","lessThan":"6.14","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3565893cc72cdf6b795cf6a33e7ff9605322334d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a32bedab8ece9d1f90a1476a5b486a1804dc78ba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b1df2997d0cd2be7bef7b4ab64ccfd1019dedc81","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98245","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:12.643","lastModified":"2026-10-21T13:21:25.683","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: take commit root semaphore when iterating in mark_block_group_to_copy()\n\nmark_block_group_to_copy() iterates over the commit root with\nskip_locking=true. A concurrent transaction commit can swap and free\nthe commit root during iteration, causing use-after-free when\naccessing extent buffers.\n\nFix it by using path->need_commit_sem to protect the commit root search."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/btrfs/dev-replace.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"78ce9fc269af6e69c1399ab910ba6bc81c934f67","lessThan":"93a025166495c63ba5b8ac721c7040d5312e8335","versionType":"git","status":"affected"},{"version":"78ce9fc269af6e69c1399ab910ba6bc81c934f67","lessThan":"8e2007b263ea250251ec3021a0a197da990ee1a8","versionType":"git","status":"affected"},{"version":"78ce9fc269af6e69c1399ab910ba6bc81c934f67","lessThan":"709f6a5e986535005110c6c69b322f63631cb200","versionType":"git","status":"affected"},{"version":"78ce9fc269af6e69c1399ab910ba6bc81c934f67","lessThan":"c32490c6d3f3a9f2d177d57c7eb8bbc347561d08","versionType":"git","status":"affected"},{"version":"78ce9fc269af6e69c1399ab910ba6bc81c934f67","lessThan":"0594e3423f4ba3137c734371169491f9a98e9af4","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/btrfs/dev-replace.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.12","status":"affected"},{"version":"0","lessThan":"5.12","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0594e3423f4ba3137c734371169491f9a98e9af4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/709f6a5e986535005110c6c69b322f63631cb200","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8e2007b263ea250251ec3021a0a197da990ee1a8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/93a025166495c63ba5b8ac721c7040d5312e8335","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c32490c6d3f3a9f2d177d57c7eb8bbc347561d08","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98246","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:12.783","lastModified":"2026-10-19T10:18:25.497","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Serialize local codec list cleanup\n\nhci_dev_close_sync() clears hdev->local_codecs after releasing hdev->lock.\nCodec list additions and both traversals in sco_sock_getsockopt() use that\nlock, but the close path does not. A close and BT_CODEC query can therefore\ninterleave as follows:\n\n  hci_dev_close_sync()          sco_sock_getsockopt()\n                                hci_dev_lock()\n                                fetch codec entry\n  hci_codec_list_clear()\n    kfree(entry)\n                                read entry->id\n\nThe reader then accesses an entry which the close path has freed. KASAN\n\n  BUG: KASAN: slab-use-after-free in sco_sock_getsockopt+0xfa0/0xfe0\n  Read of size 1 at addr ffff8881001c3450\n  Call Trace:\n   sco_sock_getsockopt+0xfa0/0xfe0\n   do_sock_getsockopt+0x537/0x7b0\n   __sys_getsockopt+0xf2/0x170\n  Allocated by task 92:\n   hci_codec_list_add.isra.0+0x2c/0x440\n   hci_read_codec_capabilities+0x224/0x590\n   hci_read_supported_codecs+0x2c2/0x640\n  Freed by task 92:\n   kfree+0x131/0x3c0\n   hci_codec_list_clear+0xd8/0x160\n   hci_dev_close_sync+0x92a/0xfa0\n\nTake hdev->lock around the clear operation at its existing point in the\nclose path. This makes the clear wait for active readers and prevents a new\ntraversal until the list is empty without changing teardown ordering."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/hci_sync.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"626535077ba9dc110787540d1fe24881094c15a1","lessThan":"9f407d52c0d881430d689836d3e7d32aa36f98b5","versionType":"git","status":"affected"},{"version":"b938790e70540bf4f2e653dcd74b232494d06c8f","lessThan":"560ed4373c06a58123ecdf9ad5ecaddc87a73382","versionType":"git","status":"affected"},{"version":"b938790e70540bf4f2e653dcd74b232494d06c8f","lessThan":"1ee0c5429dc4a92879bda2554b1bfd4abc6c587c","versionType":"git","status":"affected"},{"version":"b938790e70540bf4f2e653dcd74b232494d06c8f","lessThan":"4dc1ae5ff75b17e17ec4b74b11cc4b0099e71e00","versionType":"git","status":"affected"},{"version":"b938790e70540bf4f2e653dcd74b232494d06c8f","lessThan":"1276c2fafd18499769a28f96f45c5a76d6fc990e","versionType":"git","status":"affected"},{"version":"b938790e70540bf4f2e653dcd74b232494d06c8f","lessThan":"9a10987a2f160a44a638c9a35994ca6e3089696e","versionType":"git","status":"affected"},{"version":"eea5a8f0c3b7c884d2351e75fbdd0a3d7def5ae1","versionType":"git","status":"affected"},{"version":"6.1.57","lessThan":"6.1.189","versionType":"semver","status":"affected"},{"version":"6.5.7","lessThan":"6.6","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/hci_sync.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1276c2fafd18499769a28f96f45c5a76d6fc990e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1ee0c5429dc4a92879bda2554b1bfd4abc6c587c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4dc1ae5ff75b17e17ec4b74b11cc4b0099e71e00","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/560ed4373c06a58123ecdf9ad5ecaddc87a73382","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9a10987a2f160a44a638c9a35994ca6e3089696e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9f407d52c0d881430d689836d3e7d32aa36f98b5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98247","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:12.940","lastModified":"2026-10-19T10:18:25.610","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_codec: validate vendor codec count length\n\nThe Read Local Supported Codecs parsers consume the variable-sized\nstandard codec array before parsing the vendor codec count.  Although the\ninitial reply-size check includes a vendor count byte in the fixed layout,\nit does not guarantee that the byte remains after the standard codec array.\n\nIf a controller reply ends immediately after that array, calculating the\nvendor codec array size reads vnd_codecs->num beyond the skb data.  Use\nskb_pull_data() to validate and consume each codec header before using its\ncount in both command variants."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/hci_codec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8961987f3f5fa2f2618e72304d013c8dd5e604a6","lessThan":"9c04b9a4d08b95dee901d24b7607c4cbd65fa0a8","versionType":"git","status":"affected"},{"version":"8961987f3f5fa2f2618e72304d013c8dd5e604a6","lessThan":"a6da782fefae611e68a1aa79644065fc8ca5abcd","versionType":"git","status":"affected"},{"version":"8961987f3f5fa2f2618e72304d013c8dd5e604a6","lessThan":"e4cfd3c4299105237458b27958bd7b0aa4c60795","versionType":"git","status":"affected"},{"version":"8961987f3f5fa2f2618e72304d013c8dd5e604a6","lessThan":"f49a543d76d48f184b34225d9c0e2fc4cbdea8ec","versionType":"git","status":"affected"},{"version":"8961987f3f5fa2f2618e72304d013c8dd5e604a6","lessThan":"12a82819b0cada6e304790b1097f8f9006eb6123","versionType":"git","status":"affected"},{"version":"8961987f3f5fa2f2618e72304d013c8dd5e604a6","lessThan":"d0795cfd6f655f4de84868a4f4bb41a03f037b3d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/hci_codec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.16","status":"affected"},{"version":"0","lessThan":"5.16","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/12a82819b0cada6e304790b1097f8f9006eb6123","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9c04b9a4d08b95dee901d24b7607c4cbd65fa0a8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a6da782fefae611e68a1aa79644065fc8ca5abcd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d0795cfd6f655f4de84868a4f4bb41a03f037b3d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e4cfd3c4299105237458b27958bd7b0aa4c60795","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f49a543d76d48f184b34225d9c0e2fc4cbdea8ec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98248","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:13.143","lastModified":"2026-10-19T10:18:25.707","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64: percpu: Fix LSE operations on {8,16}-bit types\n\nThe assembly for __percpu_##name##_case_##sz() and\n__percpu_##name##_return_case_##sz() doesn't use the 'sfx' macro\nargument to form the LSE instruction. Without 'sfx', a W register\nargument will imply a 32-bit memory location, and consequently\n{8,16}-bit ops will erroneously read and write 32 bits of memory when\nthe LSE instruction is used.\n\nFix this by appending 'sfx' to 'op_lse' to LSE instruction. It is not\nnecessary (and not valid) to append 'sfx' to 'op_llsc', as 'op_llsc' is\na register-register operation which does not access memory (and does not\ntake a size suffix)."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/arm64/include/asm/percpu.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"959bf2fd03b59fc107584c21425f3dc73c49f762","lessThan":"d69ab4480e49bf925f4781afcc9f284affcb96b6","versionType":"git","status":"affected"},{"version":"959bf2fd03b59fc107584c21425f3dc73c49f762","lessThan":"390742871a723b52de9b92a94c0d1c85a2531e3e","versionType":"git","status":"affected"},{"version":"959bf2fd03b59fc107584c21425f3dc73c49f762","lessThan":"843ace1d0a39e9b1cfcbfb3856a7b0fbdd9cd003","versionType":"git","status":"affected"},{"version":"959bf2fd03b59fc107584c21425f3dc73c49f762","lessThan":"8cf2093f5372952a9ebc805c418d45df7112cd14","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/arm64/include/asm/percpu.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.0","status":"affected"},{"version":"0","lessThan":"5.0","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/390742871a723b52de9b92a94c0d1c85a2531e3e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/843ace1d0a39e9b1cfcbfb3856a7b0fbdd9cd003","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8cf2093f5372952a9ebc805c418d45df7112cd14","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d69ab4480e49bf925f4781afcc9f284affcb96b6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98249","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:13.290","lastModified":"2026-10-19T10:18:25.797","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc\n\nswsusp_arch_suspend_exit() reinstalls the restored kernel's hyp stub\nvectors with an hvc, but never passes the arguments. x0 is not set to\nHVC_SET_VECTORS and x1 is not set to the vector address, so the stub\ndispatch falls through and returns without writing vbar_el2. EL2 is\nleft pointing at the trans_pgd copy of the vectors, a page that\nswsusp_free() releases right after resume.\n\nSet the arguments up the same way __hyp_set_vectors() does.\n\nWithout this fix, Vladimir was able to trigger a hang when resuming from\nhibernation with CONFIG_PAGE_POISONING=y and page_poison=on."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/arm64/kernel/hibernate-asm.S"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"788bfdd97434982b6d575062581e8e72eea755af","lessThan":"6646418d1032cac25110526161f60d255ed08397","versionType":"git","status":"affected"},{"version":"788bfdd97434982b6d575062581e8e72eea755af","lessThan":"909e92423db7299e0206232051aa21fe129f65d0","versionType":"git","status":"affected"},{"version":"788bfdd97434982b6d575062581e8e72eea755af","lessThan":"60a3c319f1127c4d247d4ed235c5d65376d5e745","versionType":"git","status":"affected"},{"version":"788bfdd97434982b6d575062581e8e72eea755af","lessThan":"e80ea8118a073a30ebe7a31bd78938c2b1751acc","versionType":"git","status":"affected"},{"version":"788bfdd97434982b6d575062581e8e72eea755af","lessThan":"d3f8f773312af69eaf4dda106d76d6d42e4362e5","versionType":"git","status":"affected"},{"version":"788bfdd97434982b6d575062581e8e72eea755af","lessThan":"955d86e5f3b95b731991fdb84966c50b16314629","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/arm64/kernel/hibernate-asm.S"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.16","status":"affected"},{"version":"0","lessThan":"5.16","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/60a3c319f1127c4d247d4ed235c5d65376d5e745","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6646418d1032cac25110526161f60d255ed08397","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/909e92423db7299e0206232051aa21fe129f65d0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/955d86e5f3b95b731991fdb84966c50b16314629","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d3f8f773312af69eaf4dda106d76d6d42e4362e5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e80ea8118a073a30ebe7a31bd78938c2b1751acc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98250","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:13.437","lastModified":"2026-10-19T10:18:25.897","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix handling of NFSEXP_PNFS in the netlink codepath\n\nThe rework of how block layouts were checked moved the check for\nNFSEXP_PNFS out of nfsd4_setup_layout_type() and into the callers. That\npatch didn't account for the new call in nfsd4_setup_layout_type()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/nfsd/export.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"da9baa5470dcb077a7c9806f0925c60b530c470b","lessThan":"30335038d4e25cf017abb0562f4f4eace4f58f96","versionType":"git","status":"affected"},{"version":"da9baa5470dcb077a7c9806f0925c60b530c470b","lessThan":"f76017a7663c4ce5e379f8a8d39f032bdb1fd865","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/nfsd/export.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.2","status":"affected"},{"version":"0","lessThan":"7.2","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/30335038d4e25cf017abb0562f4f4eace4f58f96","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f76017a7663c4ce5e379f8a8d39f032bdb1fd865","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98251","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:13.567","lastModified":"2026-10-19T10:18:25.987","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: avoid reallocating confirmed conntrack labels\n\novs_ct_get_conn_labels() adds the labels extension when a conntrack\nentry does not have one.  Confirmed conntracks can be read locklessly,\nso adding an extension may reallocate and free the extension block\nwhile another CPU accesses it.\n\nOnly add the extension for unconfirmed conntracks.  A confirmed\nconntrack without labels now fails the caller's label operation instead\nof reallocating its extension storage."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/openvswitch/conntrack.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c2ac667358708d7cce64c78f58af6adf4c1e848b","lessThan":"4371d79ea74407fb992c985b1f94391e35bb8289","versionType":"git","status":"affected"},{"version":"c2ac667358708d7cce64c78f58af6adf4c1e848b","lessThan":"7ff688aceada1160331a789385ea146f62fbddf7","versionType":"git","status":"affected"},{"version":"c2ac667358708d7cce64c78f58af6adf4c1e848b","lessThan":"05eab8dced6bf4d3009a6eeee16ddac99047dc83","versionType":"git","status":"affected"},{"version":"c2ac667358708d7cce64c78f58af6adf4c1e848b","lessThan":"579d87ec1e1e85729a6cb2c25961e58beb78640c","versionType":"git","status":"affected"},{"version":"c2ac667358708d7cce64c78f58af6adf4c1e848b","lessThan":"2e6dd889c325abf23821e1459c3ffef59b7f0009","versionType":"git","status":"affected"},{"version":"c2ac667358708d7cce64c78f58af6adf4c1e848b","lessThan":"d16f089bd700f45d720ce989d5495e1dc3be0cf8","versionType":"git","status":"affected"},{"version":"c2ac667358708d7cce64c78f58af6adf4c1e848b","lessThan":"8c9fcc6c33950d3db551af664d1fd3d998bfee56","versionType":"git","status":"affected"},{"version":"c2ac667358708d7cce64c78f58af6adf4c1e848b","lessThan":"3f118c8217c109fd13ca61caa301d72c483897ef","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/openvswitch/conntrack.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.3","status":"affected"},{"version":"0","lessThan":"4.3","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/05eab8dced6bf4d3009a6eeee16ddac99047dc83","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2e6dd889c325abf23821e1459c3ffef59b7f0009","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3f118c8217c109fd13ca61caa301d72c483897ef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4371d79ea74407fb992c985b1f94391e35bb8289","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/579d87ec1e1e85729a6cb2c25961e58beb78640c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7ff688aceada1160331a789385ea146f62fbddf7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8c9fcc6c33950d3db551af664d1fd3d998bfee56","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d16f089bd700f45d720ce989d5495e1dc3be0cf8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98252","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:13.723","lastModified":"2026-10-19T10:18:26.110","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: fix refcount bug in iwpm_get_nlmsg_request()\n\niwpm_get_nlmsg_request() initializes refcount _after_ list_add_tail()\nmaking it accessible to global list where another CPU can kref_get()\non nlmsg_request causing a refcount \"addition on 0\" bug. Fix this\nby initializing kref _before_ list_add_tail() so refcount for\nnlmsg_request can be incremented/decremented normally. In addition,\nalso initialize every field before list_add_tail()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/core/iwpm_util.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"30dc5e63d6a5ad24894b5512d10b228d73645a44","lessThan":"52c13c63bb3662c108244e7447055e30bf40244e","versionType":"git","status":"affected"},{"version":"30dc5e63d6a5ad24894b5512d10b228d73645a44","lessThan":"8a91609032d47e77bcb37bc8f6e88d89340d2709","versionType":"git","status":"affected"},{"version":"30dc5e63d6a5ad24894b5512d10b228d73645a44","lessThan":"ce8a379598bd4058081416abea4279fd05a95374","versionType":"git","status":"affected"},{"version":"30dc5e63d6a5ad24894b5512d10b228d73645a44","lessThan":"2fbac8a56004b6ce54fbfe845d4b25da6e0b55e8","versionType":"git","status":"affected"},{"version":"30dc5e63d6a5ad24894b5512d10b228d73645a44","lessThan":"88e429a4e9bac3d2138011c5ca06254331f2587f","versionType":"git","status":"affected"},{"version":"30dc5e63d6a5ad24894b5512d10b228d73645a44","lessThan":"e15eb536be4f646ce683d2867572b2200be877f7","versionType":"git","status":"affected"},{"version":"30dc5e63d6a5ad24894b5512d10b228d73645a44","lessThan":"117871cdb8927542abd7b65ce5995bf0265a8c05","versionType":"git","status":"affected"},{"version":"30dc5e63d6a5ad24894b5512d10b228d73645a44","lessThan":"33fb59da49c4c3f5c2ec9f9d4447a56857a02c02","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/core/iwpm_util.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.16","status":"affected"},{"version":"0","lessThan":"3.16","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/117871cdb8927542abd7b65ce5995bf0265a8c05","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2fbac8a56004b6ce54fbfe845d4b25da6e0b55e8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/33fb59da49c4c3f5c2ec9f9d4447a56857a02c02","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/52c13c63bb3662c108244e7447055e30bf40244e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/88e429a4e9bac3d2138011c5ca06254331f2587f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8a91609032d47e77bcb37bc8f6e88d89340d2709","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ce8a379598bd4058081416abea4279fd05a95374","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e15eb536be4f646ce683d2867572b2200be877f7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98253","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:13.887","lastModified":"2026-10-19T10:18:26.240","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/ucma: Serialize join and leave on copy_to_user failure\n\nrdma_join_multicast() queues RoCE work that later reads the ucma_multicast\nthrough event->param.ud.private_data, then list_add()s the CMA multicast\nat the head of id_priv->mc_list. rdma_leave_multicast() matches only by\nsockaddr and destroys the first hit.\n\nucma_process_join() used to drop ctx->mutex after a successful join and\nretake it only if copy_to_user() failed. Two concurrent JOIN_MCAST calls\nwith the same address can therefore insert a second CMA entry before the\nfirst thread's leave. leave then cancels the newer work and the older\nworker still dereferences the ucma_multicast that the first thread frees.\n\nKeep ctx->mutex held from rdma_join_multicast() through copy_to_user() and,\non -EFAULT, through rdma_leave_multicast() so leave cannot miss this join.\nDo not leave if join itself failed: that path never published this address\non mc_list, and a leave-by-addr would destroy an earlier successful join."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/core/ucma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"60d613b39e8d0c9f3b526e9c96445422b4562d76","lessThan":"29b9ed83d8bfab5c6e11fcbf1aa836aa4ae26cb9","versionType":"git","status":"affected"},{"version":"fe454dc31e84f8c14cb8942fcb61666c9f40745b","lessThan":"52172e11bd074ccaded21740ffeb67123f01dd00","versionType":"git","status":"affected"},{"version":"fe454dc31e84f8c14cb8942fcb61666c9f40745b","lessThan":"01e29d0d78a8f66f221625720a04939eef5ec1f6","versionType":"git","status":"affected"},{"version":"fe454dc31e84f8c14cb8942fcb61666c9f40745b","lessThan":"ae805d204cf1f15b87d1bf3529b4c649f3519420","versionType":"git","status":"affected"},{"version":"fe454dc31e84f8c14cb8942fcb61666c9f40745b","lessThan":"43c4e24bd10370fc976f6220518049ce71419399","versionType":"git","status":"affected"},{"version":"fe454dc31e84f8c14cb8942fcb61666c9f40745b","lessThan":"01cbdb724c584d7772fd25af2e4dfdf8527ce0d5","versionType":"git","status":"affected"},{"version":"fe454dc31e84f8c14cb8942fcb61666c9f40745b","lessThan":"83610ee5e498fa5bfcb80031d2b959baea276bf6","versionType":"git","status":"affected"},{"version":"fe454dc31e84f8c14cb8942fcb61666c9f40745b","lessThan":"662ade4de9ff5eceb0820a9f8e9fac70ba6a815b","versionType":"git","status":"affected"},{"version":"a3262b3884dd67b4c5632ce7cdf9cff9d1a575d4","versionType":"git","status":"affected"},{"version":"5.10.20","lessThan":"5.10.271","versionType":"semver","status":"affected"},{"version":"5.11.3","lessThan":"5.12","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/core/ucma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.12","status":"affected"},{"version":"0","lessThan":"5.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/01cbdb724c584d7772fd25af2e4dfdf8527ce0d5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/01e29d0d78a8f66f221625720a04939eef5ec1f6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/29b9ed83d8bfab5c6e11fcbf1aa836aa4ae26cb9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/43c4e24bd10370fc976f6220518049ce71419399","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/52172e11bd074ccaded21740ffeb67123f01dd00","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/662ade4de9ff5eceb0820a9f8e9fac70ba6a815b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/83610ee5e498fa5bfcb80031d2b959baea276bf6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ae805d204cf1f15b87d1bf3529b4c649f3519420","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98254","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:14.057","lastModified":"2026-10-19T10:18:26.380","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nswiotlb: use the adjusted address for the highmem page lookup\n\nswiotlb_bounce() reads the page frame number from the slot's recorded\norig_addr, then advances orig_addr by tlb_offset to reach the address\nthe caller asked about. The highmem branch mixes the two: the offset\nwithin the page comes from the adjusted address, the page from the value\nbefore it.\n\nOnce the adjustment crosses a page boundary the pair no longer describes\none location, and the whole copy lands one page below the intended one\nfor a positive tlb_offset, one above for a negative one. DMA_FROM_DEVICE\nwrites the device data over the wrong page and leaves the intended one\nstale, DMA_TO_DEVICE feeds the device from a page the mapping may not\ncover. Partial syncs through dma_sync_single_range_for_*() are what make\ntlb_offset non-zero.\n\nThe branch test is picked the same way, so a slot recorded in lowmem can\nbe adjusted into highmem and the lowmem path then hands a highmem\naddress to phys_to_virt().\n\nTake both from orig_addr once it is final and keep pfn in the branch\nthat uses it. PhysHighMem() asks the question straight from the address,\nas dma-debug already does."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/dma/swiotlb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5f89468e2f060031cd89fd4287298e0eaf246bf6","lessThan":"6e53b4d6afbde626255805d438cabb1cac482445","versionType":"git","status":"affected"},{"version":"5f89468e2f060031cd89fd4287298e0eaf246bf6","lessThan":"aa4709813b29db89f2307f968db5d24925dcdeb1","versionType":"git","status":"affected"},{"version":"5f89468e2f060031cd89fd4287298e0eaf246bf6","lessThan":"0219b72f5c209732b2f03a8cc0d7240b5e428a99","versionType":"git","status":"affected"},{"version":"5f89468e2f060031cd89fd4287298e0eaf246bf6","lessThan":"b7d7914a9ae3097e63d113007e4fb44d33d515b1","versionType":"git","status":"affected"},{"version":"e6108147dd91b94d1979b110f265710c254c99d5","versionType":"git","status":"affected"},{"version":"e77b796eb9b7ca3c1c0d574d0c155f55b59ca8d5","versionType":"git","status":"affected"},{"version":"5.10.47","lessThan":"5.11","versionType":"semver","status":"affected"},{"version":"5.12.14","lessThan":"5.13","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/dma/swiotlb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0219b72f5c209732b2f03a8cc0d7240b5e428a99","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e53b4d6afbde626255805d438cabb1cac482445","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aa4709813b29db89f2307f968db5d24925dcdeb1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b7d7914a9ae3097e63d113007e4fb44d33d515b1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98255","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:14.210","lastModified":"2026-10-19T10:18:26.500","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: exclude old ACKs from tcp fast path\n\nExclude old ACKs before SND.UNA from the tcp fast path\nas well as ACKs after SND.NXT.\n\nSuch ACKs will fall through to the slow path, where tcp_ack()\nperforms the appropriate validation and challenge ACK handling\naccording to RFC5961 and Commit 3d501dd326fb1c7 (\"tcp: do not\naccept ACK of bytes we never sent\").\n\nThis prevents old ACKs from being accepted\nor modifying connection state as part of the fast path before\nappropriate ACK validation is applied.\nIn particular, this prevents payload carried by a segment with\nan excessively old ACK from advancing RCV.NXT before the ACK\nis rejected."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv4/tcp_input.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"31770e34e43d6c8dee129bfee77e56c34e61f0e5","lessThan":"07cacab90290f795bad2e566790f4ba8e84cdf5f","versionType":"git","status":"affected"},{"version":"31770e34e43d6c8dee129bfee77e56c34e61f0e5","lessThan":"6eb9b697f50b73b9684e466c1e97f4ca8e947a59","versionType":"git","status":"affected"},{"version":"31770e34e43d6c8dee129bfee77e56c34e61f0e5","lessThan":"b86e1e5a4bbcbbccde8b7a3d3486604b581f6628","versionType":"git","status":"affected"},{"version":"31770e34e43d6c8dee129bfee77e56c34e61f0e5","lessThan":"1c8448db5cf35a13d82b0c9004ffdb49358883e7","versionType":"git","status":"affected"},{"version":"31770e34e43d6c8dee129bfee77e56c34e61f0e5","lessThan":"8309dc2cc360056aa9cd2acfbfc25930798c3b66","versionType":"git","status":"affected"},{"version":"31770e34e43d6c8dee129bfee77e56c34e61f0e5","lessThan":"ff037920c688ae6ca1153fec01e90e6782712455","versionType":"git","status":"affected"},{"version":"31770e34e43d6c8dee129bfee77e56c34e61f0e5","lessThan":"8205ac5ddb42a1843fa8d6a8c295b5c7f4f8c6ed","versionType":"git","status":"affected"},{"version":"31770e34e43d6c8dee129bfee77e56c34e61f0e5","lessThan":"f81e6c3fb06327bc49cdd6e559845293ba06a704","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv4/tcp_input.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.14","status":"affected"},{"version":"0","lessThan":"4.14","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/07cacab90290f795bad2e566790f4ba8e84cdf5f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1c8448db5cf35a13d82b0c9004ffdb49358883e7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6eb9b697f50b73b9684e466c1e97f4ca8e947a59","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8205ac5ddb42a1843fa8d6a8c295b5c7f4f8c6ed","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8309dc2cc360056aa9cd2acfbfc25930798c3b66","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b86e1e5a4bbcbbccde8b7a3d3486604b581f6628","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f81e6c3fb06327bc49cdd6e559845293ba06a704","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ff037920c688ae6ca1153fec01e90e6782712455","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98256","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:14.373","lastModified":"2026-10-19T10:18:26.607","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsignal: Prevent exec() race\n\nHyunwoo debugged the following KASAN UAF splat:\n\n  BUG: KASAN: slab-use-after-free in __send_signal_locked+0xb27/0xba0\n  Write of size 8 at addr ffff888007ed80c8 by task poc/79\n  ...\n  Call Trace:\n   __send_signal_locked+0xb27/0xba0\n   do_send_sig_info+0xa7/0x160\n   do_send_specific+0x76/0xa0\n   __x64_sys_tgkill+0x193/0x270\n  ...\n  Allocated by task 80:\n   do_timer_create+0x1a4/0x1030\n   __x64_sys_timer_create+0x145/0x190\n  ...\n  Freed by task 12:\n   kmem_cache_free_bulk+0x1f8/0x4a0\n   kvfree_rcu_bulk+0x14f/0x1c0\n   kfree_rcu_work+0x128/0x1a0\n  ...\n  Last potentially related work creation:\n   kvfree_call_rcu+0x39/0x390\n   __flush_itimer_signals+0x211/0x320\n   flush_itimer_signals+0x47/0x90\n   begin_new_exec+0xa6b/0x28c0\n\nIt turned out that this happens with a non-leader exec() as Hyunwoo\nexplained:\n\nde_thread() calls exchange_tids() before release_task(leader), so the\nstruct pid held by a SIGEV_THREAD_ID timer created against the leader's tid\nnow points to the thread which called execve(). pid_task() returns that\nthread and lock_task_sighand() on it succeeds.\n\nIf the timer signal is blocked, its sigqueue stays queued on the leader's\ntask::pending. The next expiry of that timer can then run while\nrelease_task() flushes the queue.\n\nposixtimer_send_sigqueue() checks whether the sigqueue is already queued\nwith a plain list_empty(), which only reads list_head::next.\nlist_del_init() is not atomic and INIT_LIST_HEAD() stores list_head::next\nbefore list_head::prev, so the check can pass in between. list_add_tail()\nqueues the entry on the task::pending of the live thread, and the\nlist_head::prev store from the flush then overwrites the list_head::prev\nlink that list_add_tail() has just set.\n\n__flush_itimer_signals() does not undo that either. With list_head::prev\npointing at the entry itself, its list_del_init() only stores the same\nvalues again, so the entry is not removed from the list. It is still there\nafter the last reference is dropped and the timer is freed by RCU, and the\nlist_add_tail() of a later tgkill() follows that list_head::prev into the\nfreed timer.\n\nThis problem surfaced with the recent commit which moved the sigqueue flush\nout of the sighand lock held region.\n\nHyonwoo proposed to fix this by using list_del_init_careful(), but that\njust papers over the problem. After some disucssions and various attempts\nto solve it, Eric pointed out that there is no reason to flush\ntask::pending late in release_task() and it should be done in\nexit_signals() already.\n\nAs nothing can collect and deliver signals which are queued in a dying\ntask's pending queue, there is no reason to delay it further.\n\nBut it has to be ensured that no signals can be queued into it after that\npoint. exit_signals() sets PF_EXITING in task::flags, which can be used as\nan indicator for this.\n\nCure it by:\n\n  - Preventing signal queueing for task private signals (PIDTYPE_PID) when\n    the task has PF_EXITING set in __send_signal_locked() and in\n    posixtimer_send_sigqueue().\n\n  - Protecting the unlocked setting of PF_EXITING in exit_signals() for the\n    task group empty and the group exit case with sighand lock\n\n  - Flushing task::pending signals right there.\n\n    Optimize that by moving the whole pending list to an on-stack list head\n    under sighand lock and free the signals without the lock held.\n\nThere has been quite some discussion about the lockless flush and the\nnon-leader exec case on weakly ordered systems. The problem is that a third\nparty which tries to send a posix timer signal relies on the PID lookup to\nfind the target task and that lookup might result in the new leader when\nthe signal was originaly directed to the old leader. In case that the\nsignal was queued on the old leader then the lockless flush raised a\nconcern over the following situation:\n\n   old_leader\t\tnew_leader              third party\n\nA: flush_list()\t// list_del_in\n---truncated---"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/exit.c","kernel/signal.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fb3bbcfe344e64a46574a638b051ffd78762c12d","lessThan":"621c365739828900f32a0c1cdfe5387528a62176","versionType":"git","status":"affected"},{"version":"fb3bbcfe344e64a46574a638b051ffd78762c12d","lessThan":"934bd95f1a6404dbb845951b823547abab05a649","versionType":"git","status":"affected"},{"version":"fb3bbcfe344e64a46574a638b051ffd78762c12d","lessThan":"d2710c8d938ae6a825a6463158e6e6f31eac792a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/exit.c","kernel/signal.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/621c365739828900f32a0c1cdfe5387528a62176","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/934bd95f1a6404dbb845951b823547abab05a649","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d2710c8d938ae6a825a6463158e6e6f31eac792a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98257","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:14.540","lastModified":"2026-10-19T10:18:26.740","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrds: ib: use rds_conn_drop() on protocol version mismatch\n\nrds_ib_cm_connect_complete() runs from the RDMA-CM event handler with\nconn->c_cm_lock held.  When the peer negotiates a protocol version\nolder than RDS_PROTOCOL_COMPAT_VERSION, the handler calls\nrds_conn_destroy(), which is only safe in the rmmod path: it\nsynchronously tears the connection down and flush_work()es the\nshutdown work cp_down_w.\n\nThat shutdown work (rds_conn_shutdown()) needs cp_cm_lock, which is\nthe very lock the event handler still holds, so the flush never\ncompletes: the two workers wait on each other and the RDS connection\nworkqueues stall for good.\n\nAll other RDMA-CM failure paths (REJECTED, CONNECT_ERROR,\nDISCONNECTED) use rds_conn_drop(), which marks the connection\nRDS_CONN_ERROR and schedules the shutdown work asynchronously.  Use\nit here as well."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/rds/ib_cm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f147dd9ecabf23fd63d2562ffe64252a0453ecde","lessThan":"424019be3f637da76b74f44a40034669acbb166f","versionType":"git","status":"affected"},{"version":"f147dd9ecabf23fd63d2562ffe64252a0453ecde","lessThan":"14fb90067d13f4494cff0f03243fae3cf2911cbc","versionType":"git","status":"affected"},{"version":"f147dd9ecabf23fd63d2562ffe64252a0453ecde","lessThan":"344c72a0bc2703a6de4918ed935850e07dae3af2","versionType":"git","status":"affected"},{"version":"f147dd9ecabf23fd63d2562ffe64252a0453ecde","lessThan":"b5c9f2951d330d4a198a64d6e60f79b4bd6ef078","versionType":"git","status":"affected"},{"version":"f147dd9ecabf23fd63d2562ffe64252a0453ecde","lessThan":"d392b16acd0908f077289aad8bba066ff16de336","versionType":"git","status":"affected"},{"version":"f147dd9ecabf23fd63d2562ffe64252a0453ecde","lessThan":"65ca0a5037152a5a80b8fe6aac80eb80458be573","versionType":"git","status":"affected"},{"version":"f147dd9ecabf23fd63d2562ffe64252a0453ecde","lessThan":"7d8c22cb2cb1efb5e830a4545c76abf7b35cc2e8","versionType":"git","status":"affected"},{"version":"f147dd9ecabf23fd63d2562ffe64252a0453ecde","lessThan":"f97d8c7bab7843631206a114986c9059da03efeb","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/rds/ib_cm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.37","status":"affected"},{"version":"0","lessThan":"2.6.37","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"references":[{"url":"https://git.kernel.org/stable/c/14fb90067d13f4494cff0f03243fae3cf2911cbc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/344c72a0bc2703a6de4918ed935850e07dae3af2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/424019be3f637da76b74f44a40034669acbb166f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/65ca0a5037152a5a80b8fe6aac80eb80458be573","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7d8c22cb2cb1efb5e830a4545c76abf7b35cc2e8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b5c9f2951d330d4a198a64d6e60f79b4bd6ef078","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d392b16acd0908f077289aad8bba066ff16de336","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f97d8c7bab7843631206a114986c9059da03efeb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98258","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:14.737","lastModified":"2026-10-19T10:18:26.880","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nposix-cpu-timers: Prevent freeing a timer which is queued on the expiry list\n\nKijo analyzed another race in the POSIX CPU timer code:\n\nCommit bf635681c906 converted cpu_timer::firing from a tristate value to a\nboolean. This lost the distinction between \"not owned by the firing list\"\nand \"still owned, but delivery was canceled\". The resulting race is:\n\n    expiry handler              timer_settime()        timer_delete()\n    --------------              ---------------        --------------\n    collect timer onto\n    private firing list\n    firing = true\n                                observes firing = true\n                                firing = false\n                                return TIMER_RETRY\n                                wait for handler\n                                                       observes firing = false\n                                                       finish deletion\n                                                       unhash and free timer\n    resume list traversal\n    read freed elist.next\n    -> UAF\n\nThe firing bit is clearly the wrong indicator since that commit.\n\nCheck whether the timer is queued on the expiry list or not instead. If it\nis queued clear the firing bit to prevent signal delivery as before and\nreturn TIMER_RETRY so the caller unlocks the timer which allows the expiry\ncode to make progress and remove it from the list."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/time/posix-cpu-timers.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bf635681c906ad056d1fda325de8d1c12c9f8201","lessThan":"9971dac1a77845ff467146915fcbb9170f6a8209","versionType":"git","status":"affected"},{"version":"bf635681c906ad056d1fda325de8d1c12c9f8201","lessThan":"4336e3f47d9d516441066e9a65eaf076790d8d45","versionType":"git","status":"affected"},{"version":"bf635681c906ad056d1fda325de8d1c12c9f8201","lessThan":"c21eaa72f02fc6e85621cbe09d303d8fb8bd39cd","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/time/posix-cpu-timers.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.13","status":"affected"},{"version":"0","lessThan":"6.13","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/4336e3f47d9d516441066e9a65eaf076790d8d45","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9971dac1a77845ff467146915fcbb9170f6a8209","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c21eaa72f02fc6e85621cbe09d303d8fb8bd39cd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98259","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:14.877","lastModified":"2026-10-19T10:18:26.993","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/dax: check zero or empty entry before converting xarray entry\n\nCalling dax_to_folio() with empty entry causes kernel panic below when\nbooting a VM with DAX enabled storage.\n\nThis patch checks empty entry before calling dax_to_folio() on\ndax_associate_entry(), dax_disassociate_entry(), and dax_busy_page().\n\nCommit 98c183a4fccf (\"fs/dax: don't disassociate zero page entries\") added\nguards in the associate and disassociate paths, but the guards still come\nafter dax_to_folio(), and dax_busy_page() still has the same problem.\n\n[    0.737679] EXT4-fs (pmem0p1): mounted filesystem 79676804-7c8b-491a-b2a6-9bae3c72af70 ro with ordered data mode. Quota mode: disabled.\n[    0.737891] VFS: Mounted root (ext4 filesystem) readonly on device 259:1.\n[    0.739119] devtmpfs: mounted\n[    0.739476] Freeing unused kernel memory: 1920K\n[    0.740156] Run /sbin/init as init process\n[    0.740229]   with arguments:\n[    0.740286]     /sbin/init\n[    0.740321]   with environment:\n[    0.740369]     HOME=/\n[    0.740400]     TERM=linux\n[    0.743162] Unable to handle kernel paging request at virtual address fffffdffbf000008\n[    0.743285] Mem abort info:\n[    0.743316]   ESR = 0x0000000096000006\n[    0.743371]   EC = 0x25: DABT (current EL), IL = 32 bits\n[    0.743444]   SET = 0, FnV = 0\n[    0.743489]   EA = 0, S1PTW = 0\n[    0.743545]   FSC = 0x06: level 2 translation fault\n[    0.743610] Data abort info:\n[    0.743656]   ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000\n[    0.743720]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n[    0.743785]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n[    0.743848] swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000000b9d17000\n[    0.743931] [fffffdffbf000008] pgd=10000000bfa3d403, p4d=10000000bfa3d403, pud=1000000040bfe403, pmd=0000000000000000\n[    0.744070] Internal error: Oops: 0000000096000006 [#1]  SMP\n[    0.748888] CPU: 0 UID: 0 PID: 1 Comm: init Not tainted 6.18.4 #1 NONE\n[    0.749421] pstate: 004000c5 (nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[    0.749969] pc : dax_disassociate_entry.constprop.0+0x20/0x50\n[    0.750444] lr : dax_insert_entry+0xcc/0x408\n[    0.750802] sp : ffff80008000b9e0\n[    0.751083] x29: ffff80008000b9e0 x28: 0000000000000000 x27: 0000000000000000\n[    0.751682] x26: 0000000001963d01 x25: ffff0000004f7d90 x24: 0000000000000000\n[    0.752264] x23: 0000000000000000 x22: ffff80008000bcc8 x21: 0000000000000011\n[    0.752836] x20: ffff80008000ba90 x19: 0000000001963d01 x18: 0000000000000000\n[    0.753407] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000\n[    0.753970] x14: ffffbf3154b9ae70 x13: 0000000000000000 x12: ffffbf3154b9ae70\n[    0.754548] x11: ffffffffffffffff x10: 0000000000000000 x9 : 0000000000000000\n[    0.755122] x8 : 000000000000000d x7 : 000000000000001f x6 : 0000000000000000\n[    0.755707] x5 : 0000000000000000 x4 : 0000000000000000 x3 : fffffdffc0000000\n[    0.756287] x2 : 0000000000000008 x1 : 0000000040000000 x0 : fffffdffbf000000\n[    0.756871] Call trace:\n[    0.757107]  dax_disassociate_entry.constprop.0+0x20/0x50 (P)\n[    0.757592]  dax_iomap_pte_fault+0x4fc/0x808\n[    0.757951]  dax_iomap_fault+0x28/0x30\n[    0.758258]  ext4_dax_huge_fault+0x80/0x2dc\n[    0.758594]  ext4_dax_fault+0x10/0x3c\n[    0.758892]  __do_fault+0x38/0x12c\n[    0.759175]  __handle_mm_fault+0x530/0xcf0\n[    0.759518]  handle_mm_fault+0xe4/0x230\n[    0.759833]  do_page_fault+0x17c/0x4dc\n[    0.760144]  do_translation_fault+0x30/0x38\n[    0.760483]  do_mem_abort+0x40/0x8c\n[    0.760771]  el0_ia+0x4c/0x170\n[    0.761032]  el0t_64_sync_handler+0xd8/0xdc\n[    0.761371]  el0t_64_sync+0x168/0x16c\n[    0.761677] Code: f9453021 f2dfbfe3 cb813080 8b001860 (f9400401)\n[    0.762168] ---[ end trace 0000000000000000 ]---\n[    0.762550] note: init[1] exited with irqs disabled\n[    0.762631] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/dax.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"38607c62b34b46317c46d5baf1df03ac6e48a1c6","lessThan":"44ab7420ab52ab6c04bf225cac7c5c007cedd6c7","versionType":"git","status":"affected"},{"version":"38607c62b34b46317c46d5baf1df03ac6e48a1c6","lessThan":"185cd2f5fe1e3319853cf065905b2885ad0bcbf8","versionType":"git","status":"affected"},{"version":"38607c62b34b46317c46d5baf1df03ac6e48a1c6","lessThan":"8e2b8614039853e68d5338e37821e8bcee9fc05f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/dax.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/185cd2f5fe1e3319853cf065905b2885ad0bcbf8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/44ab7420ab52ab6c04bf225cac7c5c007cedd6c7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8e2b8614039853e68d5338e37821e8bcee9fc05f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98260","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:15.040","lastModified":"2026-10-19T10:18:27.110","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nexec: Cleanup POSIX timers right after de_thread()\n\nA per-thread CPU timer holds a reference to the PID of the thread it is\nattached to and, while it is armed, its node is queued in that thread's\nposix_cputimers. The task is looked up by that PID.\n\nWhen a non-leader thread exec()s, de_thread() changes which task owns\nthat PID. pid_task(timer->it.cpu.pid, PIDTYPE_PID) then returns NULL,\nbut the node is still queued on tsk, which is alive. timer_lock_sighand()\ntakes a failed lookup to mean that the node is already dequeued, so it\nhas nothing to undo.\n\nbegin_new_exec() calls posix_cpu_timers_exit(me) right after\nexec_task_namespaces() and that removes the leftover node, so the state\nnormally stays invisible. But bprm->point_of_no_return is set before\nde_thread(), so if unshare_files(), set_mm_exe_file(), exec_mmap() or\nexec_task_namespaces() fails, the task dies before it gets there.\nexit_itimers() then frees the k_itimer while its node is still queued,\nand reaping tsk later erases that freed node from the rbtree.\n\nIn short:\n\n      the non-leader thread B           the parent\n\n  timer_create(CLOCK_THREAD_CPUTIME_ID)\n  timer_settime()\n    arm_timer()            // the node is queued on B\n  execve()\n    de_thread(B)\n      exchange_tids(B, leader)  // B's PID now belongs to the leader\n      release_task(leader)\n        __exit_signal(leader)\n          posix_cpu_timers_exit(leader)  // cleans leader's queue, not B's\n          __unhash_process(leader)  // that PID has no task anymore\n    exec_mmap()\n      mmap_read_lock_killable(old_mm)\n                                kill(B, SIGKILL)\n      // -EINTR\n  get_signal()\n    do_exit()\n      exit_itimers()\n        posix_timer_delete()\n          posix_cpu_timer_del()\n        posix_timer_unhash_and_free()  // freed while still queued\n                                wait4()\n                                  release_task(B)\n                                    posix_cpu_timers_exit(B)\n                                      cleanup_timerqueue()\n                                        timerqueue_del()  // use-after-free\n\nMove the POSIX timer cleanup right after de_thread() before any of the\nlater failure conditions brings the task into do_exit().\n\n[ tglx: Move the cleanup right after de_thread() ]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/exec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59","lessThan":"6f1977cea3e85cd8ab55fb337d3e1725fe61d1ce","versionType":"git","status":"affected"},{"version":"55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59","lessThan":"d9ae467e617ca29b825493a362bf0d75ad5f4ac3","versionType":"git","status":"affected"},{"version":"55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59","lessThan":"75aa08b93c65766040f9ca99f41ac85ad22596b6","versionType":"git","status":"affected"},{"version":"55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59","lessThan":"d602877baf36c43c788a5f472c977e0be414029f","versionType":"git","status":"affected"},{"version":"55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59","lessThan":"acb03d3881818581052924a9bbbe92b8741ed448","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/exec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.7","status":"affected"},{"version":"0","lessThan":"5.7","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/6f1977cea3e85cd8ab55fb337d3e1725fe61d1ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/75aa08b93c65766040f9ca99f41ac85ad22596b6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/acb03d3881818581052924a9bbbe92b8741ed448","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d602877baf36c43c788a5f472c977e0be414029f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d9ae467e617ca29b825493a362bf0d75ad5f4ac3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98261","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:15.200","lastModified":"2026-10-19T10:18:27.253","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix server use-after-free in cifs_chan_skip_or_disable()\n\nWhen a secondary channel is no longer supported by the server,\ncifs_chan_skip_or_disable() drops the channel reference with\ncifs_put_tcp_session() and then continues to use the server pointer by\ncalling cifs_signal_cifsd_for_reconnect() on it and reading its\nprimary_server pointer. cifs_put_tcp_session() can drop the last\nreference of the channel and tear it down, so both the channel and the\nprimary server (whose reference is also dropped by\ncifs_put_tcp_session()) can be freed before they are signaled for\nreconnect.\n\nSignal the channel and the primary server and capture the primary\nserver pointer before dropping the channel reference with\ncifs_put_tcp_session()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"50e8363ecc85da49764781da90ebffe1a657b370","lessThan":"0338489960ddad6368bce55e8adbc176c523093d","versionType":"git","status":"affected"},{"version":"f591062bdbf4742b7f1622173017f19e927057b0","lessThan":"edd52eae5fcfb8433b6bb0e7cd98db438fe01227","versionType":"git","status":"affected"},{"version":"f591062bdbf4742b7f1622173017f19e927057b0","lessThan":"fcc0a935bb6e37ecbf7e4335061309f896f35780","versionType":"git","status":"affected"},{"version":"f591062bdbf4742b7f1622173017f19e927057b0","lessThan":"7a1b27780b113583a94256d58dabfe7c0d9286e7","versionType":"git","status":"affected"},{"version":"f591062bdbf4742b7f1622173017f19e927057b0","lessThan":"717e0a25036b6c92cecace30913b2d874a4c22b8","versionType":"git","status":"affected"},{"version":"d61ba1d71ea6039eca7ada870bf3f0c3c8fc12e4","versionType":"git","status":"affected"},{"version":"6.6.15","lessThan":"6.6.158","versionType":"semver","status":"affected"},{"version":"6.7.3","lessThan":"6.8","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0338489960ddad6368bce55e8adbc176c523093d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/717e0a25036b6c92cecace30913b2d874a4c22b8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7a1b27780b113583a94256d58dabfe7c0d9286e7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/edd52eae5fcfb8433b6bb0e7cd98db438fe01227","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fcc0a935bb6e37ecbf7e4335061309f896f35780","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98262","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:15.347","lastModified":"2026-10-19T10:18:27.390","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY\n\nA user reported that commit 105c42566a55 (\"ata: ahci: force 32-bit DMA for\nJMicron JMB582/JMB585\") made the JMicron JMB585 unusable on his board.\n\nThe failure is seen as soon as the ahci driver is probed, and booting with\niommu=off does not solve the problem.\n\nLooking at the AHCI specification, PxCLBU and PxFBU are both read only '0'\nfor HBAs that do not support 64-bit addressing.\n\nFor HBAs that do support 64-bit addressing, the registers are read write,\nwith a reset value that is Implementation Specific.\n\nWhen using the AHCI_HFLAG_32BIT_ONLY flag, the HBA does support 64-bit\naddressing, and a 32-bit DMA mask is set by simply clearing HOST_CAP_64.\nThus, in this case, we need to explicitly clear the registers to 0."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/ata/libahci.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c","lessThan":"0191c9ff23ef1678dbfb5ad253a2dee92feb5d71","versionType":"git","status":"affected"},{"version":"c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c","lessThan":"8f510f68208a1f673d7c7234a687be4671490e9c","versionType":"git","status":"affected"},{"version":"c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c","lessThan":"4719424bb7cb9f20b73986bcb72dd528f0e5c6eb","versionType":"git","status":"affected"},{"version":"c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c","lessThan":"a5a8b4737f68bbac8aa0685af0c8921e6003c22b","versionType":"git","status":"affected"},{"version":"c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c","lessThan":"b28a17d4a9bb0aa38b48681c3927b012ba40eabe","versionType":"git","status":"affected"},{"version":"c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c","lessThan":"b691a3e244278362e552439d6d3ee5a5d3703488","versionType":"git","status":"affected"},{"version":"c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c","lessThan":"7912ad8fb5233bb8cfe21d50df639c7f4854ff9d","versionType":"git","status":"affected"},{"version":"c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c","lessThan":"82e47533221d4746947b74d2e79a478c36c6433a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/ata/libahci.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.22","status":"affected"},{"version":"0","lessThan":"2.6.22","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0191c9ff23ef1678dbfb5ad253a2dee92feb5d71","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4719424bb7cb9f20b73986bcb72dd528f0e5c6eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7912ad8fb5233bb8cfe21d50df639c7f4854ff9d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/82e47533221d4746947b74d2e79a478c36c6433a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8f510f68208a1f673d7c7234a687be4671490e9c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a5a8b4737f68bbac8aa0685af0c8921e6003c22b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b28a17d4a9bb0aa38b48681c3927b012ba40eabe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b691a3e244278362e552439d6d3ee5a5d3703488","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98263","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:15.507","lastModified":"2026-10-19T10:18:27.507","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type\n\nstream_config is not initialized before being passed to\nsdw_stream_add_slave().  The type field may contain garbage and is\nlater copied to stream->type by sdw_config_stream().\n\nZero-initialize stream_config so type defaults to SDW_STREAM_PCM.\n\nWhile at it, use snd_sdw_params_to_config() helper instead of\nopen-coding the same logic."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/soc/codecs/rt712-sdca-dmic.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"63a511284c9ea72696a5dd0a2d2721bdef19f774","lessThan":"6507055733a9d397289277408b52daf422f8a814","versionType":"git","status":"affected"},{"version":"63a511284c9ea72696a5dd0a2d2721bdef19f774","lessThan":"c144447c207e2be24d6ac86d544691ba464caad8","versionType":"git","status":"affected"},{"version":"63a511284c9ea72696a5dd0a2d2721bdef19f774","lessThan":"d93988c9e58d37b677f6ee8aceae741c8d1e30ad","versionType":"git","status":"affected"},{"version":"63a511284c9ea72696a5dd0a2d2721bdef19f774","lessThan":"a318ee718e7448cd6bf62d9b3197b6a6a8d4701e","versionType":"git","status":"affected"},{"version":"63a511284c9ea72696a5dd0a2d2721bdef19f774","lessThan":"03a5699a0a04309c597683967aaaf25d1e555ea2","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/soc/codecs/rt712-sdca-dmic.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.4","status":"affected"},{"version":"0","lessThan":"6.4","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/03a5699a0a04309c597683967aaaf25d1e555ea2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6507055733a9d397289277408b52daf422f8a814","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a318ee718e7448cd6bf62d9b3197b6a6a8d4701e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c144447c207e2be24d6ac86d544691ba464caad8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d93988c9e58d37b677f6ee8aceae741c8d1e30ad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98264","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:15.650","lastModified":"2026-10-19T10:18:27.603","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: virtio: reset device before deleting virtqueues\n\nvirtsnd_remove() and virtsnd_freeze() delete the virtqueues before\nresetting the device. del_vqs() frees the vring backing, but does not\nprovide a generic device quiesce operation. In particular, modern\nvirtio-pci keeps enabled queues active until the device is reset.\n\nReset the device before deleting the virtqueues so it can no longer\naccess the vring memory when that memory is released. This also covers\nprobe failures after DRIVER_OK, which unwind through virtsnd_remove()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/virtio/virtio_card.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"de3a9980d8c34b2479173e809afa820473db676a","lessThan":"8edc3669e3e22f0123a1114c3a03df9abc4cd465","versionType":"git","status":"affected"},{"version":"de3a9980d8c34b2479173e809afa820473db676a","lessThan":"830012feadc228a938514a6487862dcf56af7e66","versionType":"git","status":"affected"},{"version":"de3a9980d8c34b2479173e809afa820473db676a","lessThan":"500a8401415ab085555785c3c339747e378abd36","versionType":"git","status":"affected"},{"version":"de3a9980d8c34b2479173e809afa820473db676a","lessThan":"3e24b4a6acfd3bedb2200334595facd767c9a897","versionType":"git","status":"affected"},{"version":"de3a9980d8c34b2479173e809afa820473db676a","lessThan":"f070cce7cb361d5389b18f3ff6bd3d25a7596369","versionType":"git","status":"affected"},{"version":"de3a9980d8c34b2479173e809afa820473db676a","lessThan":"6c05d00af307560e6a9f1631d6270d3df5aa2272","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/virtio/virtio_card.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3e24b4a6acfd3bedb2200334595facd767c9a897","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/500a8401415ab085555785c3c339747e378abd36","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6c05d00af307560e6a9f1631d6270d3df5aa2272","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/830012feadc228a938514a6487862dcf56af7e66","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8edc3669e3e22f0123a1114c3a03df9abc4cd465","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f070cce7cb361d5389b18f3ff6bd3d25a7596369","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98265","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:15.797","lastModified":"2026-10-21T13:21:25.820","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Clamp implicit feedback packet count to URB capacity\n\ndata_ep_set_params() allocates each data URB for exactly u->packets\nisochronous frames, so urb->iso_frame_desc[] has u->packets slots and\nctx->packets is the driver's only record of that limit. For an implicit\nfeedback sink, snd_usb_queue_pending_output_urbs() overwrites it with the\nsync source's packet count, which is calculated independently from the\ncapture endpoint's parameters. When that count is larger,\nprepare_playback_urb() and prepare_silent_urb() can write\niso_frame_desc[] past the allocation; their existing bounds limit payload\nbytes, not the descriptor index.\n\nThe reproducer uses a high-speed UAC2 device declaring bInterval 1 for\nimplicit feedback capture (8 packets) and bInterval 4 for playback\n(1 packet). On the first capture completion after the stream starts, it\naccesses seven descriptors spanning 112 bytes beyond the one-packet URB:\n\n  BUG: KASAN: slab-out-of-bounds in prepare_playback_urb (sound/usb/pcm.c:1560)\n  Write of size 4 at addr ffff88801e696ad0 by task vhci_rx/178\n   prepare_playback_urb (sound/usb/pcm.c:1560)\n   prepare_outbound_urb (sound/usb/endpoint.c:340)\n   snd_usb_queue_pending_output_urbs (sound/usb/endpoint.c:501)\n   snd_complete_urb (sound/usb/endpoint.c:1834)\n   __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1657)\n   usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1741)\n   vhci_rx_loop (drivers/usb/usbip/vhci_rx.c:107)\n   kthread (kernel/kthread.c:436)\n  The buggy address belongs to the object at ffff88801e696a00\n   which belongs to the cache kmalloc-256 of size 256\n  The buggy address is located 0 bytes to the right of\n   allocated 208-byte region [ffff88801e696a00, ffff88801e696ad0)\n\nRecord the allocated packet count per endpoint and clamp both the adopted\ncount and the packet-size copy to it. Fold the Format Type II delimiter\ninto urb_packs before the allocation loop so the recorded limit matches\nevery URB."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/usb/card.h","sound/usb/endpoint.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c26bde6301f20d9aafbfb7c2459a88c6a6ec178f","lessThan":"8b637ab10e40e01b452f4aff66dad335a9b89a16","versionType":"git","status":"affected"},{"version":"32a1f64f8ff6e2c5391f5964baec697bce25b83c","lessThan":"ad279ba0dc1781229f5b52f58d38d56960400e06","versionType":"git","status":"affected"},{"version":"e949fd266cfa1dcca7caa3faa698578c4ffd26d6","lessThan":"79c55a7b5d71cf2a6bbd4bd7698e1b10b70f813a","versionType":"git","status":"affected"},{"version":"cf044e44190234a41a788de1cdbb6c21f4a52e1e","lessThan":"ab77e3f453c5f2499c08d6e8e218501d25bab39e","versionType":"git","status":"affected"},{"version":"cf044e44190234a41a788de1cdbb6c21f4a52e1e","lessThan":"76a986c980bb502c7688d605ac7a67fd257a9a1b","versionType":"git","status":"affected"},{"version":"df75696e70c88b22ed1d8c9d515993a858c58fd0","versionType":"git","status":"affected"},{"version":"3a74f6b46c01d9a816378cd83c327a59f61475ec","versionType":"git","status":"affected"},{"version":"f6fbdf797e016fbf968dd54301026b182175985a","versionType":"git","status":"affected"},{"version":"6.6.128","lessThan":"6.6.160","versionType":"semver","status":"affected"},{"version":"6.12.75","lessThan":"6.12.112","versionType":"semver","status":"affected"},{"version":"6.18.16","lessThan":"6.18.54","versionType":"semver","status":"affected"},{"version":"5.15.202","lessThan":"5.16","versionType":"semver","status":"affected"},{"version":"6.1.165","lessThan":"6.2","versionType":"semver","status":"affected"},{"version":"6.19.6","lessThan":"6.20","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/usb/card.h","sound/usb/endpoint.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.0","status":"affected"},{"version":"0","lessThan":"7.0","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/76a986c980bb502c7688d605ac7a67fd257a9a1b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/79c55a7b5d71cf2a6bbd4bd7698e1b10b70f813a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8b637ab10e40e01b452f4aff66dad335a9b89a16","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ab77e3f453c5f2499c08d6e8e218501d25bab39e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ad279ba0dc1781229f5b52f58d38d56960400e06","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98266","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:15.960","lastModified":"2026-10-19T10:18:27.847","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: core: Fix potential UAF after asynchronous card release\n\nUsually a sound driver releases the resources assigned to the card via\nsnd_card_free(), and it synchronizes with the whole release procedure.\nHowever, when the card is released asynchronously via\nsnd_card_free_when_closed() like USB-audio driver, the situation is\nslightly different; although the snd_card_disconnect() call at the\ndisconnection guarantees that any newer accesses will be gated, the\nin-flight tasks might be still accessing to the underlying card->dev\ndevice even after the disconnection, which would cause a\nuse-after-free in the end, as reported by fuzzers.\n\nFor addressing the bug above, this patch takes the refcount of\ncard->dev at initialization of the card object, and releases at its\ndestructor.   This assures the availability of the card->dev in its\nwhole lifecycle."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/core/init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"5c0df40aa577e405c458e44e8d458dd78407f4af","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"2dec4642589a663e064e4411d92d6e8fa250d53b","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"398b21608955c9712a012355b69a39407367edc9","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"fd95e68df6fe66344161a1329cbe5e5805e7b704","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/core/init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2dec4642589a663e064e4411d92d6e8fa250d53b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/398b21608955c9712a012355b69a39407367edc9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5c0df40aa577e405c458e44e8d458dd78407f4af","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fd95e68df6fe66344161a1329cbe5e5805e7b704","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98267","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:16.093","lastModified":"2026-10-19T10:18:27.950","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\n9p: Fix v9fs_issue_write() to update i_size and remote_i_size\n\nFix v9fs_issue_write() to update i_size and remote_i_size to the new size\nof the server file if we made it larger, using the start fpos and the count\nreturned by p9_client_write() to calculate the new minimum file size.\n\nThis assumes that if the 9P server makes a short write (say it hits\nENOSPC), a reduced count is returned."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/9p/vfs_addr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5fb70e7275a61dd404f684370e1add7fe0ebe9c5","lessThan":"aeb1fe55583836744aef11fbfa2a09122aa9816c","versionType":"git","status":"affected"},{"version":"5fb70e7275a61dd404f684370e1add7fe0ebe9c5","lessThan":"88871ab548c1d7b11cde9b04063f3c1c6fbd7039","versionType":"git","status":"affected"},{"version":"5fb70e7275a61dd404f684370e1add7fe0ebe9c5","lessThan":"9cd92e3392bdd14568e9e44aec1ac05e1fcd62e5","versionType":"git","status":"affected"},{"version":"5fb70e7275a61dd404f684370e1add7fe0ebe9c5","lessThan":"c60ae98c5aa64021751b38ab1313b19d620bf640","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/9p/vfs_addr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/88871ab548c1d7b11cde9b04063f3c1c6fbd7039","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9cd92e3392bdd14568e9e44aec1ac05e1fcd62e5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aeb1fe55583836744aef11fbfa2a09122aa9816c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c60ae98c5aa64021751b38ab1313b19d620bf640","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98268","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:16.227","lastModified":"2026-10-19T10:18:28.043","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix null pointer access in is_include_guest_event()\n\nA typical module unload occurring event when there is an active perf\nconnection leads to freeing of the pmu pointer. The call log is something\nlike:\n ..\n __pmu_detach_event\n pmu_detach_event\n pmu_detach_events\n perf_pmu_unregister\n ..\n\n__pmu_detach_event() sets event->pmu to null. When the perf connection\nfinally is closed, the following stack trace is observed:\n\n Oops: general protection fault, kernel NULL pointer dereference\n ...\n RIP: 0010:_free_event+0x3e/0x370\n ...\n Call Trace:\n ...\n perf_event_release_kernel+0x260/0x2d0\n perf_release+0x12/0x20\n\nA call to mediated_pmu_unaccount_event() inside _free_event() is the root\ncause of this crash. Adding a check inside is_include_guest_event() ensures\nwe don't accidentally access a null pmu ptr. In addition to this, we will\nnow call mediated_pmu_unaccount_event() before clearing the pmu ptr so that\nnr_include_guest_events counts are maintained correctly."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/events/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"eff95e170275d9e80b968f335cd03d0ac250d2d1","lessThan":"7fa9a465ae8f07c0e4685db6edb6a6f984dbd784","versionType":"git","status":"affected"},{"version":"eff95e170275d9e80b968f335cd03d0ac250d2d1","lessThan":"88aed0422f39b22406f35f1e758cea25e7bbcfb5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/events/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.0","status":"affected"},{"version":"0","lessThan":"7.0","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/7fa9a465ae8f07c0e4685db6edb6a6f984dbd784","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/88aed0422f39b22406f35f1e758cea25e7bbcfb5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98269","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:16.353","lastModified":"2026-10-19T10:18:28.150","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: abort transaction on failure to update inode for hole punching and reflinking\n\nIf we fail to update the inode we error out without aborting the\ntransaction, which can result in a persistent inconsistency if after\nthe failure the transaction is committed, as we have dropped file\nextent items from a range and either punched a hole or insert a new file\nextent item for that range (for reflinks).\n\nSo add the missing transaction abort."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/btrfs/file.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2aaa66558172b017f36bf38ae69372813dedee9d","lessThan":"2605eb9ba3bbd4c9f455cfe6b85bd28a1da7067d","versionType":"git","status":"affected"},{"version":"2aaa66558172b017f36bf38ae69372813dedee9d","lessThan":"834a3b5c5f1ec0df48c1a6208f9989f4ffdaa0b6","versionType":"git","status":"affected"},{"version":"2aaa66558172b017f36bf38ae69372813dedee9d","lessThan":"9588850bfa75c78ce73c2f6f72544d19d2e9beb6","versionType":"git","status":"affected"},{"version":"2aaa66558172b017f36bf38ae69372813dedee9d","lessThan":"36c68dc909845c049e0286d229bc502947239452","versionType":"git","status":"affected"},{"version":"2aaa66558172b017f36bf38ae69372813dedee9d","lessThan":"97fcd34aa9fd73cefe3120ac9a82ca9d7763922f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/btrfs/file.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.7","status":"affected"},{"version":"0","lessThan":"3.7","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2605eb9ba3bbd4c9f455cfe6b85bd28a1da7067d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/36c68dc909845c049e0286d229bc502947239452","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/834a3b5c5f1ec0df48c1a6208f9989f4ffdaa0b6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9588850bfa75c78ce73c2f6f72544d19d2e9beb6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/97fcd34aa9fd73cefe3120ac9a82ca9d7763922f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98270","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:16.487","lastModified":"2026-10-19T10:18:28.257","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: check ras and obj before dereference\n\nnbio_v7_9_handle_ras_controller_intr_no_bifring() dereferences ras and obj\nwithout checking either for NULL. Both amdgpu_ras_get_context() and\namdgpu_ras_find_obj() can return NULL, e.g. during the window between\nadev->nbio.ras being set (early in amdgpu_ras_init(), by design, to\nenable the fatal-error interrupt as soon as possible) and the PCIE_BIF\nras object actually being created in RAS late_init. Any interrupt in that\nwindow crashes in hard-IRQ context.\n\nThis is analogous to commit d190b459b2a4 (\"drm/amdgpu: the warning\ndereferencing obj for nbio_v7_4\"), which fixed the same issue in the\nnbio_v7_4 handler.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.\n\n(cherry picked from commit c7071767a50a32ed727cf800ac84372429e3b4b3)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7692e1ee2446fd1940b5caa6e09779504a58881a","lessThan":"b7c7f07a40037514f8e890aa00f8d7b196d680cf","versionType":"git","status":"affected"},{"version":"7692e1ee2446fd1940b5caa6e09779504a58881a","lessThan":"fc5f845a291fc8175e6857cd6ad042818da192e8","versionType":"git","status":"affected"},{"version":"7692e1ee2446fd1940b5caa6e09779504a58881a","lessThan":"37583946d8751f8e285c467d770ac0b609b82a23","versionType":"git","status":"affected"},{"version":"7692e1ee2446fd1940b5caa6e09779504a58881a","lessThan":"315c22712715491f0dfafdaf2c2b437540e68702","versionType":"git","status":"affected"},{"version":"7692e1ee2446fd1940b5caa6e09779504a58881a","lessThan":"723d4dc628d764b19cf9efca14b82cca5ff020c9","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/315c22712715491f0dfafdaf2c2b437540e68702","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/37583946d8751f8e285c467d770ac0b609b82a23","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/723d4dc628d764b19cf9efca14b82cca5ff020c9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b7c7f07a40037514f8e890aa00f8d7b196d680cf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fc5f845a291fc8175e6857cd6ad042818da192e8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98271","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:16.627","lastModified":"2026-10-19T10:18:28.367","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: do not leave stale header offsets after pskb_carve()\n\npskb_carve_inside_header() and pskb_carve_inside_nonlinear() remove\nthe first bytes of a packet and reallocate skb->head.\n\nAll the headers that were present before the operation are gone,\nbut both functions call skb_headers_offset_update(skb, 0), which\nis a no-op : skb->mac_header, skb->network_header,\nskb->transport_header and skb->csum_start keep their old values and\nnow describe bytes which are no longer there.\n\nBoth helpers size the new head from the old skb_end_offset(), so the\nstale offsets still land inside the new allocation. They point past\nskb_tail_pointer() though, to bytes that were never initialized.\n\npskb_carve_inside_nonlinear() is the worst case, because it leaves a\nzombie skb with an empty linear part (skb->data ==\nskb_tail_pointer(skb), skb_headlen(skb) == 0), while\nskb_mac_header_was_set() is still true and skb->mac_header is way\nahead of skb->data.\n\nThe only user of pskb_extract() is rds_tcp_data_recv(), and the\ncarved skb is queued on tinc->ti_skb_list. When the RDS incoming\nmessage is released, rds_tcp_inc_free() calls skb_queue_purge(),\nwhich frees the skbs with SKB_DROP_REASON_QUEUE_PURGE. This is\nvisible from drop_monitor, which then tries to pull back to the\n(bogus) mac header :\n\nskbuff: __skb_pull(len=234)\nskb len=6968 data_len=6968 headroom=0 headlen=0 tailroom=0\nend-tail=384 mac=(234,14) mac_len=14 net=(248,40) trans=288\nshinfo(txflags=0 nr_frags=1 gso(size=1428 type=16 segs=5))\ncsum(0x100120 start=288 offset=16 ip_summed=3 complete_sw=0 valid=1 level=0)\nhash(0x7b446c6c sw=0 l4=1) proto=0x86dd pkttype=0 iif=60\nkernel BUG at ./include/linux/skbuff.h:2847!\n\nAdd skb_carve_reset_headers() to mark the mac and transport headers\nas not set, reset the network header, clear skb->mac_len, and drop\na now meaningless CHECKSUM_PARTIAL (csum_start no longer describes\nanything).\n\nInvalidate the inner offsets as well. Unlike mac_header and\ntransport_header they have no \"unset\" sentinel, so a leftover\nnon-zero value still looks like a real header. Zero\nskb->inner_mac_header, skb->inner_network_header,\nskb->inner_transport_header, skb->inner_protocol and\nskb->encapsulation, so that all the header state is invalidated in\none place.\n\nv2: fixed an inaccurate changelog. The stale offsets stay inside the\n    new skb->head, which is never smaller than the old one, they\n    simply point past skb_tail_pointer() to bytes that are gone.\n    Thanks to Xuanqiang Luo for insisting on this.\n    Also invalidate the inner header state, as suggested by the\n    netdev AI review :\n    https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260911114922.621937-1-edumazet%40google.com"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/core/skbuff.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6fa01ccd883021105e9f8af7d04b9f156fa3494a","lessThan":"75e4a3e62531738c124c8555a626426fca29d392","versionType":"git","status":"affected"},{"version":"6fa01ccd883021105e9f8af7d04b9f156fa3494a","lessThan":"bff8a8e53a6d290bc2777bde36d3cb6317b8463d","versionType":"git","status":"affected"},{"version":"6fa01ccd883021105e9f8af7d04b9f156fa3494a","lessThan":"12929ed66a5166177ef5f06d3da81e4f99993e90","versionType":"git","status":"affected"},{"version":"6fa01ccd883021105e9f8af7d04b9f156fa3494a","lessThan":"a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/core/skbuff.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.7","status":"affected"},{"version":"0","lessThan":"4.7","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/12929ed66a5166177ef5f06d3da81e4f99993e90","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/75e4a3e62531738c124c8555a626426fca29d392","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bff8a8e53a6d290bc2777bde36d3cb6317b8463d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98272","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:16.780","lastModified":"2026-10-19T10:18:28.490","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mvpp2: prevent buffer overflow in page_pool allocation\n\nThe per‑processor buffering scheme is supported only if the\nnumber of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS (8).\nThis is already checked in mvpp2_probe() during the initial\nactivation of percpu_pools.\n\nHowever, mvpp2_change_mtu() may later call\nmvpp2_bm_switch_buffers(priv, true) without this check, which can\nlead to an out-of-bounds access in the priv->page_pool array in\nmvpp2_bm_init(). The array is sized to hold MVPP2_PORT_MAX_RXQ\nentries, and mvpp2_get_nrxqs() may return exactly that value. The\nper-CPU scheme then doubles it to nrxqs * 2, exceeding the array\nbounds.\n\nCheck that the hardware version is MVPP22 or newer and that the\nnumber of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS\nbefore switching to per-CPU mode.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7d04b0b13b1175ce0c4bdc77f1278c1f120f874f","lessThan":"5cefdb7acfc646fbded59ae77dfe0aac4c9e4a3c","versionType":"git","status":"affected"},{"version":"7d04b0b13b1175ce0c4bdc77f1278c1f120f874f","lessThan":"4ac1d5adc4f4dbafbfd270b55cc6d8bf9849d545","versionType":"git","status":"affected"},{"version":"7d04b0b13b1175ce0c4bdc77f1278c1f120f874f","lessThan":"dfd46b5584a5881b131008767950e1ab82713c8c","versionType":"git","status":"affected"},{"version":"7d04b0b13b1175ce0c4bdc77f1278c1f120f874f","lessThan":"6569fd85b0ef9a8a6f20b7eb868420b8c7c0c2a0","versionType":"git","status":"affected"},{"version":"7d04b0b13b1175ce0c4bdc77f1278c1f120f874f","lessThan":"e7f30dcfa6c64033bf9137362517bd248e5be384","versionType":"git","status":"affected"},{"version":"7d04b0b13b1175ce0c4bdc77f1278c1f120f874f","lessThan":"f0e7d62c1eb984dd204095118973c59604144cd8","versionType":"git","status":"affected"},{"version":"7d04b0b13b1175ce0c4bdc77f1278c1f120f874f","lessThan":"1734c3fc0066e228ce1c11e434b7c2527f0a949a","versionType":"git","status":"affected"},{"version":"7d04b0b13b1175ce0c4bdc77f1278c1f120f874f","lessThan":"14cb1e7702e5cb3c58888f6aed498381a73927d2","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.4","status":"affected"},{"version":"0","lessThan":"5.4","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/14cb1e7702e5cb3c58888f6aed498381a73927d2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1734c3fc0066e228ce1c11e434b7c2527f0a949a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4ac1d5adc4f4dbafbfd270b55cc6d8bf9849d545","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5cefdb7acfc646fbded59ae77dfe0aac4c9e4a3c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6569fd85b0ef9a8a6f20b7eb868420b8c7c0c2a0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dfd46b5584a5881b131008767950e1ab82713c8c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e7f30dcfa6c64033bf9137362517bd248e5be384","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f0e7d62c1eb984dd204095118973c59604144cd8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98273","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:16.937","lastModified":"2026-10-19T10:18:28.617","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/kprobes: Fix crash when probing CS CALL instructions\n\nWhen using eBPF to probe CS CALL instructions within a function,\na crash can be triggered.\n\nThe eBPF tool probes offset 257 of the __hrtimer_run_queues()\nfunction:\n\n<__hrtimer_run_queues+249>:  nopl   0x0(%rax,%rax,1)\n<__hrtimer_run_queues+254>:  mov    %r14,%rdi\n<__hrtimer_run_queues+257>:  cs call <__x86_indirect_thunk_r12>\n<__hrtimer_run_queues+263>:  mov    %eax,%r12d\n<__hrtimer_run_queues+266>:  xchg   %ax,%ax\n<__hrtimer_run_queues+268>:  mov    %r13,%rdi\n\nWhich triggers this crash:\n\n  BUG: unable to handle page fault for address: 00000000000f41c9\n  #PF: supervisor write access in kernel mode\n  #PF: error_code(0x0002) - not-present page\n  PGD 0 P4D 0\n  Oops: 0002 [#1] SMP NOPTI\n  CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: P\n  RIP: 0010:__hrtimer_run_queues+0x106/0x230\n\nNote that __hrtimer_run_queues+0x106 is __hrtimer_run_queues+262, which is\nat the 6th byte of the above CS CALL instruction. Since the CS CALL\ninstruction occupies 6 bytes, the exception occurred in the middle of that\ncall instruction.\n\nThe root cause is that when using eBPF tools to probe in the middle of a\nfunction, a kprobe with INT3 is used as the underlying implementation.\n\nDuring single-step emulation of the original CALL instruction,\nint3_emulate_call() assumes that the probed CALL instruction is 5 bytes\nlong. However, the actual CS-prefixed CALL instruction occupies 6 bytes,\nso it constructs an incorrect exception return address. When the CPU\nreturns from the kprobe handler, the next instruction to be executed is at\nthe address of the last byte of that CS CALL instruction. Coincidentally,\nstarting from that address, the CPU fetches and decodes a completely\ndifferent instruction, which ultimately triggers a kernel crash.\n\nFix the issue by using the actual instruction length obtained from\nthe instruction decoder when constructing the exception return\naddress, rather than relying on the hardcoded CALL_INSN_SIZE macro.\n\n[ mingo: Refined the changelog ]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/x86/include/asm/text-patching.h","arch/x86/kernel/alternative.c","arch/x86/kernel/kprobes/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6256e668b7af9d81472e03c6a171630c08f8858a","lessThan":"cfc1af3d054aaabee08f1f77c441b3533b082869","versionType":"git","status":"affected"},{"version":"6256e668b7af9d81472e03c6a171630c08f8858a","lessThan":"d8c6a18c0552135cbf0c696c9019b2979d0862c9","versionType":"git","status":"affected"},{"version":"6256e668b7af9d81472e03c6a171630c08f8858a","lessThan":"a5f7a5bb3b7f28ba7e4fa246775b29a0e5537255","versionType":"git","status":"affected"},{"version":"ba7d1dae9fe866abe74bb1e849fb85983b7c4c37","versionType":"git","status":"affected"},{"version":"5.10.190","lessThan":"5.11","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/x86/include/asm/text-patching.h","arch/x86/kernel/alternative.c","arch/x86/kernel/kprobes/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/a5f7a5bb3b7f28ba7e4fa246775b29a0e5537255","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cfc1af3d054aaabee08f1f77c441b3533b082869","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d8c6a18c0552135cbf0c696c9019b2979d0862c9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98274","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:17.077","lastModified":"2026-10-19T10:18:28.740","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb()\n\nPSP conflicts with TLS ULP in its usage of both skb->decrypted and\nsk->sk_validate_xmit_skb().\n\nMake PSP mutually exclusive with TLS ULP, the only other user of either\nof these. As other users of skb->decrypted come along, they can be added\nto sk_has_decrypt_user(). It would make sense to also assert that\nsk->sk_validate_xmit_skb() is also NULL in both of these setup paths for\nsimilar future proofing, but the PSP listener/sk_clone() path is still\nbroken and it could be seen as a regression to not allow rx assoc to run\non a child of a listener socket with PSP tx assoc state.\n\nInclude all TCP ULPs in the sk_has_decrypt_user() check, even though TLS\nis the only one that conflicts with PSP via the decrypted bit. This is\nintentional because PSP was not designed to be used with ULPs. It is\nbest to close off surface area that may make bugs reachable, until\nsomeone wishes to design and test an actual user of PSP with ULPs."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/net/sock.h","net/core/sock.c","net/ipv4/tcp_ulp.c","net/psp/psp_sock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6b46ca260e2290e3453d1355ab5b6d283d73d780","lessThan":"a13cca5ba5375f13cbdab545abfb5e288bef3f78","versionType":"git","status":"affected"},{"version":"6b46ca260e2290e3453d1355ab5b6d283d73d780","lessThan":"c8c8c18862337c469e325c207601de3279847809","versionType":"git","status":"affected"},{"version":"6b46ca260e2290e3453d1355ab5b6d283d73d780","lessThan":"a41f24c612c3f5139a3143307eb85bbcf1bd4d07","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/net/sock.h","net/core/sock.c","net/ipv4/tcp_ulp.c","net/psp/psp_sock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.18","status":"affected"},{"version":"0","lessThan":"6.18","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/a13cca5ba5375f13cbdab545abfb5e288bef3f78","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a41f24c612c3f5139a3143307eb85bbcf1bd4d07","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c8c8c18862337c469e325c207601de3279847809","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98275","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:17.203","lastModified":"2026-10-19T10:18:28.843","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: cortina: Ack RX overrun interrupt correctly\n\nThe RX overrun interrupt is reported in interrupt status register 4, but\ngmac_irq() acknowledges it using the RX descriptor error bit from status\nregister 0. For GMAC0 this writes the GMAC1 overrun bit, while for GMAC1\nthe shift leaves no bit in the 32-bit register.\n\nAcknowledge the same per-port RX overrun bit that was detected."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/cortina/gemini.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"1163cc82dcbc145f912bf2106ab668762f53e483","versionType":"git","status":"affected"},{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"12a0c7bb448c1899ea3d8f97fa47a8740044e16d","versionType":"git","status":"affected"},{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"d72d87926ca33c6766dc73ace46859d7220a45bb","versionType":"git","status":"affected"},{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"472493d1d3334d104b9873abc1c2d80ed3b144f3","versionType":"git","status":"affected"},{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"2f23fa11fef9b4a93335894379d82238f0a28228","versionType":"git","status":"affected"},{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"4f33e036e827f368cdb10bcb15ad098448aca0f5","versionType":"git","status":"affected"},{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"d4bd670454390aab72ab9fb7b73bce2966c33fe3","versionType":"git","status":"affected"},{"version":"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88","lessThan":"1dd85662fee6e2ac580b1c4f9a0c0a7ae6e31f0e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/cortina/gemini.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.16","status":"affected"},{"version":"0","lessThan":"4.16","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1163cc82dcbc145f912bf2106ab668762f53e483","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/12a0c7bb448c1899ea3d8f97fa47a8740044e16d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1dd85662fee6e2ac580b1c4f9a0c0a7ae6e31f0e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2f23fa11fef9b4a93335894379d82238f0a28228","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/472493d1d3334d104b9873abc1c2d80ed3b144f3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4f33e036e827f368cdb10bcb15ad098448aca0f5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d4bd670454390aab72ab9fb7b73bce2966c33fe3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d72d87926ca33c6766dc73ace46859d7220a45bb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98276","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:17.360","lastModified":"2026-10-19T10:18:28.973","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lock the socket in sock_gettstamp()\n\nsk->sk_flags must only be changed while holding the socket lock,\nbecause sock_set_flag() and sock_reset_flag() use non atomic\noperations (__set_bit() and __clear_bit()).\n\nsock_gettstamp() is one of the last places where a bit of sk->sk_flags\nis changed from a syscall without owning the socket lock, through\nsock_enable_timestamp(sk, SOCK_TIMESTAMP).\n\nsk_set_memalloc() and sk_clear_memalloc() also change sk->sk_flags\nwithout the socket lock, but their callers (nbd, iscsi_tcp, nvme-tcp,\nsunrpc, wireguard) need a careful audit, this will be addressed in a\nseparate patch.\n\nJungwoo Lee and Wongi Lee reported an UDP socket use-after-free\ncaused by this bug: a SIOCGSTAMPNS_NEW ioctl racing with bind()\ncan cancel the SOCK_RCU_FREE bit that udp_lib_get_port() just set,\nbecause both threads perform a read-modify-write on the same word.\n\n  CPU 0 (bind)                        CPU 1 (SIOCGSTAMPNS_NEW)\n  --------------------------------    ----------------------------\n  read sk_flags = F                   read sk_flags = F\n  compute F | BIT(SOCK_RCU_FREE)      compute F | BIT(SOCK_TIMESTAMP)\n  store F | BIT(SOCK_RCU_FREE)\n  sk_add_node_rcu(sk, ...)\n                                      store F | BIT(SOCK_TIMESTAMP)\n\nAfter the lost update, SOCK_RCU_FREE is clear while the socket is\nvisible to lockless UDP receive lookups. sk_destruct() then frees\nthe socket immediately instead of waiting for a RCU grace period,\nwhile the receive path still holds a reference-less pointer to it:\n\n BUG: KASAN: slab-use-after-free in ipv4_pktinfo_prepare+0x30/0x410\n Read of size 8 at addr ffff888008806610 by task exploit/207\n CPU: 0 UID: 1000 PID: 207 Comm: exploit Not tainted 6.12.95+ #1\n  ipv4_pktinfo_prepare+0x30/0x410\n  udp_queue_rcv_one_skb+0x51c/0x1180\n  udp_unicast_rcv_skb+0x109/0x350\n  ip_protocol_deliver_rcu+0x14b/0x310\n  ip_local_deliver_finish+0x29d/0x390\n  ip_local_deliver+0x24d/0x2a0\n\nOnly grab the socket lock when SOCK_TIMESTAMP has to be set,\nto keep the common case lockless."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/core/sock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"18899e2e4023369a8f7739c2255a59a9748d8d17","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"88c804847dd87dc613b771b392ccecdb94725032","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"3b12d3967e96f1b7b977d9fc352ae29a1b299a82","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"17b2a1eb97fdb2a2cbaeab3b146b26797ea9311f","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"1f73253add8365d0dad0a4f421acaa8c21d20cef","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d9f96bc2d822501f84d1caa6275a2c6b316ca2c4","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"899650bbf985b7bfd2a7b808357df9b16e6d6959","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"9ed55f3dbef4f4adfe65eb03b0c35c53229a8490","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/core/sock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/17b2a1eb97fdb2a2cbaeab3b146b26797ea9311f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/18899e2e4023369a8f7739c2255a59a9748d8d17","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1f73253add8365d0dad0a4f421acaa8c21d20cef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3b12d3967e96f1b7b977d9fc352ae29a1b299a82","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/88c804847dd87dc613b771b392ccecdb94725032","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/899650bbf985b7bfd2a7b808357df9b16e6d6959","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9ed55f3dbef4f4adfe65eb03b0c35c53229a8490","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d9f96bc2d822501f84d1caa6275a2c6b316ca2c4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98277","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:17.530","lastModified":"2026-10-19T10:18:29.140","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\neth: fbnic: ring the doorbell if a burst ends in a drop\n\nfbnic_tx_map() skips the doorbell write, and the completion request,\nfor every packet handed to it with xmit_more set, counting on the\npacket which ends the burst to publish them all. When that packet is\ndropped instead - skb_put_padto(), skb_cow_head() or a DMA mapping\nfailure - nothing rings. The descriptors of the preceding packets stay\ninvisible to the HW until the next transmit on that queue, which for a\nburst-then-idle workload may never come.\n\nRemember the meta descriptor of the last packet left without a doorbell\nand flush it from the error paths. The completion request has to be set\non that descriptor rather than simply writing the tail, otherwise the HW\nwould transmit the packets but never report a head, and the ring would\nfill up and stall for good.\n\nThis is very similar to Joe's recent series of fixes for bnxt.\nNot seen in real life, reproduced under QEMU with failure injection."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/meta/fbnic/fbnic_txrx.c","drivers/net/ethernet/meta/fbnic/fbnic_txrx.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9a57bacd574b52b08bc2c600af6a8c7a87049ecf","lessThan":"60ef74357a36ed2a102a75bb68d37aa7f305b94e","versionType":"git","status":"affected"},{"version":"9a57bacd574b52b08bc2c600af6a8c7a87049ecf","lessThan":"28fb764d670aa22dcbd2a02fd8fd87ae8d3563a9","versionType":"git","status":"affected"},{"version":"9a57bacd574b52b08bc2c600af6a8c7a87049ecf","lessThan":"490599ab23134962a6d18a024e84541d77bdb999","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/meta/fbnic/fbnic_txrx.c","drivers/net/ethernet/meta/fbnic/fbnic_txrx.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/28fb764d670aa22dcbd2a02fd8fd87ae8d3563a9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/490599ab23134962a6d18a024e84541d77bdb999","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/60ef74357a36ed2a102a75bb68d37aa7f305b94e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98278","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:17.660","lastModified":"2026-10-19T10:18:29.243","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: remove WARN_ON_ONCE() from the dev_fill_forward_path() loop check\n\nipip_fill_forward_path() and ip6_tnl_fill_forward_path() look up the\nroute to the tunnel's remote endpoint and set ctx->dev to its device,\nwhich is the tunnel itself when that route resolves back to the tunnel.\ndev_fill_forward_path() then makes no progress and trips\nWARN_ON_ONCE(last_dev == ctx->dev) as soon as a flowtable tries to\noffload a flow through the tunnel. That routing loop is a configuration\nany CAP_NET_ADMIN user can set up, and ip_tunnel_xmit() and\nip6_tnl_xmit() already treat it as a tx error, so remove the warning and\njust fail the walk, as commit 008e7a7c293b (\"net: remove WARN_ON_ONCE\nwhen accessing forward path array\") did for the path stack overflow."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/core/dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ab427db17885814069bae891834f20842f0ac3a4","lessThan":"d8eb177632dacda28bc6130c2105afbf5b791eb0","versionType":"git","status":"affected"},{"version":"ab427db17885814069bae891834f20842f0ac3a4","lessThan":"150dba2c69e93302af24a0c868eebe4871e2e107","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/core/dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/150dba2c69e93302af24a0c868eebe4871e2e107","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d8eb177632dacda28bc6130c2105afbf5b791eb0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98279","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:17.783","lastModified":"2026-10-19T10:18:29.343","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: handle lack of space when cleaning up verity items\n\nWhen enable_verity() hits the qgroup limit, rollback_verity() needs its\nown metadata reservation. When the qgroup limit or lack of space refuses\nthe rollback, the whole filesystem is forced read-only even though the\nqgroup limit was for one subvolume only. Also orphan cleanup at the next\nmount fails the same way, so the leftover items are never removed: with\n-EDQUOT the subvolume stays unreachable, and with -ENOSPC on a full\nfilesystem the next read-write mount fails.\n\nStart transactions with btrfs_start_transaction_fallback_global_rsv() in\nbtrfs_orphan_cleanup(), drop_verity_items() and rollback_verity(). Those\ncalls only delete items and free the space in the end, so they may use\nthe global reserve and skip the qgroup limit, which avoids -ENOSPC and\n-EDQUOT."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/btrfs/inode.c","fs/btrfs/verity.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"146054090b0859b28fc39015c7704ccc3c3a347f","lessThan":"4b7ecabd87dc40998fe7870d7975279649229a3b","versionType":"git","status":"affected"},{"version":"146054090b0859b28fc39015c7704ccc3c3a347f","lessThan":"efa5780b84f066f419a667f6b9542368b2f62074","versionType":"git","status":"affected"},{"version":"146054090b0859b28fc39015c7704ccc3c3a347f","lessThan":"76bf149cd0298544631e756670b89c399c7acbca","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/btrfs/inode.c","fs/btrfs/verity.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/4b7ecabd87dc40998fe7870d7975279649229a3b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/76bf149cd0298544631e756670b89c399c7acbca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/efa5780b84f066f419a667f6b9542368b2f62074","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98280","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:17.910","lastModified":"2026-10-19T10:18:29.447","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/i2c: Disable IRQ on unbind\n\nCurrently, struct xe_i2c is freed before SGUnit IRQ is disabled in unbind\npath, leaving a potential UAF in case I2C IRQ is hit during this small\nwindow. Explicitly disable I2C IRQ in xe_i2c_remove() and fix this.\n\n(cherry picked from commit 8ba5c8b8ab3fd362267c11df2cd5a90ee46f6e24)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/xe/xe_i2c.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0bb78ce099265fba3808c05de1c75c649664a6cb","lessThan":"571ccbc801aa4d22a22d9f924b826c77052330f0","versionType":"git","status":"affected"},{"version":"0bb78ce099265fba3808c05de1c75c649664a6cb","lessThan":"f0e9f963a3d209d7dc7ddd61116118ab5da2797d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/xe/xe_i2c.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/571ccbc801aa4d22a22d9f924b826c77052330f0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f0e9f963a3d209d7dc7ddd61116118ab5da2797d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98281","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:18.040","lastModified":"2026-10-19T10:18:29.547","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Also allocate private hash on vfork()\n\nAs Jann demonstrated, it is entirely feasible to access the mm through vfork().\nTherefore we need to allocate a private hash on vfork() as well as any other\nCLONE_VM user.\n\nSpecifically, it must be avoided to have (private) futex waiters before\nallocating the private hash."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/fork.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1dcd36420af2da5bd59306dba9caf78e3d248b1d","lessThan":"5468a4855b63b30156a79e5248e01bf1a2c18dd7","versionType":"git","status":"affected"},{"version":"ee9dce44362b2d8132c32964656ab6dff7dfbc6a","lessThan":"eecbafa8cabbc4d1482f6a5e2acc25a8f934681b","versionType":"git","status":"affected"},{"version":"ee9dce44362b2d8132c32964656ab6dff7dfbc6a","lessThan":"b61b6f95d6722ddbbbd09e689fa41b55fd36f9a5","versionType":"git","status":"affected"},{"version":"974ac49a9a068b0591a59f65c63eb06579a13091","versionType":"git","status":"affected"},{"version":"6.18.33","lessThan":"6.18.54","versionType":"semver","status":"affected"},{"version":"7.0.10","lessThan":"7.1","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/fork.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/5468a4855b63b30156a79e5248e01bf1a2c18dd7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b61b6f95d6722ddbbbd09e689fa41b55fd36f9a5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eecbafa8cabbc4d1482f6a5e2acc25a8f934681b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98282","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:18.180","lastModified":"2026-10-19T10:18:29.667","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba\n\nThe commit b1af23d836f8 (\"KVM: PPC: iommu: Unify TCE checking\") unified\nIOBA parameter checking across KVM and VFIO into iommu_tce_check_ioba().\nWhile doing so, the passed in argument npages is ignored and constant\nvalue '1' is used leaving out a possible overflow as the callers can\nlegitimately be using npages > 1 for H_STUFF_TCE or H_PUT_TCE_INDIRECT\ncases.\n\nFix this by accounting for 'npages', checking for arithmetic overflow,\nand verifying that the entire requested range (ioba - offset + npages)\ndoes not exceed the table capacity 'size'."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/powerpc/kernel/iommu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b1af23d836f811137d504d14d4cbdd01929dec34","lessThan":"98d8dcc4ebd10523507d4478e148809a7771a213","versionType":"git","status":"affected"},{"version":"b1af23d836f811137d504d14d4cbdd01929dec34","lessThan":"9fd9c9bbb05417f468a11fb6d145d7ff61f4a868","versionType":"git","status":"affected"},{"version":"b1af23d836f811137d504d14d4cbdd01929dec34","lessThan":"3776bf56e06980e8a12c8c0565d9e6ac44965f03","versionType":"git","status":"affected"},{"version":"b1af23d836f811137d504d14d4cbdd01929dec34","lessThan":"d6a1779129d936bc1fbab80181165da544eab736","versionType":"git","status":"affected"},{"version":"b1af23d836f811137d504d14d4cbdd01929dec34","lessThan":"d48ceb6e1a6915c7bac4f902554a1047365cdff2","versionType":"git","status":"affected"},{"version":"b1af23d836f811137d504d14d4cbdd01929dec34","lessThan":"0543813753ef5cfbd6fa96694f7acf783fa01af7","versionType":"git","status":"affected"},{"version":"b1af23d836f811137d504d14d4cbdd01929dec34","lessThan":"314091243159f8e3749bc719bb129f423f72fd86","versionType":"git","status":"affected"},{"version":"b1af23d836f811137d504d14d4cbdd01929dec34","lessThan":"0b271f7d7f5ed45bc498a03ce0aa9cfd8402fc71","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/powerpc/kernel/iommu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.12","status":"affected"},{"version":"0","lessThan":"4.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0}]},"references":[{"url":"https://git.kernel.org/stable/c/0543813753ef5cfbd6fa96694f7acf783fa01af7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0b271f7d7f5ed45bc498a03ce0aa9cfd8402fc71","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/314091243159f8e3749bc719bb129f423f72fd86","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3776bf56e06980e8a12c8c0565d9e6ac44965f03","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/98d8dcc4ebd10523507d4478e148809a7771a213","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9fd9c9bbb05417f468a11fb6d145d7ff61f4a868","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d48ceb6e1a6915c7bac4f902554a1047365cdff2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d6a1779129d936bc1fbab80181165da544eab736","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98283","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:18.333","lastModified":"2026-10-19T10:18:29.817","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()\n\nkvmhv_emulate_tlbie_all_lpid() iterates the nested-guest IDR and drops\nmmu_lock before calling kvmhv_emulate_tlbie_lpid(), but does not hold a\nreference on the kvm_nested_guest pointer obtained from the IDR.  A\nconcurrent vCPU issuing a single-LPID tlbie (is=2, ric=2) can race\nthrough kvmhv_flush_nested() -> kvmhv_remove_nested() -> idr_remove /\n--refcnt -> kvmhv_release_nested() -> kfree(gp) in that window, leaving\nthe iterating vCPU with a dangling pointer.  The subsequent\nmutex_lock(&gp->tlb_lock) and accesses to gp->shadow_pgtable,\ngp->shadow_lpid and gp->l1_host all touch freed memory.  The free path\nis fully L1-controlled.\n\nFix this by incrementing gp->refcnt inside the loop before dropping\nmmu_lock, mirroring what kvmhv_get_nested() does, and releasing the\nreference with kvmhv_put_nested() after the per-guest work completes.\nThis is the same get/put discipline already used at every other\ncall site that drops mmu_lock while holding a nested-guest pointer."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/powerpc/kvm/book3s_hv_nested.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e3b6b4661527e821ffbe3db83952fdb1e6e47c49","lessThan":"4d8f7b1f586375df8bce23a0909566ad5e852259","versionType":"git","status":"affected"},{"version":"e3b6b4661527e821ffbe3db83952fdb1e6e47c49","lessThan":"e37fba1ba69385cff2d0e60b371ee19e7d1852d1","versionType":"git","status":"affected"},{"version":"e3b6b4661527e821ffbe3db83952fdb1e6e47c49","lessThan":"24b634852413229bb8340d908b115c3365f3a247","versionType":"git","status":"affected"},{"version":"e3b6b4661527e821ffbe3db83952fdb1e6e47c49","lessThan":"fbf69b7d0555ee83c871f58750770f74b7179ad1","versionType":"git","status":"affected"},{"version":"e3b6b4661527e821ffbe3db83952fdb1e6e47c49","lessThan":"ec2d7a52b3996ae81131617b4afc0af31583c1b4","versionType":"git","status":"affected"},{"version":"e3b6b4661527e821ffbe3db83952fdb1e6e47c49","lessThan":"51938dfa8a51a4f85328413fca9b6e21f9d2d088","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/powerpc/kvm/book3s_hv_nested.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.20","status":"affected"},{"version":"0","lessThan":"4.20","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0}]},"references":[{"url":"https://git.kernel.org/stable/c/24b634852413229bb8340d908b115c3365f3a247","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4d8f7b1f586375df8bce23a0909566ad5e852259","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/51938dfa8a51a4f85328413fca9b6e21f9d2d088","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e37fba1ba69385cff2d0e60b371ee19e7d1852d1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ec2d7a52b3996ae81131617b4afc0af31583c1b4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fbf69b7d0555ee83c871f58750770f74b7179ad1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98284","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:18.480","lastModified":"2026-10-19T10:18:29.960","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: do not free nlk->groups while lockless readers can use it\n\nnetlink_realloc_groups() uses krealloc() under netlink_table_grab().\nWhenever NLGRPSZ(groups) lands in a different kmalloc bucket, the old\nbitmap is freed immediately.\n\nTwo readers of nlk->groups / nlk->ngroups do not hold the netlink\ntable lock:\n\n1) sk_diag_dump_groups(). Hashed (bound) sockets are dumped from the\n   rhashtable walk in __netlink_diag_dump(), which only holds RCU.\n   Only the mc_list part of the dump takes nl_table_lock.\n\n2) netlink_native_seq_show() (/proc/net/netlink), whose walk has been\n   lockless since commit 21e4902aea80 (\"netlink: Lockless lookup with\n   RCU grace period in socket release\").\n\nBoth can read a freed buffer, and sk_diag_dump_groups() can also read\npast the end of the old (smaller) buffer if it happens to load the old\n@groups pointer together with the new @ngroups value, copying the\nresult into a NETLINK_DIAG_GROUPS attribute.\n\nThis is the same class of bug that commit f773608026ee (\"netlink:\naccess nlk groups safely in netlink bind and getname\") fixed for bind()\nand getname(); these two readers were missed. Simply grabbing the table\nlock in sk_diag_dump_groups() is not an option, because it is also\ncalled with nl_table_lock already held from the mc_list section of the\ndump.\n\nMake the lockless readers safe instead:\n\n- Allocate a new bitmap and free the old one after an RCU grace period,\n  instead of relying on the implicit kfree() done by krealloc().\n\n- Publish @groups before @ngroups, both with release semantics, and have\n  the lockless readers load @ngroups first. A reader can then never pair\n  the new (bigger) size with the old (smaller) buffer, and a reader\n  picking up the new pointer while still seeing the old size is\n  guaranteed to see the initialized bitmap.\n\nnetlink_realloc_groups() is called from process context (bind() and\nsetsockopt()), so kfree_rcu_mightsleep() can be used, once the table\nhas been released."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/netlink/af_netlink.c","net/netlink/diag.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"21e4902aea80ef35afc00ee8d2abdea4f519b7f7","lessThan":"22f313e211d58a66786c81487c3905fa5d4b2a8f","versionType":"git","status":"affected"},{"version":"21e4902aea80ef35afc00ee8d2abdea4f519b7f7","lessThan":"ceac0de741bfb47ca255eee075257b3bb31f0651","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/netlink/af_netlink.c","net/netlink/diag.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.0","status":"affected"},{"version":"0","lessThan":"4.0","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/22f313e211d58a66786c81487c3905fa5d4b2a8f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ceac0de741bfb47ca255eee075257b3bb31f0651","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98285","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:18.610","lastModified":"2026-10-19T10:18:30.067","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: vlan: fix bugs caused by switchdev deletion errors\n\nAllowing switchdev to prevent vlan deletion and error out in __vlan_del\ncould cause multiple different issues - inconsistent state, memory leaks\nwhen flushing, NULL pointer dereference on bridge error when flushing.\nIt doesn't make sense to allow it to stop __vlan_del, so log the error\nand continue with software vlan deletion. This is also consistent with\n8021q behaviour."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bridge/br_vlan.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bf361ad38165939049a2649b1a0078f3268d4bd1","lessThan":"ed3ea86db736a30bebf49b947c42730e8451bcd2","versionType":"git","status":"affected"},{"version":"bf361ad38165939049a2649b1a0078f3268d4bd1","lessThan":"2842ce397dd09882530b42f7fdb0c855767eb24e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bridge/br_vlan.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.3","status":"affected"},{"version":"0","lessThan":"4.3","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2842ce397dd09882530b42f7fdb0c855767eb24e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ed3ea86db736a30bebf49b947c42730e8451bcd2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98286","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:18.740","lastModified":"2026-10-19T10:18:30.170","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown\n\nIn drop_monitor teardown paths (net_dm_trace_off_set(),\nnet_dm_hw_monitor_stop(), and error unwind paths in net_dm_trace_on_set()\nand net_dm_hw_monitor_start()), per-CPU timers are stopped using\ntimer_delete_sync() followed by cancel_work_sync().\n\nHowever, there is a circular dependency between send_timer and\ndm_alert_work:\n1) sched_send_work() (timer callback) schedules dm_alert_work.\n2) send_dm_alert() / net_dm_hw_summary_work() calls reset_per_cpu_data()\n   or net_dm_hw_reset_per_cpu_data().\n3) If memory allocation fails under memory pressure in the reset\n   function, it re-arms the timer via mod_timer(&data->send_timer, ...).\n\nIf dm_alert_work is running concurrently while timer_delete_sync()\nexecutes on another CPU, an allocation failure in the worker will\nre-arm the timer after timer_delete_sync() has already returned.\nOnce cancel_work_sync() completes and module_put() is called, the timer\nremains active in the timer wheel. If the module is then unloaded, the\ntimer will fire and execute sched_send_work() in freed memory,\ntriggering a kernel panic / use-after-free.\n\nSwitch from timer_delete_sync() to timer_shutdown_sync(). This guarantees\nthat any in-flight timer handler has finished and prevents subsequent\nre-arming attempts from running workers from succeeding. When monitoring\nis restarted later, timer_setup() is invoked, which cleanly\nre-initializes the timer."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/core/drop_monitor.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9398e9c0b1d44eeb700e9e766c02bcc765c82570","lessThan":"9616b0c67fbd8cc0b49de7b26cdf2ab33747c80e","versionType":"git","status":"affected"},{"version":"9398e9c0b1d44eeb700e9e766c02bcc765c82570","lessThan":"bda4d9525fb91a2388ee09669421b8d505290864","versionType":"git","status":"affected"},{"version":"9398e9c0b1d44eeb700e9e766c02bcc765c82570","lessThan":"c391a40f71886b28c082b47270f0e856fa3e1150","versionType":"git","status":"affected"},{"version":"2514c7ad115e762562c7bdd58bb1ab3425a98245","versionType":"git","status":"affected"},{"version":"439b1164da3612ec7e186e1dc314471e7190bfc7","versionType":"git","status":"affected"},{"version":"5.10.27","lessThan":"5.11","versionType":"semver","status":"affected"},{"version":"5.11.11","lessThan":"5.12","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/core/drop_monitor.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.12","status":"affected"},{"version":"0","lessThan":"5.12","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/9616b0c67fbd8cc0b49de7b26cdf2ab33747c80e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bda4d9525fb91a2388ee09669421b8d505290864","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c391a40f71886b28c082b47270f0e856fa3e1150","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98287","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:18.880","lastModified":"2026-10-19T10:18:30.283","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npppoatm: ensure a writable skb header and linear data\n\nIn pppoatm_send(), LLC encapsulation checks whether there is sufficient\nheadroom for the 4-byte LLC header, but does not ensure that the skb header\nis writable.\n\nNormal transmit packets passing through ppp_start_xmit() have their header\nunshared via skb_cow_head(). However, packets can also reach pppoatm_send()\nvia PPP channel bridging (PPPIOCBRIDGECHAN) without going through\nppp_start_xmit().\n\nUse skb_cow_head() to ensure both sufficient headroom and a writable\nheader before pushing the LLC header.\n\nWhile at it:\n- Call pskb_may_pull(skb, 1) before inspecting skb->data[0] to prevent\n  out-of-bounds reads on zero-length or non-linear frames (e.g. from\n  bridging).\n- Defer SC_COMP_PROT protocol compression until after pppoatm_may_send()\n  succeeds. This eliminates the temporary skb allocation on admission failure\n  and completely removes the fragile \"undo\" heuristic at the nospace label,\n  avoiding any risk of reading uninitialized headroom or performing an\n  unbalanced skb_push()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/atm/pppoatm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4cf476ced45d7f12df30a68e833b263e7a2202d1","lessThan":"208ccc4d08b1897451e9ba01c016bf93ff107966","versionType":"git","status":"affected"},{"version":"4cf476ced45d7f12df30a68e833b263e7a2202d1","lessThan":"e6cd1bba7d113c15c00ac63671213a096fe4d686","versionType":"git","status":"affected"},{"version":"4cf476ced45d7f12df30a68e833b263e7a2202d1","lessThan":"ffc448eb54f5ba80d4212c1e870cdb92b0f709fa","versionType":"git","status":"affected"},{"version":"4cf476ced45d7f12df30a68e833b263e7a2202d1","lessThan":"8e66c5969acd859ba72fb0a7fa895623fc1b3769","versionType":"git","status":"affected"},{"version":"4cf476ced45d7f12df30a68e833b263e7a2202d1","lessThan":"e2f5529b0016db7d34f411408607f5cf395a542e","versionType":"git","status":"affected"},{"version":"4cf476ced45d7f12df30a68e833b263e7a2202d1","lessThan":"30992fe39e65589ed8e000425e088fa74994b811","versionType":"git","status":"affected"},{"version":"4cf476ced45d7f12df30a68e833b263e7a2202d1","lessThan":"ecc7253683a3c55caa868ce0ee530fcb0044bd3c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/atm/pppoatm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.11","status":"affected"},{"version":"0","lessThan":"5.11","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/208ccc4d08b1897451e9ba01c016bf93ff107966","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/30992fe39e65589ed8e000425e088fa74994b811","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8e66c5969acd859ba72fb0a7fa895623fc1b3769","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e2f5529b0016db7d34f411408607f5cf395a542e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e6cd1bba7d113c15c00ac63671213a096fe4d686","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ecc7253683a3c55caa868ce0ee530fcb0044bd3c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ffc448eb54f5ba80d4212c1e870cdb92b0f709fa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98288","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:19.030","lastModified":"2026-10-19T10:18:30.407","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: fix TSO header length truncation\n\nstmmac_tso_xmit() stores the protocol header length returned by\nstmmac_tso_header_size() in a u8. stmmac_tso_valid_packet() admits\nheaders up to 1023 bytes, so a header longer than 255 bytes wraps modulo\n256 (486 becomes 230, 256 becomes 0).\n\nA TCP over IPv6 socket carrying a few hundred bytes of sticky\ndestination/hop-by-hop options makes skb_tcp_all_headers() exceed 255\nwhile staying below the 1023-byte limit, so such an skb reaches\nstmmac_tso_xmit().\n\nWiden proto_hdr_len to unsigned int, which is sufficient since the value\nis bounded by the hardware limit, and adjust the debug print specifier\naccordingly."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9edfa7dab8112a012b349b7937f5444fdc21e8f9","lessThan":"bcf6013c2b4d732c6e4bf4d0f6ae4a18d63d414b","versionType":"git","status":"affected"},{"version":"9edfa7dab8112a012b349b7937f5444fdc21e8f9","lessThan":"15989abd74f16f44bf953d056b95f1d2fda9b0cd","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.13","status":"affected"},{"version":"0","lessThan":"4.13","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/15989abd74f16f44bf953d056b95f1d2fda9b0cd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bcf6013c2b4d732c6e4bf4d0f6ae4a18d63d414b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98289","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:19.177","lastModified":"2026-10-19T10:18:30.560","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Unify scc_index when finalising SCC in __unix_walk_scc().\n\nCommit bfdb01283ee8 (\"af_unix: Assign a unique index to SCC.\")\nchanged Tarjan's algorithm to update lowlink with lowlink,\nwhich is called lowpoint (unix_vertex.scc_index).\n\nunix_vertex_dead() assumes all vertices in an SCC share the same\nlowpoint, but this is not always true if an SCC has two or more\nback edges, depending on the order of DFS.\n\nFor example, the graph below has two back edges from B to A\nand from C to B.\n\n  A --> B --> C\n  ^    | ^    |\n  `----' `----'\n\nIf DFS walks through A -> B -> C -> B (-> C -> B) -> A (-> B -> A),\neach index and scc_index will be updated as follows.\n\n  A --> B --> C    C = (3, 3)  (index, scc_index)\n                   B = (2, 2)\n                   A = (1, 1)\n\n  A ... B ... C    C = (3, 2)<-.\n         ^    |    B = (2, 2) -'\n         `----'    A = (1, 1)\n\n  A ... B ... C    C = (3, 2)\n  ^    | .    .    B = (2, 1)<-.\n  `----'  ....     A = (1, 1) -'\n\nThen, unix_vertex_dead() thinks that B is passed to another\nSCC with scc_index 2, and the SCC is not garbage-collected.\n\nThis does not happen if DFS walks in a different order below\nor starts from B.\n\n    1      3\n  A --> B --> C\n  ^    | ^    |\n  `----' `----'\n     2      4\n\nLet's unify scc_index across the SCC when finalising it.\n\nNote that updating v->index was previously done in unix_scc_dead(),\nwhen called from __unix_walk_scc(), just to save one loop.  Since\n__unix_walk_scc() now iterates over the SCC anyway, the update is\nmoved back to __unix_walk_scc() and 'fast' argument is dropped."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/unix/garbage.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4090fa373f0e763c43610853d2774b5979915959","lessThan":"b8f71d69380a5fbc734c868acbeb560f1de1766f","versionType":"git","status":"affected"},{"version":"4090fa373f0e763c43610853d2774b5979915959","lessThan":"be550ee108ad80828aa61280400bedfc7e7c39d3","versionType":"git","status":"affected"},{"version":"4090fa373f0e763c43610853d2774b5979915959","lessThan":"4a4263dfeabad72f95e8ab6e15146861fa4144dd","versionType":"git","status":"affected"},{"version":"5dfd283f4651d04dbb70ceb9ae5c4a30eda3c52a","versionType":"git","status":"affected"},{"version":"de7921631ff323369aa63a4324695ab54ea4047e","versionType":"git","status":"affected"},{"version":"6.1.141","lessThan":"6.2","versionType":"semver","status":"affected"},{"version":"6.6.93","lessThan":"6.7","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/unix/garbage.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/4a4263dfeabad72f95e8ab6e15146861fa4144dd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b8f71d69380a5fbc734c868acbeb560f1de1766f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/be550ee108ad80828aa61280400bedfc7e7c39d3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98290","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:19.317","lastModified":"2026-10-19T10:18:30.680","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: avoid socket lock inversion in listener cleanup\n\nrfcomm_sock_cleanup_listen() closes unaccepted child sockets through\nrfcomm_sock_close(), which takes the child socket lock before\nrfcomm_dlc_close() acquires rfcomm_mutex. The RFCOMM worker takes these\nlocks in reverse order while handling connections and DLC state changes,\nso lockdep reports a possible deadlock.\n\nClose dequeued children without taking their socket lock. The accept queue\nowns a reference to each child, and bt_accept_dequeue() locks the child\nwhile unlinking it and clearing its parent pointer.\n\nDropping the child lock makes it important to prevent a concurrent\nrfcomm_connect_ind() from enqueueing a new child after cleanup observes an\nempty queue. Set a listening socket to BT_CLOSED while its lock is still\nheld, before dropping the lock and draining the queue. The state check in\nrfcomm_connect_ind() then rejects new children once cleanup starts."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/rfcomm/sock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b7ce436a5d798bc59e71797952566608a4b4626b","lessThan":"eb4adaa46e4c9e6efa7be3ce06398f4d7c39b57c","versionType":"git","status":"affected"},{"version":"b7ce436a5d798bc59e71797952566608a4b4626b","lessThan":"4aafb47301a799d3e01230d6568c4e93524e1523","versionType":"git","status":"affected"},{"version":"b7ce436a5d798bc59e71797952566608a4b4626b","lessThan":"c741977e413f5b49d306700820fb55ccb8269f5a","versionType":"git","status":"affected"},{"version":"b7ce436a5d798bc59e71797952566608a4b4626b","lessThan":"c6792c441767256030606eb82dca5d5fc360dd9a","versionType":"git","status":"affected"},{"version":"b7ce436a5d798bc59e71797952566608a4b4626b","lessThan":"bfce253f039eb5f58b810af267942a9f59207254","versionType":"git","status":"affected"},{"version":"b7ce436a5d798bc59e71797952566608a4b4626b","lessThan":"18174b166547ef41973cc19feb5ef9cab39a8def","versionType":"git","status":"affected"},{"version":"b7ce436a5d798bc59e71797952566608a4b4626b","lessThan":"801fb950cae7048eb7d83b18857d1ca37b8cd5a4","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/rfcomm/sock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/18174b166547ef41973cc19feb5ef9cab39a8def","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4aafb47301a799d3e01230d6568c4e93524e1523","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/801fb950cae7048eb7d83b18857d1ca37b8cd5a4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bfce253f039eb5f58b810af267942a9f59207254","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c6792c441767256030606eb82dca5d5fc360dd9a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c741977e413f5b49d306700820fb55ccb8269f5a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eb4adaa46e4c9e6efa7be3ce06398f4d7c39b57c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98291","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:19.467","lastModified":"2026-10-19T10:18:30.833","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel_pcie: fix off-by-one bounds check in RX submit\n\nbtintel_pcie_submit_rx() used frbd_index > rxq->count to guard the\nFRBD array access, allowing frbd_index == rxq->count to pass through\nand index one element past the end of the array. Change the check to\n>= rxq->count so every out-of-range index is rejected.\n\nThis issue was reported by Claude Mythos."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/bluetooth/btintel_pcie.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c2b636b3f788d10486a6691ad6dd3ec4c93bd78e","lessThan":"b5214d72bfdf8ef7744d0c8147e6ebb09b36b259","versionType":"git","status":"affected"},{"version":"c2b636b3f788d10486a6691ad6dd3ec4c93bd78e","lessThan":"18464860ce27af0dccd2fc72830610b85b518cff","versionType":"git","status":"affected"},{"version":"c2b636b3f788d10486a6691ad6dd3ec4c93bd78e","lessThan":"de4c3c72bcc6e8474f70c22427f94ca44bccd890","versionType":"git","status":"affected"},{"version":"c2b636b3f788d10486a6691ad6dd3ec4c93bd78e","lessThan":"2ea5a87a5a7ae58cb2662b8a7d06f209383e1765","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/bluetooth/btintel_pcie.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/18464860ce27af0dccd2fc72830610b85b518cff","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2ea5a87a5a7ae58cb2662b8a7d06f209383e1765","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b5214d72bfdf8ef7744d0c8147e6ebb09b36b259","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/de4c3c72bcc6e8474f70c22427f94ca44bccd890","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98292","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:19.603","lastModified":"2026-10-19T10:18:30.940","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access\n\nbtmtksdio.c and btmtkuart.c cast a received WMT event straight to\nstruct btmtk_hci_wmt_evt and read its op/flag fields without checking\nthe event is long enough to contain them, unlike btmtk.c. The\nFUNC_CTRL case then further casts to struct btmtk_hci_wmt_evt_funcc\nand reads its 2-byte status field, again without a length check.\nFirmware that sends a short or malformed WMT event makes both drivers\nread past the end of the received SKB.\n\nMirror btmtk.c: validate the base WMT header with skb_pull_data()\nbefore touching any of its fields, and when a FUNC_CTRL event turns\nout to be the short, header-only form (a plain enable/disable ack\nwith no status word), decode the result from the header's own flag\nbyte instead (0 = success, otherwise failure).\n\nVerified setup on MT7920, MT7921, MT7922 and MT7925: no regression."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/bluetooth/btmtksdio.c","drivers/bluetooth/btmtkuart.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e0b67035a90b58d01f911fed77b6e3da153da66e","lessThan":"5a5cfd8488c97e1b8939515429fe4c81e9f2df4f","versionType":"git","status":"affected"},{"version":"e0b67035a90b58d01f911fed77b6e3da153da66e","lessThan":"8879e3e0a84a86954c855caceead4867e74a9a27","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/bluetooth/btmtksdio.c","drivers/bluetooth/btmtkuart.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.1","status":"affected"},{"version":"0","lessThan":"5.1","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5a5cfd8488c97e1b8939515429fe4c81e9f2df4f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8879e3e0a84a86954c855caceead4867e74a9a27","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98293","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:19.727","lastModified":"2026-10-19T10:18:31.057","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: Fix parent socket leak in iso_conn_ready()\n\niso_get_sock() returns the parent socket with a reference held, which is\ndropped by sock_put() once the child socket has been set up. The error\npath taken when iso_sock_alloc() fails only calls release_sock() and\nreturns, leaking the reference and thus the parent socket itself.\n\nDrop the reference on that path as well."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/iso.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"11dc486ed5d4626e6b92a23b67ed76cb6c48bfc9","lessThan":"ea8a262662be62c095789924c11722ecbf40a4de","versionType":"git","status":"affected"},{"version":"fa224d0c094a458e9ebf5ea9b1c696136b7af427","lessThan":"9228f87365e68a6cae191f57f456e89a6d2167cf","versionType":"git","status":"affected"},{"version":"fa224d0c094a458e9ebf5ea9b1c696136b7af427","lessThan":"e2b156a8d25966be49c1f809b654a2c4bb16564d","versionType":"git","status":"affected"},{"version":"fa224d0c094a458e9ebf5ea9b1c696136b7af427","lessThan":"f016daabd4fec4e9b8563f8b6f42eabce0ca66b0","versionType":"git","status":"affected"},{"version":"fa224d0c094a458e9ebf5ea9b1c696136b7af427","lessThan":"ca18ee413a7cb6f09885778039225e58bae0d607","versionType":"git","status":"affected"},{"version":"6.6.67","lessThan":"6.6.158","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/iso.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/9228f87365e68a6cae191f57f456e89a6d2167cf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ca18ee413a7cb6f09885778039225e58bae0d607","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e2b156a8d25966be49c1f809b654a2c4bb16564d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ea8a262662be62c095789924c11722ecbf40a4de","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f016daabd4fec4e9b8563f8b6f42eabce0ca66b0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98294","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:19.887","lastModified":"2026-10-19T10:18:31.170","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_qca: Do not write to the serial port after it is closed\n\nhci_uart_close() closes the serdev port if HCI_QUIRK_NON_PERSISTENT_SETUP\nis set (for example, for the WCN399x family). A failed hci_dev_open_sync()\nfollowing a successful qca_setup() calls hdev->close() but not\nhdev->shutdown(), so the port is closed while power->vregs_on is left true.\nqca_serdev_remove() then passes its power->vregs_on test and calls\nqca_power_off(), which writes to the closed port unconditionally.\n\nSeen on a WCN3988 by unbinding the driver after a controller failure. The\ntrace below is from a 7.0.0 based kernel, where qca_power_off() was still\nnamed qca_power_shutdown():\n\n  Unable to handle kernel NULL pointer dereference at virtual address\n  0000000000000038\n  Call trace:\n   tty_set_termios+0x50/0x238 (P)\n   ttyport_set_baudrate+0x84/0xc0\n   serdev_device_set_baudrate+0x24/0x40\n   qca_power_shutdown+0x158/0x1fc [hci_uart]\n   qca_serdev_remove+0x54/0x68 [hci_uart]\n   serdev_drv_remove+0x1c/0x2c\n   device_remove+0x4c/0x80\n   device_release_driver_internal+0x1cc/0x224\n   device_driver_detach+0x18/0x24\n   unbind_store+0xb4/0xc0\n\nCheck HCI_UART_PROTO_READY, which hci_uart_close() clears in the same place\nit closes the port, before writing to it. The regulator disable is left\nunconditional so the controller is still powered down.\n\nThe dangling serport->tty that turns this into a use-after-free is\naddressed in a separate patch."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/bluetooth/hci_qca.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fa9ad876b8e0ebd2b4367ef1580f89be64ebd5d3","lessThan":"a5414b0a9464b863733c8bd97493cb443a210ec4","versionType":"git","status":"affected"},{"version":"fa9ad876b8e0ebd2b4367ef1580f89be64ebd5d3","lessThan":"15754e4ec47ac5d117c9609c34a49ed6980ac4a1","versionType":"git","status":"affected"},{"version":"fa9ad876b8e0ebd2b4367ef1580f89be64ebd5d3","lessThan":"4e93c65f87825e1e012bce56615320aeb123815d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/bluetooth/hci_qca.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.19","status":"affected"},{"version":"0","lessThan":"4.19","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/15754e4ec47ac5d117c9609c34a49ed6980ac4a1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4e93c65f87825e1e012bce56615320aeb123815d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a5414b0a9464b863733c8bd97493cb443a210ec4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98295","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:20.133","lastModified":"2026-10-19T10:18:31.283","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: coredump: Quiesce dump work on unregister\n\nhci_devcd_handle_pkt_init() arms dump_timeout and coredump producers\nqueue dump_rx without holding an hdev reference. Unregister leaves both\nworks live, so disconnecting during an active dump lets them access hdev\nafter hci_release_dev() frees it.\n\nShut down coredump processing during unregister. Close the producer gate\nunder dump_q.lock before disabling both works, then free the active buffer\nand queued packets under hci_dev_lock. Serializing the gate with enqueue\nprevents controller-specific workers from adding packets after the final\npurge."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/net/bluetooth/coredump.h","net/bluetooth/coredump.c","net/bluetooth/hci_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9695ef876fd122cb7bbc04a4a93b8727d2e36bda","lessThan":"24af375d7d8aa5f698e4dc41317102f44114351a","versionType":"git","status":"affected"},{"version":"9695ef876fd122cb7bbc04a4a93b8727d2e36bda","lessThan":"dcaf10ef27f928568c25de3e9fc242e538de5c67","versionType":"git","status":"affected"},{"version":"9695ef876fd122cb7bbc04a4a93b8727d2e36bda","lessThan":"82699d1b727ba5980b94f1eb8dc3d346f41b7c67","versionType":"git","status":"affected"},{"version":"9695ef876fd122cb7bbc04a4a93b8727d2e36bda","lessThan":"d236517c264e41dc09833c708ef23bccb7a91219","versionType":"git","status":"affected"},{"version":"deb8156ebe5cb63a5988e7f86cc46aa062527c2b","versionType":"git","status":"affected"},{"version":"6.1.188","lessThan":"6.2","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/net/bluetooth/coredump.h","net/bluetooth/coredump.c","net/bluetooth/hci_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.4","status":"affected"},{"version":"0","lessThan":"6.4","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/24af375d7d8aa5f698e4dc41317102f44114351a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/82699d1b727ba5980b94f1eb8dc3d346f41b7c67","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d236517c264e41dc09833c708ef23bccb7a91219","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dcaf10ef27f928568c25de3e9fc242e538de5c67","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98296","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:20.280","lastModified":"2026-10-19T10:18:31.397","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel_pcie: validate TX skb length in send_sync\n\nbtintel_pcie_prepare_tx() copies skb->len bytes into a fixed\nBTINTEL_PCIE_BUFFER_SIZE (4096) DMA slot via an unchecked memcpy.\nOversized packets are currently rejected only in\nbtintel_pcie_send_frame(); any future caller of\nbtintel_pcie_send_sync() would silently overflow the DMA buffer.\n\nAdd the bounds check in btintel_pcie_send_sync() itself, right\nbefore skb_push() and the DMA copy."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/bluetooth/btintel_pcie.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6e65a09f927566f257322358d429b267548473eb","lessThan":"84f353256e170dc4865d45007d1bc446ed566da7","versionType":"git","status":"affected"},{"version":"6e65a09f927566f257322358d429b267548473eb","lessThan":"c298a61e18029401486c40298a50fbeea7e7b663","versionType":"git","status":"affected"},{"version":"6e65a09f927566f257322358d429b267548473eb","lessThan":"4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/bluetooth/btintel_pcie.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/4b837ebd0ea21ae5cc26f02dc042edc6fe7b46b9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/84f353256e170dc4865d45007d1bc446ed566da7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c298a61e18029401486c40298a50fbeea7e7b663","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98297","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:20.400","lastModified":"2026-10-21T13:21:26.010","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: Fix queuing tx_work after workqueue is drained\n\nhci_send_acl(), hci_send_sco() and hci_send_iso() queue hdev->tx_work\nunconditionally. They can run from the L2CAP/SCO/ISO socket send path\nwhile hci_dev_close_sync() is draining hdev->workqueue (HCIDEVDOWN\nracing with a socket write). Since that queue_work() is not chained\nwork from the tx_work worker itself, __queue_work() sees the queue\nmarked __WQ_DRAINING, warns \"cannot queue %ps on wq %s\", and drops\nthe work:\n\n  WARNING: CPU: 1 PID: 5985 at kernel/workqueue.c:2352 __queue_work\n  Call Trace:\n   queue_work_on\n   l2cap_chan_send\n   l2cap_sock_sendmsg\n   ...\n\nhci_dev_close_sync() already sets HCI_CMD_DRAIN_WORKQUEUE before\ndraining, but only hci_cmd_work() and handle_cmd_cnt_and_timer()\ncheck it before queuing. Route the tx_work producers through the\nsame guard via a shared hci_sched_tx() helper."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/hci_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7b81c1378b79c3143ca3fdb3d18ac0f01cbabb21","lessThan":"8010212197d4a3ee714f78ed77048d0b712ff925","versionType":"git","status":"affected"},{"version":"9cebe4680bb9a72f80c6541eb24af06db7a1fbc9","lessThan":"ab0678a0701ac4de499428dc1b321659bb74d272","versionType":"git","status":"affected"},{"version":"47330cc875b36a1cf7b3543cb2cf90a7c603ce0e","lessThan":"e220c1242a643d97102a79f09b7ef3aa31276961","versionType":"git","status":"affected"},{"version":"525daaea459fc215f432de1b8debbd9144bf97b0","lessThan":"cbb325bc150e8c0dbce004ac0e5516bcffc0de31","versionType":"git","status":"affected"},{"version":"525daaea459fc215f432de1b8debbd9144bf97b0","lessThan":"6610c6fe4b8936c232048e6049bf77c70a6f759c","versionType":"git","status":"affected"},{"version":"60bceb9a4c693e68cc90ba4b2dfb9e000e8638ff","versionType":"git","status":"affected"},{"version":"6.12.93","lessThan":"6.12.112","versionType":"semver","status":"affected"},{"version":"6.18.35","lessThan":"6.18.54","versionType":"semver","status":"affected"},{"version":"7.0.12","lessThan":"7.1","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/hci_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/6610c6fe4b8936c232048e6049bf77c70a6f759c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8010212197d4a3ee714f78ed77048d0b712ff925","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ab0678a0701ac4de499428dc1b321659bb74d272","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cbb325bc150e8c0dbce004ac0e5516bcffc0de31","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e220c1242a643d97102a79f09b7ef3aa31276961","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98298","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:20.537","lastModified":"2026-10-19T10:18:31.620","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()\n\nIn mmp_pdma_prep_slave_sg(), for_each_sg() iterates the scatterlist\nputting each entry into 'sg', but the entry length is read from 'sgl'\n(the list head) instead of 'sg' (the current entry):\n\n    for_each_sg(sgl, sg, sg_len, i) {\n        addr = sg_dma_address(sg);\n        avail = sg_dma_len(sgl);   /* should be 'sg' */\n\nConsequently 'avail' is always the length of the first entry. For\nmulti-sg lists this causes out-of-bounds reads when a later entry is\nshorter than the first, and silent data loss when it is longer.\nSingle-sg or uniformly-sized lists happen to mask the issue."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/dma/mmp_pdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c8acd6aa6bed3c0fd7898202f4ebc534db9085f2","lessThan":"f448a5f5bd10d792440a1b08cf2e8f311767032d","versionType":"git","status":"affected"},{"version":"c8acd6aa6bed3c0fd7898202f4ebc534db9085f2","lessThan":"2148db529f082d6e3ca95413bf943442f4ef30cc","versionType":"git","status":"affected"},{"version":"c8acd6aa6bed3c0fd7898202f4ebc534db9085f2","lessThan":"d920c07aa6d89ec11afdb6976aafaee9563a5234","versionType":"git","status":"affected"},{"version":"c8acd6aa6bed3c0fd7898202f4ebc534db9085f2","lessThan":"4a33886057e6d127555efb022879c583e966acc5","versionType":"git","status":"affected"},{"version":"c8acd6aa6bed3c0fd7898202f4ebc534db9085f2","lessThan":"88a505330eb06128f7ce79a4c5e4832b7601b3d1","versionType":"git","status":"affected"},{"version":"c8acd6aa6bed3c0fd7898202f4ebc534db9085f2","lessThan":"bae65e4925928f77824ca0103122e2ed20ef5802","versionType":"git","status":"affected"},{"version":"c8acd6aa6bed3c0fd7898202f4ebc534db9085f2","lessThan":"54ccc01012a240476edf641bf1a2b8bff54fe6ae","versionType":"git","status":"affected"},{"version":"c8acd6aa6bed3c0fd7898202f4ebc534db9085f2","lessThan":"075bc7b1d3dde5ed43fbaabbc1a69f09b7fc3a47","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/dma/mmp_pdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.7","status":"affected"},{"version":"0","lessThan":"3.7","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/075bc7b1d3dde5ed43fbaabbc1a69f09b7fc3a47","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2148db529f082d6e3ca95413bf943442f4ef30cc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4a33886057e6d127555efb022879c583e966acc5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/54ccc01012a240476edf641bf1a2b8bff54fe6ae","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/88a505330eb06128f7ce79a4c5e4832b7601b3d1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bae65e4925928f77824ca0103122e2ed20ef5802","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d920c07aa6d89ec11afdb6976aafaee9563a5234","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f448a5f5bd10d792440a1b08cf2e8f311767032d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98299","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:20.697","lastModified":"2026-10-19T10:18:31.743","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: do not let tcp_rmem be set below 4096\n\nWe can hit a division by zero crash in tcp_rcvbuf_grow()\nand tcp_rcv_space_adjust():\n\ndivide error: 0000 [#1] PREEMPT SMP\nRIP: 0010:tcp_rcvbuf_grow+0x187/0x450 net/ipv4/tcp_input.c:939\n...\ngrow = div_u64(((u64)rcvwin << 1) * (newval - oldval), oldval);\n\nThe division uses oldval = tp->rcvq_space.space as divisor.\nWhen tp->rcvq_space.space is zero, this leads to a divide-by-zero\nexception.\n\ntp->rcvq_space.space is initialized in tcp_init_buffer_space():\n    tp->rcvq_space.space = min3(tp->rcv_ssthresh, tp->rcv_wnd,\n                                (u32)TCP_INIT_CWND * tp->advmss);\n\nIf tcp_rmem[1] is configured to very small values (such as 1),\nsk->sk_rcvbuf is initialized to 1. Then tcp_full_space(sk), which\ncomputes (sk->sk_rcvbuf * scaling_ratio) >> 8, truncates to 0.\nThis sets tp->window_clamp = 0, tp->rcv_ssthresh = 0, and\ntp->rcvq_space.space = 0. Later, when data arrives and DRS is invoked,\ntcp_rcvbuf_grow() divides by oldval == 0.\n\nBack in 2015, commit b1cb59cf2efe (\"net: sysctl_net_core: check SNDBUF\nand RCVBUF for min length\") ensured that net.core.rmem_default and\nnet.core.rmem_max cannot be set below SOCK_MIN_RCVBUF. Similarly,\nSO_RCVBUF setsockopt enforces max_t(int, val * 2, SOCK_MIN_RCVBUF).\n\nHowever, net.ipv4.tcp_rmem still had .extra1 = SYSCTL_ONE, allowing\narbitrarily small values.\n\nBecause SOCK_MIN_RCVBUF depends on sizeof(struct sk_buff) and cacheline\nalignment, its value varies across architectures and configuration options.\nUsing a fixed constant of 4096 ensures a predictable, architecture-\nindependent lower bound that is safely above SOCK_MIN_RCVBUF everywhere\nand matches the documented 4K default.\n\nFix this by setting tcp_rmem.extra1 to 4096 and updating the documentation."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["Documentation/networking/ip-sysctl.rst","net/ipv4/sysctl_net_ipv4.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"879907631b9e70eedb62d76461b29afa106ebe7a","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"8e32532d0fa3191ecf9524b0e6bafa0832e712ba","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"67b83c15bed9eeeb8d1a6dbf88a5f79525970173","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"9a4f49bf8d2da4e52e904f60c29cca317bab9b3a","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"60df201dbb19a1bf6478b56d100f7ae1fe90e46a","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"7898bda1ebc198f5559b301a96dd5398edd4d4d3","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"1c4bb940c3bb4325bb88ac1b7eaf5faaa39e7d63","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"83a945a529d6e002dd7339c532288a931f463dba","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["Documentation/networking/ip-sysctl.rst","net/ipv4/sysctl_net_ipv4.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1c4bb940c3bb4325bb88ac1b7eaf5faaa39e7d63","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/60df201dbb19a1bf6478b56d100f7ae1fe90e46a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/67b83c15bed9eeeb8d1a6dbf88a5f79525970173","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7898bda1ebc198f5559b301a96dd5398edd4d4d3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/83a945a529d6e002dd7339c532288a931f463dba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/879907631b9e70eedb62d76461b29afa106ebe7a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8e32532d0fa3191ecf9524b0e6bafa0832e712ba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9a4f49bf8d2da4e52e904f60c29cca317bab9b3a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98300","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:20.867","lastModified":"2026-10-19T10:18:31.887","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().\n\ntcp_v6_do_rcv() no longer calls skb_clone_and_charge_r() for\nTCP_LISTEN since commit 073d89808c06 (\"net: fix data-races around\nsk->sk_forward_alloc\").\n\nHowever, there is still a small race window between tcp_v6_rcv()\nand tcp_v6_do_rcv(), where concurrent close() changes TCP_LISTEN\nto TCP_CLOSE, causing skb_clone_and_charge_r() to be called\nlocklessly and resulting in the splat below. [0]\n\nLet's avoid calling skb_clone_and_charge_r() for TCP_CLOSE as well.\n\nThis is fine for non-listeners because tcp_rcv_state_process()\ndrops skb for TCP_CLOSE and opt_skb was freed immediately anyway.\n\n[0]:\nsk->sk_forward_alloc\nWARNING: net/ipv4/af_inet.c:162 at inet_sock_destruct+0x64d/0x810 net/ipv4/af_inet.c:162, CPU#1: ksoftirqd/1/28\nModules linked in:\nCPU: 1 UID: 0 PID: 28 Comm: ksoftirqd/1 Not tainted 7.2.0 #17 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1 04/01/2014\nRIP: 0010:inet_sock_destruct+0x64d/0x810 net/ipv4/af_inet.c:162\nCode: 3d 49 ff e9 06 fd ff ff e8 d0 5b 83 f8 90 0f 0b 90 e9 35 fe ff ff e8 c2 5b 83 f8 90 0f 0b 90 e9 c5 fe ff ff e8 b4 5b 83 f8 90 <0f> 0b 90 e9 04 ff ff ff e8 a6 5b 83 f8 90 0f 0b 90 e9 65 fe ff ff\nRSP: 0018:ffffc90000677bb8 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffff8880117bde80 RCX: ffffffff8957eb41\nRDX: ffff88801dad5d00 RSI: ffffffff8957ec3c RDI: 0000000000000005\nRBP: 00000000fffff000 R08: ffffffff8957eb41 R09: 00000000fffff000\nR10: 0000000000000005 R11: 0000000000000000 R12: dffffc0000000000\nR13: ffff8880117bdf10 R14: ffffffff81c08eb7 R15: 0000000000000003\nFS:  0000000000000000(0000) GS:ffff8880d7ae5000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f93a1021138 CR3: 00000000207a9000 CR4: 0000000000350ef0\nCall Trace:\n <TASK>\n __sk_destruct+0x82/0xae0 net/core/sock.c:2356\n rcu_do_batch kernel/rcu/tree.c:2645 [inline]\n rcu_core+0x59c/0x1100 kernel/rcu/tree.c:2897\n handle_softirqs+0x1e4/0x9b0 kernel/softirq.c:622\n run_ksoftirqd kernel/softirq.c:1076 [inline]\n run_ksoftirqd+0x38/0x60 kernel/softirq.c:1068\n smpboot_thread_fn+0x458/0xc80 kernel/smpboot.c:160\n kthread+0x396/0x4a0 kernel/kthread.c:436\n ret_from_fork+0x8e0/0xe40 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n </TASK>"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv6/tcp_ipv6.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e994b2f0fb9229aeff5eea9541320bd7b2ca8714","lessThan":"a23a3bc5004df6434de05797e0b6b2ecf864b86a","versionType":"git","status":"affected"},{"version":"e994b2f0fb9229aeff5eea9541320bd7b2ca8714","lessThan":"1cb7f292a337fdc72a8219bcd9d40a9cf5e86db5","versionType":"git","status":"affected"},{"version":"e994b2f0fb9229aeff5eea9541320bd7b2ca8714","lessThan":"7d94602e77a4525611afebb23149145ac242afd7","versionType":"git","status":"affected"},{"version":"e994b2f0fb9229aeff5eea9541320bd7b2ca8714","lessThan":"b727e3d58cb906f1506c1334dfba71fbb1338339","versionType":"git","status":"affected"},{"version":"e994b2f0fb9229aeff5eea9541320bd7b2ca8714","lessThan":"3e3394a13b603cc79b6a35480b8e20df6c716944","versionType":"git","status":"affected"},{"version":"e994b2f0fb9229aeff5eea9541320bd7b2ca8714","lessThan":"619bfbaacbff6a9822923f69f6af29d7f66a870c","versionType":"git","status":"affected"},{"version":"e994b2f0fb9229aeff5eea9541320bd7b2ca8714","lessThan":"56d38839ef0bff6526d9bd73b6811bd00316b21c","versionType":"git","status":"affected"},{"version":"e994b2f0fb9229aeff5eea9541320bd7b2ca8714","lessThan":"8e759cd1f6444a946bd1fd2b2b29eea582eea1d5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv6/tcp_ipv6.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.4","status":"affected"},{"version":"0","lessThan":"4.4","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1cb7f292a337fdc72a8219bcd9d40a9cf5e86db5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3e3394a13b603cc79b6a35480b8e20df6c716944","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/56d38839ef0bff6526d9bd73b6811bd00316b21c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/619bfbaacbff6a9822923f69f6af29d7f66a870c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7d94602e77a4525611afebb23149145ac242afd7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8e759cd1f6444a946bd1fd2b2b29eea582eea1d5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a23a3bc5004df6434de05797e0b6b2ecf864b86a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b727e3d58cb906f1506c1334dfba71fbb1338339","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98301","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:21.037","lastModified":"2026-10-19T10:18:32.027","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mst: move switchdev call outside rcu\n\nThis is a follow-up of one of sashiko's pre-existing bug reports.\nbr_mst_set_state() calls switchdev_port_attr_set() for nonzero MSTIs\nwhile holding rcu_read_lock() which invokes the blocking switchdev\nnotifier chain and may sleep. Nonzero MSTI changes come from netlink\nwith rtnl held. Move the switchdev call before entering the rcu section and\nassert that rtnl is held.\n\nThe call cannot be deferred because netlink needs its error and extack.\nAlso DSA reads the old bridge MST state during the callback and checks it.\nA deferred callback will be late and will see the updated state."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bridge/br_mst.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8ca9a750fc711911ef616ceb627d07357b04545e","lessThan":"b9661fd2423fc25e91e0517ecc0b6156ad83e3a8","versionType":"git","status":"affected"},{"version":"4488617e5e995a09abe4d81add5fb165674edb59","lessThan":"6b431b63219853eef4054e2f1cb073d2ca2059b4","versionType":"git","status":"affected"},{"version":"3a7c1661ae1383364cd6092d851f5e5da64d476b","lessThan":"abf734d150c61acfdfee102169d0e5d1c482e285","versionType":"git","status":"affected"},{"version":"3a7c1661ae1383364cd6092d851f5e5da64d476b","lessThan":"d5c4ee1fa4e83a12afc051c831936cd8e006cde3","versionType":"git","status":"affected"},{"version":"3a7c1661ae1383364cd6092d851f5e5da64d476b","lessThan":"c40ed3e884c8dc0350f26484030438ef24208ff1","versionType":"git","status":"affected"},{"version":"3a7c1661ae1383364cd6092d851f5e5da64d476b","lessThan":"18a6fe05fb6e18de29fa90d388bb34044114b3d8","versionType":"git","status":"affected"},{"version":"a2b01e65d9ba8af2bb086d3b7288ca53a07249ac","versionType":"git","status":"affected"},{"version":"e43dd2b1ec746e105b7db5f9ad6ef14685a615a4","versionType":"git","status":"affected"},{"version":"6.1.93","lessThan":"6.1.189","versionType":"semver","status":"affected"},{"version":"6.6.33","lessThan":"6.6.158","versionType":"semver","status":"affected"},{"version":"6.8.12","lessThan":"6.9","versionType":"semver","status":"affected"},{"version":"6.9.3","lessThan":"6.10","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bridge/br_mst.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/18a6fe05fb6e18de29fa90d388bb34044114b3d8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b431b63219853eef4054e2f1cb073d2ca2059b4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/abf734d150c61acfdfee102169d0e5d1c482e285","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b9661fd2423fc25e91e0517ecc0b6156ad83e3a8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c40ed3e884c8dc0350f26484030438ef24208ff1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d5c4ee1fa4e83a12afc051c831936cd8e006cde3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98302","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:21.183","lastModified":"2026-10-19T10:18:32.150","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fddi: skfp: fix NULL deref when setting the MAC address while down\n\nskfp_ctl_set_mac_address() calls ResetAdapter() unconditionally, without\nchecking netif_running(). ResetAdapter() first calls card_stop(), which\nsets smc->hw.hw_state to STOPPED, and then mac_drv_clear_tx_queue(),\nwhich walks the two transmit queues:\n\n\tfor (i = QUEUE_S; i <= QUEUE_A0; i++) {\n\t\tqueue = smc->hw.fp.tx[i] ;\n\t\t...\n\t\tt = queue->tx_curr_get ;\n\nsmc->hw.fp.tx[] is only populated by init_tx(), which is reached from\nskfp_open() through init_smt() -> init_fddi_driver() -> init_fplus() ->\ninit_mac() -> init_tx(). The private area is allocated and zeroed by\nalloc_fddidev(), so on an interface that has never been brought up both\nqueue pointers are still NULL. The hw_state test at the top of\nmac_drv_clear_tx_queue() does not catch this, because card_stop() has\njust set STOPPED; the function proceeds into the loop and dereferences\nNULL. ResetAdapter() does call init_smt() itself, but only after the\nqueues have been cleared.\n\nSetting the MAC address on a down interface therefore oopses:\n\n  ip link set dev fddi0 address 02:00:00:00:00:01\n\n  BUG: KASAN: null-ptr-deref in mac_drv_clear_tx_queue+0x68/0x2c0 [skfp]\n  Read of size 8 at addr 0000000000000010 by task ip/302\n  Call Trace:\n   <TASK>\n   mac_drv_clear_tx_queue+0x68/0x2c0 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]\n   ResetAdapter+0x29/0x100 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]\n   skfp_ctl_set_mac_address+0x57/0x80 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]\n   netif_set_mac_address+0x1e4/0x2c0\n   do_setlink+0x684/0x2680\n   </TASK>\n\nAddress 0x10 is the offset of tx_curr_get, the third pointer in\nstruct s_smt_tx_queue, on 64-bit. mac_drv_clear_rx_queue(), which\nResetAdapter() calls immediately afterwards, dereferences\nsmc->hw.fp.rx[QUEUE_R1] in the same way behind the same ineffective\nhw_state test; the transmit queue merely crashes first. Both are\ncovered by the guard below.\n\nSkip the adapter reset when the interface is down. dev_addr_set() is\nleft unconditional, so the new address is still recorded in\ndev->dev_addr. Nothing is lost by not resetting the adapter here:\nskfp_open() deliberately re-reads the factory address on every open,\n\n\tread_address(smc, NULL);\n\teth_hw_addr_set(dev, smc->hw.fddi_canon_addr.a);\n\nand the comment above it states this is done to discard exactly such an\naddress override across a close/open cycle. An address set while the\ninterface is down could not have survived the following open even\nbefore this change, so the guard removes no working behaviour. Guarding\nthe hardware side of ndo_set_mac_address() with netif_running() is\nestablished practice; skge_set_mac_address() has done so since commit\n2eb3e621c4e0 (\"skge: set mac address bonding fix\").\n\nGuarding the reset as a whole, rather than NULL-checking the queues, is\nalso what the rest of the driver expects. After a previous open/close\nthe queue pointers are stale but non-NULL, so there is no crash, yet\nResetAdapter() goes on to call smt_online() and STI_FBI() (\"Enable\nBoard Interrupts\") while skfp_close() has already called free_irq() -\nthe adapter would be brought back online with no handler installed. The\nonly other ResetAdapter() caller is skfp_interrupt(), which by\nconstruction runs only while the device is open.\n\nFound by automated driver testing against an emulated SysKonnect FDDI\nadapter under a KASAN-enabled 7.0.0 kernel. Triggering it requires\nCAP_NET_ADMIN."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/fddi/skfp/skfddi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"835903bea770ad96ab4322e18d98e00f8e0b39c3","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"5fd0f401b3eee95c93daa35ef99cb03d676031f0","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"731db6110b3148331ed8d5d11a564bfd520721d9","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"822903ed991971780db1db1be31a4f00e2b13e30","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"616ba18b2cfb72b7bea214bdd72df2485b2e37dc","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d6f63fdb298d546a47790cb373db65462c264d04","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"438131e7ae847e907d345bf504d7e25585561b5c","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"7c8810c2e69c3d9ca6df870b40ae9218e50b4fb1","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/fddi/skfp/skfddi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/438131e7ae847e907d345bf504d7e25585561b5c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5fd0f401b3eee95c93daa35ef99cb03d676031f0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/616ba18b2cfb72b7bea214bdd72df2485b2e37dc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/731db6110b3148331ed8d5d11a564bfd520721d9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7c8810c2e69c3d9ca6df870b40ae9218e50b4fb1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/822903ed991971780db1db1be31a4f00e2b13e30","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/835903bea770ad96ab4322e18d98e00f8e0b39c3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d6f63fdb298d546a47790cb373db65462c264d04","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98303","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:21.370","lastModified":"2026-10-19T10:18:32.300","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup\n\nWhen the forward output route cannot be used in icmp_route_lookup(),\nit enters the \"reverse path\" and calls ip_route_input() on fl4_dec.daddr,\nthe original packet's source address.\n\nip_route_input() only returns an error for truly invalid packets. For\nunreachable addresses it will succeed and return an input route whose\ndst.output is set to ip_rt_bug(). The existing check only rejects\nRTN_LOCAL routes, so the RTN_UNREACHABLE route types can still be returned\nand later used for output, syzkaller triggering a WARN_ON_ONCE()\nin ip_rt_bug() as bellow:\n\n ------------[ cut here ]------------\n WARNING: net/ipv4/route.c:1273 at ip_rt_bug+0x14/0x20\n RIP: 0010:ip_rt_bug+0x14/0x20\n Call Trace:\n  ip_push_pending_frames+0xfa/0x100\n  __icmp_send+0x905/0xf10\n  ip_options_compile+0xc0/0xd0\n  ip_rcv_finish_core+0x321/0xae0\n  ip_rcv+0x1de/0x260\n  __netif_receive_skb_one_core+0x11a/0x130\n  netif_receive_skb+0x7b/0x260\n  tun_get_user+0x11bf/0x1c10\n ------------[ cut here ]------------\n\nReject input route that is RTN_UNREACHABLE to fix it. The net warning\nis only printed for RTN_LOCAL, as RTN_UNREACHABLE is not the result of\na race condition."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv4/icmp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8b7817f3a959ed99d7443afc12f78a7e1fcc2063","lessThan":"06083cea4a3b95f5ebc85312f97d7086e6c9e782","versionType":"git","status":"affected"},{"version":"8b7817f3a959ed99d7443afc12f78a7e1fcc2063","lessThan":"83aa83f81a8fec30ff5372dee60b2f0561bcb2ca","versionType":"git","status":"affected"},{"version":"8b7817f3a959ed99d7443afc12f78a7e1fcc2063","lessThan":"cac69c50716c712ef0114837c9427da66066124c","versionType":"git","status":"affected"},{"version":"8b7817f3a959ed99d7443afc12f78a7e1fcc2063","lessThan":"1af2d87964d87ba7626d96928d68c09158b5a223","versionType":"git","status":"affected"},{"version":"8b7817f3a959ed99d7443afc12f78a7e1fcc2063","lessThan":"fda3000147dc96c75ba162f680bec0a9fecf3037","versionType":"git","status":"affected"},{"version":"8b7817f3a959ed99d7443afc12f78a7e1fcc2063","lessThan":"2998147b59c9df0a51477c7a6b3d1f0ba3127dd4","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv4/icmp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.25","status":"affected"},{"version":"0","lessThan":"2.6.25","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/06083cea4a3b95f5ebc85312f97d7086e6c9e782","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1af2d87964d87ba7626d96928d68c09158b5a223","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2998147b59c9df0a51477c7a6b3d1f0ba3127dd4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/83aa83f81a8fec30ff5372dee60b2f0561bcb2ca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cac69c50716c712ef0114837c9427da66066124c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fda3000147dc96c75ba162f680bec0a9fecf3037","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98304","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:21.520","lastModified":"2026-10-19T10:18:32.413","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmgenet: restore the hardware filters on open\n\nbcmgenet_hfb_init() runs INIT_LIST_HEAD() on priv->rxnfc_list, which drops\nevery rule off the list, and bcmgenet_open() calls it on each ifup. Every\nrule the user configured is silently lost:\n\n  # ethtool -N eth0 flow-type ether dst $MAC action 0\n  Added rule with ID 0\n  # ethtool -n eth0 | grep -c Filter:\n  1\n  # ip link set eth0 down && ip link set eth0 up\n  # ethtool -n eth0 | grep -c Filter:\n  0\n\nInitialise the lists once at probe and restore the rules on open, as\nbcmgenet_resume() already does."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/broadcom/genet/bcmgenet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3e370952287c55e5fd240cb8bb41ef8acff8829d","lessThan":"56db7ec462d6a2b886e299ad835109c089606969","versionType":"git","status":"affected"},{"version":"3e370952287c55e5fd240cb8bb41ef8acff8829d","lessThan":"906140955c8debde65afe12e594e04c49a61b0d9","versionType":"git","status":"affected"},{"version":"3e370952287c55e5fd240cb8bb41ef8acff8829d","lessThan":"23ca4ddc4fce2c233a49e9fd34d4b5b02bd7324e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/broadcom/genet/bcmgenet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/23ca4ddc4fce2c233a49e9fd34d4b5b02bd7324e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/56db7ec462d6a2b886e299ad835109c089606969","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/906140955c8debde65afe12e594e04c49a61b0d9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98305","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:21.660","lastModified":"2026-10-19T10:18:32.507","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: mxl862xx: disable the stats poll on teardown\n\nmxl862xx_setup() arms the stats poll before mxl862xx_setup_mdio(), and\nnothing stops it until dsa_register_switch() has returned an error to\nmxl862xx_probe(). DSA frees the dsa_port list before it returns, so a\npoll that fires once .setup or a later step of dsa_tree_setup() has\nfailed walks freed ports. On shutdown the user ports stay registered,\nand the WORK_STOPPED flag test in mxl862xx_get_stats64() is not atomic\nwith the cancel in mxl862xx_shutdown(), so a re-arm that read the flag\nbefore it was set queues the poll after cancel_delayed_work_sync() has\nreturned.\n\nArm the poll once .setup has succeeded and stop it from a .teardown op,\nwhich DSA calls on unregister and after a failed registration, in both\ncases before it frees the ports. Use disable_delayed_work_sync() there\nand in shutdown(): it drains a running poll as the cancel did and turns\nevery later attempt to queue the work into a no-op, so the re-arm\ncannot bring the poll back. remove() and the probe error path only set\nWORK_STOPPED, which crc_err_work tests before it walks the ports."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/dsa/mxl862xx/mxl862xx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a21d33a5265f0b31d935a8b9b2b6faefb5185911","lessThan":"97df811a11d4f76bc2ffe67b6bf730263f56c668","versionType":"git","status":"affected"},{"version":"a21d33a5265f0b31d935a8b9b2b6faefb5185911","lessThan":"9e92ad4630f5dd1838ce6bbe6b1bd2c73d34de36","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/dsa/mxl862xx/mxl862xx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/97df811a11d4f76bc2ffe67b6bf730263f56c668","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9e92ad4630f5dd1838ce6bbe6b1bd2c73d34de36","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98306","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:21.787","lastModified":"2026-10-19T10:18:32.620","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nseg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation\n\nWhen an SRv6 packet arrives on an interface enslaved to a VRF,\nvrf_ip6_rcv() sets IP6SKB_L3SLAVE in IP6CB, but decap_and_validate()\nhas never set IPSKB_L3SLAVE in IPCB. The bit stayed clear in the\ncommon case, and with CONFIG_IPV6_MIP6 the leftover frag_max_size of\na reassembled outer packet could even set it, with no VRF involved.\nCommit 44930446dde4 (\"ipv6: seg6: clear IPv4 control block on IPIP\ndecapsulation\") then made the unreliable bit reliably clear.\n\nThe effect of the missing flag is visible with End.DX4 when a\ndelivery to a local address of the node reaches the socket lookup.\nFor example, a UDP socket bound to the enslaved ingress interface\ndoes not receive any of the decapsulated packets, while an unbound\nsocket outside the VRF does.\nThis contradicts Documentation/networking/vrf.rst: by default the\nscope of an unbound UDP or TCP socket is limited to the default VRF.\n\nSet IPSKB_L3SLAVE for IPv4 in decap_and_validate(), which already does\nthe same for IPv6. The socket lookup then matches the decapsulated\npacket like any other packet received on that enslaved interface. Such\na packet matches an unbound UDP or TCP socket only when\nudp_l3mdev_accept or tcp_l3mdev_accept is set."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv6/seg6_local.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"891ef8dd2a8d14e4e73a81dcdb135b574c57f556","lessThan":"1d9f5c78903dd25a3556229eb716dd465c5f3573","versionType":"git","status":"affected"},{"version":"891ef8dd2a8d14e4e73a81dcdb135b574c57f556","lessThan":"72f410616000d21a0a6ec6c93a60301b9c92e95c","versionType":"git","status":"affected"},{"version":"891ef8dd2a8d14e4e73a81dcdb135b574c57f556","lessThan":"e4d7c52f15f572608374947c6c802052e1a2fc82","versionType":"git","status":"affected"},{"version":"891ef8dd2a8d14e4e73a81dcdb135b574c57f556","lessThan":"5130afa025c95faa621adf8bac525baeb2b290d2","versionType":"git","status":"affected"},{"version":"891ef8dd2a8d14e4e73a81dcdb135b574c57f556","lessThan":"f8fb4738ccef5f9d107845b05734a56352747b1a","versionType":"git","status":"affected"},{"version":"891ef8dd2a8d14e4e73a81dcdb135b574c57f556","lessThan":"ddf60220c925b54a1714c4722fdbdb12833232d0","versionType":"git","status":"affected"},{"version":"891ef8dd2a8d14e4e73a81dcdb135b574c57f556","lessThan":"8c16e1ccc082a3763dfc6bc2d3f658c1a6336f9d","versionType":"git","status":"affected"},{"version":"891ef8dd2a8d14e4e73a81dcdb135b574c57f556","lessThan":"7616242a2b37883f7322aaa1d2bd6cd0fed28315","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv6/seg6_local.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.14","status":"affected"},{"version":"0","lessThan":"4.14","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1d9f5c78903dd25a3556229eb716dd465c5f3573","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5130afa025c95faa621adf8bac525baeb2b290d2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/72f410616000d21a0a6ec6c93a60301b9c92e95c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7616242a2b37883f7322aaa1d2bd6cd0fed28315","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8c16e1ccc082a3763dfc6bc2d3f658c1a6336f9d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ddf60220c925b54a1714c4722fdbdb12833232d0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e4d7c52f15f572608374947c6c802052e1a2fc82","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f8fb4738ccef5f9d107845b05734a56352747b1a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98307","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:21.950","lastModified":"2026-10-19T10:18:32.737","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()\n\nWhen mac80211 removes a sta, it calls .sta_state() which in turn calls\nath11k_mac_station_remove(). In that function we clean up both peers &\narsta related resources.\n\nBut when the firmware crashes, ath11k calls ieee80211_restart_hw(), which\nassumes that all driver related resources are cleaned up beforehand. This\ncleanup is supposedly done by ath11k_mac_peer_cleanup_all() but does not\nin fact free arsta->rx_stats / tx_stats.\n\nExtract the arsta cleanup from ath11k_mac_station_remove() into a\nnew ath11k_mac_station_cleanup() and call it from both there and\nath11k_mac_peer_cleanup_all().\n\nThis should handle kmemleaks reports like:\n\tunreferenced object 0xffffff801ae66400 (size 1024):\n\t  comm \"hostapd\", pid 1306, jiffies 4295011565\n\t  hex dump (first 32 bytes):\n\t    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n\t    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n\t  backtrace (crc d61c08ec):\n\t    kmemleak_alloc+0x3c/0x50\n\t    __kmalloc_cache_noprof+0x2b0/0x3e0\n\t    ath11k_mac_op_sta_state+0x1dc/0xb10\n\t    drv_sta_state+0xac/0x6f8\n\t    sta_info_insert_rcu+0x314/0x5e0\n\t    sta_info_insert+0x14/0x38\n\t    ieee80211_add_station+0x10c/0x1a0\n\t    nl80211_new_station+0x3e8/0x680\n\t    genl_family_rcv_msg_doit+0xc0/0x120\n\t    genl_rcv_msg+0x1b4/0x258\n\t    netlink_rcv_skb+0x4c/0x108\n\t    genl_rcv+0x38/0x60\n\t    netlink_unicast+0x190/0x278\n\t    netlink_sendmsg+0x15c/0x370\n\t    ____sys_sendmsg+0x120/0x290\n\t    ___sys_sendmsg+0x70/0xa0\n\nTested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-01977-QCAHKSWPL_SILICONZ-1"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/ath/ath11k/mac.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"c4108dce0838ec7d38d782f76f9c007cfe2fff45","versionType":"git","status":"affected"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"57bc3cd46458eafa1c38e3044a61b7399cde7642","versionType":"git","status":"affected"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"be1d5e95ec499ed5ee9704aa27dd1407ccf0d0ac","versionType":"git","status":"affected"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"820b8cff81c796ba20573e04722ab62500713f97","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/ath/ath11k/mac.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.6","status":"affected"},{"version":"0","lessThan":"5.6","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/57bc3cd46458eafa1c38e3044a61b7399cde7642","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/820b8cff81c796ba20573e04722ab62500713f97","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/be1d5e95ec499ed5ee9704aa27dd1407ccf0d0ac","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c4108dce0838ec7d38d782f76f9c007cfe2fff45","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98308","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:22.093","lastModified":"2026-10-19T10:18:32.840","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: hda: trace PCM open only after assigning a stream\n\nStream assignment can fail when hardware streams are exhausted.\nMove the tracepoint after the NULL check because its payload accesses\nthe assigned stream tag.\n\nDetected by static analysis and reviewed with AI-assisted source auditing."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/hda/common/controller.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"184865085b88789fc8a355cc16ceff25f82f63ba","lessThan":"5a4c974dee03cc46eac43c82f33e34ec94f0b348","versionType":"git","status":"affected"},{"version":"184865085b88789fc8a355cc16ceff25f82f63ba","lessThan":"fba079ea22822248c82c3a999c88676d05b17bda","versionType":"git","status":"affected"},{"version":"184865085b88789fc8a355cc16ceff25f82f63ba","lessThan":"3c6ca6d9342f4a0be7c1413180e11023d13b5cde","versionType":"git","status":"affected"},{"version":"184865085b88789fc8a355cc16ceff25f82f63ba","lessThan":"0a52ba6d3b268bb82f0ec4cb861bc68d252369c0","versionType":"git","status":"affected"},{"version":"184865085b88789fc8a355cc16ceff25f82f63ba","lessThan":"5c89e7965220e85d06ae4c58adb7d7bb6da2440c","versionType":"git","status":"affected"},{"version":"184865085b88789fc8a355cc16ceff25f82f63ba","lessThan":"8477643cb91c9e09ac1b11890eef421ae63e53f7","versionType":"git","status":"affected"},{"version":"184865085b88789fc8a355cc16ceff25f82f63ba","lessThan":"3db8afba2d210b7d80cd5cc6b76d7f46daa9b47a","versionType":"git","status":"affected"},{"version":"184865085b88789fc8a355cc16ceff25f82f63ba","lessThan":"c9e6e5f38bf75276605f1952b22285f5f3abcaff","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/hda/common/controller.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.2","status":"affected"},{"version":"0","lessThan":"4.2","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0a52ba6d3b268bb82f0ec4cb861bc68d252369c0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3c6ca6d9342f4a0be7c1413180e11023d13b5cde","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3db8afba2d210b7d80cd5cc6b76d7f46daa9b47a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5a4c974dee03cc46eac43c82f33e34ec94f0b348","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5c89e7965220e85d06ae4c58adb7d7bb6da2440c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8477643cb91c9e09ac1b11890eef421ae63e53f7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c9e6e5f38bf75276605f1952b22285f5f3abcaff","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fba079ea22822248c82c3a999c88676d05b17bda","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98309","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:22.300","lastModified":"2026-10-19T10:18:32.947","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Use managed KMS polling to fix UAF on unbind\n\nvc4_kms_load() calls drm_kms_helper_poll_init() but the driver provides\nno matching drm_kms_helper_poll_fini(). The output poll work stays\nscheduled after unbind and runs on the freed drm_device:\n\n  # modprobe vc4; rmmod vc4; sleep 10\n  BUG: KASAN: slab-use-after-free in delayed_work_timer_fn\n  BUG: KASAN: slab-use-after-free in drm_client_dev_hotplug [drm]\n  Workqueue: events output_poll_execute [drm_kms_helper]\n  Allocated by task 171: __devm_drm_dev_alloc\n  Freed by task 262 (rmmod): drm_dev_put / component_del\n\nUse drmm_kms_helper_poll_init() so polling is finalized with the device,\nas other drivers do."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/vc4/vc4_kms.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c8b75bca92cbf064b9fa125fc74a85994452e935","lessThan":"b6beee927e7f4e3142032ff91b2d0417cdddc0f6","versionType":"git","status":"affected"},{"version":"c8b75bca92cbf064b9fa125fc74a85994452e935","lessThan":"cf0c4432bda37b02e7d430ff5017228ceb7caf0c","versionType":"git","status":"affected"},{"version":"c8b75bca92cbf064b9fa125fc74a85994452e935","lessThan":"ee507691c18f9fee5d4751e295ab9a7ff31d59ae","versionType":"git","status":"affected"},{"version":"c8b75bca92cbf064b9fa125fc74a85994452e935","lessThan":"7f9780df677370a19b4ec9764f13b1b82073e0d9","versionType":"git","status":"affected"},{"version":"c8b75bca92cbf064b9fa125fc74a85994452e935","lessThan":"073a30d75f309812ed61af134f24ffef4107b13a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/vc4/vc4_kms.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.4","status":"affected"},{"version":"0","lessThan":"4.4","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/073a30d75f309812ed61af134f24ffef4107b13a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7f9780df677370a19b4ec9764f13b1b82073e0d9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b6beee927e7f4e3142032ff91b2d0417cdddc0f6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cf0c4432bda37b02e7d430ff5017228ceb7caf0c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee507691c18f9fee5d4751e295ab9a7ff31d59ae","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98310","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:22.440","lastModified":"2026-10-19T10:18:33.053","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory\n\n__xe_shrinker_walk() walks the SYSTEM and TT LRUs without a runtime PM\nreference.  Shrinking a bo outside system memory invalidates its GPU\nmappings, which needs the device resumed, so while it is runtime\nsuspended the page table zap trips an assert and the TLB invalidation\nreturns -ENODEV:\n\n  WARNING: drivers/gpu/drm/xe/xe_bo.c:770 at xe_bo_move_notify+0x1fc/0x450 [xe]\n   xe_bo_shrink+0x20f/0x2b0 [xe]\n   __xe_shrinker_walk+0x174/0x410 [xe]\n   xe_shrinker_scan+0x10c/0x1e0 [xe]\n   do_shrink_slab+0x176/0x7e0\n   drop_caches_sysctl_handler+0x9c/0xf0\n\nTake a reference before walking a memory type other than XE_PL_SYSTEM\nand stop there if it cannot be acquired.  Reuse the shrinker's existing\nacquire path, which resumes the device directly where reclaim allows\nthat and otherwise queues the PM worker for a later scan.  Stop the walk\nonce the scan target is met, so a satisfied scan does not wake the\ndevice.  System memory is still reclaimed while the device is suspended.\n\nGate this on xe_device_is_l2_flush_optimized(), the same condition under\nwhich xe_bo_trigger_rebind() issues the invalidation for a non-fault-mode\nvm, so reclaim is unaffected elsewhere.  The System CCS copy already has\nits own reference in xe_bo_shrink().\n\nOnly a non-fault-mode vm can reach this, since a fault-mode vm requires\nLR mode and that holds a runtime PM reference for the vm's lifetime.\n\nReproduced with igt@xe_madvise@dontneed-before-exec while the GPU is\nruntime suspended.\n\nv2: simplify needs_rpm check. (Matt)\n    retarget Fixes tag since the issue occurs with the non-fault-mode\n    path added by 4e7ebff69aed.\nv3: handle this in xe_shrinker.c instead of xe_bo.c (Thomas)\nv4: stop the walk once the scan target is met. (Sashiko)\nv5: rebase on the freed page accounting fix. (Sashiko)\nv6: reuse the shrinker acquire path so runtime pm can be resumed\n    directly instead of always queueing a worker. (Thomas)\nv7: replace xe_pm_runtime_put() with xe_shrinker_runtime_pm_put(). (Thomas)\n\n(cherry picked from commit 628f92b28bf4c371c10207daf6fc4caee0c0db2e)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/xe/xe_shrinker.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4e7ebff69aed345f65f590a17b3119c0cb5eadde","lessThan":"b7f4d2588b1342bb190c04b3d7a32560f206c74c","versionType":"git","status":"affected"},{"version":"4e7ebff69aed345f65f590a17b3119c0cb5eadde","lessThan":"985862be16c7e4da808c51f393d631fb60c0be5c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/xe/xe_shrinker.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/985862be16c7e4da808c51f393d631fb60c0be5c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b7f4d2588b1342bb190c04b3d7a32560f206c74c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98311","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:22.573","lastModified":"2026-10-19T10:18:33.153","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: virt_wifi: don't transfer operstate before register\n\nvirt_wifi_newlink() calls netif_stacked_transfer_operstate() before\nregister_netdevice(). If the lower device is dormant, that queues the\nnew netdev on lweventlist while it is still uninitialized. If\nregistration fails after that, for example because of an invalid name\nsuch as \"bad/name\", free_netdev() immediately frees the object. A\nlater linkwatch_fire_event() then use-after-frees the list entry.\n\nMove the transfer to after netdev_upper_dev_link(), as macvlan and\nipvlan already do."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/virtual/virt_wifi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c7cdba31ed8b87526db978976392802d3f93110c","lessThan":"ee9ea1afd6990def51d52b3a0aecd5cfcc951da0","versionType":"git","status":"affected"},{"version":"c7cdba31ed8b87526db978976392802d3f93110c","lessThan":"9ce26201f6dedf3fa02b97da8c67ee6f6c5f7225","versionType":"git","status":"affected"},{"version":"c7cdba31ed8b87526db978976392802d3f93110c","lessThan":"f9526054c2b2cace5916b7225603d008834ec011","versionType":"git","status":"affected"},{"version":"c7cdba31ed8b87526db978976392802d3f93110c","lessThan":"e8304e25c6dabb8accf38b807969438d0ce84fd7","versionType":"git","status":"affected"},{"version":"c7cdba31ed8b87526db978976392802d3f93110c","lessThan":"ca49763c42c1089d654bf11b037980a9ede3772c","versionType":"git","status":"affected"},{"version":"c7cdba31ed8b87526db978976392802d3f93110c","lessThan":"293c56a66510bb7de073a1aba388e38abddff1fb","versionType":"git","status":"affected"},{"version":"c7cdba31ed8b87526db978976392802d3f93110c","lessThan":"b808a9af5fd21f9c68b0d024eda7535b5dce6a4e","versionType":"git","status":"affected"},{"version":"c7cdba31ed8b87526db978976392802d3f93110c","lessThan":"e5c8d7acd31b27057ea42cd405d0b3ece097bc89","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/virtual/virt_wifi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.0","status":"affected"},{"version":"0","lessThan":"5.0","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/293c56a66510bb7de073a1aba388e38abddff1fb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9ce26201f6dedf3fa02b97da8c67ee6f6c5f7225","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b808a9af5fd21f9c68b0d024eda7535b5dce6a4e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ca49763c42c1089d654bf11b037980a9ede3772c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e5c8d7acd31b27057ea42cd405d0b3ece097bc89","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e8304e25c6dabb8accf38b807969438d0ce84fd7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee9ea1afd6990def51d52b3a0aecd5cfcc951da0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f9526054c2b2cace5916b7225603d008834ec011","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98312","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:22.727","lastModified":"2026-10-19T10:18:33.290","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: 6fire: fix OOB write from device-reported iso length\n\nusb6fire_pcm_in_urb_handler() sizes each outgoing isochronous packet as\n(actual_length - 4) / (in_n_analog << 2) * (out_n_analog << 2) + 4, where\nactual_length is the unsigned length the device reported for the matching\nIN packet.  A packet completed with status 0 and actual_length < 4 wraps\nthe subtraction to 0x7fffffec; a zero-length isochronous packet is legal\non the bus, and the preceding loop rejects only non-zero status.  The sum\nreaches memset() on out_urb->buffer, a 4832-byte object from\nkcalloc(PCM_MAX_PACKET_SIZE, PCM_N_PACKETS_PER_URB).\n\nEven without the wrap the result is out of bounds: at 88.2/96 kHz the\n4-in/6-out scaling turns a full 420-byte IN packet into 628, so eight\npackets span 5024 bytes of that buffer.  usb_submit_urb() rejects an\nover-long descriptor only after the memset() and the\nusb6fire_pcm_playback() copy of user PCM data have run.\n\nGuard the subtraction as the sibling usb6fire_pcm_capture() already does,\nand limit the frame count to what fits in rt->out_packet_size, the OUT\nendpoint's wMaxPacketSize.  This bounds total_length by the buffer size\nwhile keeping each packet length aligned to a whole output frame.\n\n  BUG: KASAN: out-of-bounds in usb6fire_pcm_in_urb_handler (sound/usb/6fire/pcm.c:338)\n  Write of size 18446744073709551456 at addr ffff88802a3d0000 by task vhci_rx/5018\n  Call Trace:\n   dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)\n   print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)\n   kasan_report (mm/kasan/report.c:595)\n   kasan_check_range (mm/kasan/generic.c:186 mm/kasan/generic.c:200)\n   __asan_memset (mm/kasan/shadow.c:84)\n   usb6fire_pcm_in_urb_handler (sound/usb/6fire/pcm.c:338)\n   __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1657)\n   usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1741)\n   vhci_rx_loop (drivers/usb/usbip/vhci_rx.c:107 drivers/usb/usbip/vhci_rx.c:242)\n   kthread (kernel/kthread.c:436)\n   ret_from_fork (arch/x86/kernel/process.c:158)\n   ret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n\n  Allocated by task 10:\n   __kmalloc_cache_noprof (mm/slub.c:5563)\n   usb6fire_pcm_init (sound/usb/6fire/pcm.c:560 sound/usb/6fire/pcm.c:595)\n   usb6fire_chip_probe (sound/usb/6fire/chip.c:133)\n   usb_probe_interface (drivers/usb/core/driver.c:399)\n\n  The buggy address belongs to the object at ffff88802a3d0000\n   which belongs to the cache kmalloc-8k of size 8192\n  The buggy address is located 0 bytes inside of\n   4832-byte region [ffff88802a3d0000, ffff88802a3d12e0)\n  Kernel panic - not syncing: Fatal exception in interrupt"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/usb/6fire/pcm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c6d43ba816d1cf1d125bfbfc938f2a28a87facf9","lessThan":"61e665fb48e9eee44ec6d610514af383b1802cc1","versionType":"git","status":"affected"},{"version":"c6d43ba816d1cf1d125bfbfc938f2a28a87facf9","lessThan":"246de677552fe5dede293a1543b632e9853f31e4","versionType":"git","status":"affected"},{"version":"c6d43ba816d1cf1d125bfbfc938f2a28a87facf9","lessThan":"001ba7c1d9677225a5ecbc3e60d4865c08bb21d8","versionType":"git","status":"affected"},{"version":"c6d43ba816d1cf1d125bfbfc938f2a28a87facf9","lessThan":"ea11ade10583cc45af515d6b24510dbfa0184ca6","versionType":"git","status":"affected"},{"version":"c6d43ba816d1cf1d125bfbfc938f2a28a87facf9","lessThan":"cdc31537012bc7a58c95c6750db321b69dd802bb","versionType":"git","status":"affected"},{"version":"c6d43ba816d1cf1d125bfbfc938f2a28a87facf9","lessThan":"1589afe2d099d3e817873bc474676968d7080410","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/usb/6fire/pcm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.39","status":"affected"},{"version":"0","lessThan":"2.6.39","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/001ba7c1d9677225a5ecbc3e60d4865c08bb21d8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1589afe2d099d3e817873bc474676968d7080410","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/246de677552fe5dede293a1543b632e9853f31e4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/61e665fb48e9eee44ec6d610514af383b1802cc1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cdc31537012bc7a58c95c6750db321b69dd802bb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ea11ade10583cc45af515d6b24510dbfa0184ca6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98313","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:22.887","lastModified":"2026-10-19T10:18:33.410","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/dp: skip PUSH_IDLE when the link was never enabled\n\nmsm_dp_display_atomic_enable() returns early when link training fails,\nleaving ->power_on false and the main link down.\nmsm_dp_display_atomic_disable() nevertheless writes DP_STATE_CTRL_PUSH_IDLE\nand waits for an idle-pattern completion that cannot arrive, so every failed\nenable is followed by \"PUSH_IDLE pattern timedout\".\n\nEvery other step of the teardown is already gated on that flag:\nmsm_dp_display_disable(), called from .atomic_post_disable(), returns early\non !power_on. The PUSH_IDLE write is the only one that is not, so the\ncontroller's runtime-PM reference is then dropped without the link having\nbeen taken down.\n\nOn glymur (Snapdragon X2 Elite) the consequence is not a warning. The SoC\ndoes not survive it: TrustZone force-stops the SOCCP and ADSP remote\nprocessors and the machine resets silently about 50 ms later, with no oops\nand no panic. On an ASUS Zenbook A16 (UX3607OA), whose eDP panel does not\ncurrently train, this reproduces without any compositor or GPU involvement:\n\n  # eDP enable has already failed with \"Failed link training (rc=-104)\"\n  echo 1 > /sys/class/graphics/fb0/blank\n\n  [535.645455] === marker ===\n  [535.694833] qcom_q6v5_pas d00000.remoteproc: fatal error received: \\\n                 sys_m_smsm.c:512:TZ force stop\n  [535.694875] remoteproc remoteproc0: crash detected in soccp: type fatal error\n  [535.728857] qcom_q6v5_pas 6800000.remoteproc: fatal error received: \\\n                 sys_m_smsm.c:783:err fatal notification received from TZ\n  <SoC reset>\n\nGate the PUSH_IDLE write on ->power_on so the disable path is consistent\nwith the rest of the teardown. With this applied the same sequence is\nharmless and the machine stays up; without it, it resets every time.\n\nThe unconditional write dates back to the original DP driver\n(c943b4948b58 (\"drm/msm/dp: add displayPort driver support\")), but the\nsurrounding code has been restructured several times since, so no Fixes:\ntag is offered.\n\nNote that the eDP link-training failure that exposes this on the A16 is a\nseparate problem in the glymur eDP PHY and is reported separately; this\nchange is about not damaging the machine when training fails, for whatever\nreason.\n\nTested on ASUS Zenbook A16 (UX3607OA), Snapdragon X2 Elite Extreme, on\nlinux-next next-20260803 and next-20260807. The machine has since been\nrunning next-20260807 with this patch as its daily driver.\n\nPatchwork: https://patchwork.freedesktop.org/patch/745167/"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/msm/dp/dp_display.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"dc57147549a10c99766144cde265645287718ff7","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"5e97d117b79c3ce89542369ef697be64850de8ad","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e249a6e2a130c08bb4d8b0a55cbe29754307e5c9","versionType":"git","status":"affected"},{"version":"0","lessThan":"6.18.54","versionType":"semver","status":"affected"},{"version":"0","lessThan":"7.2.8","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/msm/dp/dp_display.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5e97d117b79c3ce89542369ef697be64850de8ad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dc57147549a10c99766144cde265645287718ff7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e249a6e2a130c08bb4d8b0a55cbe29754307e5c9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98314","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:23.033","lastModified":"2026-10-19T10:18:33.520","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: set timer->private_data before registering the PCM timer\n\nsnd_pcm_timer_init() calls snd_device_register() to link the new\nstruct snd_timer into the global timer list while it still carries\nhw.c_resolution = snd_pcm_timer_resolution (and hw.start/hw.stop),\nand only afterwards sets timer->private_data = substream.\n\nOnce the timer is on the list under register_mutex, a concurrent\nreader can already reach it through the same mutex and invoke these\ncallbacks. /proc/asound/timers does this via c_resolution(), and\nsnd_timer_open()+snd_timer_start() reach start()/stop() the same way.\nAll three dereference timer->private_data, which for this brief\nwindow is NULL, giving a NULL-pointer dereference:\n\n  substream = timer->private_data;\n  return substream->runtime ? ...   // substream is NULL\n\nMove the private_data/private_free assignment before\nsnd_device_register() so the timer is never visible on the list\nwithout its private_data set. On the snd_device_register() failure\npath, private_free() (snd_pcm_timer_free()) can now run, but it only\ndoes substream->timer = NULL, which is already NULL at that point\nsince substream->timer is set to the new timer just once, after a\nsuccessful registration -- so the failure path stays safe."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/core/pcm_timer.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"27f167e117eca310661fbcbacb352ea08face067","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"555d168bd98daa46daccc68c908201388c834293","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"8c869d5cf5affb20994bdbb60e7d46d65c91b55f","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"686c7a6af1eea8d2a919303e4c6bbec3de79dbdc","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e1eee8f16628f8b6bcae0a366fd6a2dd65e71edd","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d63f5a9f8121fb43c798056d7dd34c58f47185d7","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"0b349249d572633d7c8cdeb917623d1676a2b7c3","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"1e713f9bb2ac583521f06b0eb4e22440b1e3d078","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/core/pcm_timer.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0b349249d572633d7c8cdeb917623d1676a2b7c3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1e713f9bb2ac583521f06b0eb4e22440b1e3d078","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/27f167e117eca310661fbcbacb352ea08face067","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/555d168bd98daa46daccc68c908201388c834293","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/686c7a6af1eea8d2a919303e4c6bbec3de79dbdc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8c869d5cf5affb20994bdbb60e7d46d65c91b55f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d63f5a9f8121fb43c798056d7dd34c58f47185d7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e1eee8f16628f8b6bcae0a366fd6a2dd65e71edd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98315","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:23.200","lastModified":"2026-10-19T10:18:33.630","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: protect runlist updates with the runlist lock\n\nntfs_non_resident_attr_shrink() calls runlist helpers that require the\nrunlist write lock, but did not hold it while freeing clusters and\ntruncating the runlist. Serialize those operations and the resident\nconversion with the runlist lock.\n\nntfs_attr_map_cluster() can merge a newly allocated run before updating\nmapping pairs. If the update fails, free the clusters and restore both\nthe in-memory runlist and on-disk mapping pairs from a saved runlist.\nMark the volume in error if either rollback step fails."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ntfs/attrib.c","fs/ntfs/attrib.h","fs/ntfs/attrlist.c","fs/ntfs/attrlist.h","fs/ntfs/compress.c","fs/ntfs/file.c","fs/ntfs/inode.c","fs/ntfs/mft.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"495e90fa334828d4119061e2726af51d0a0fb4ed","lessThan":"742797432e8c9b0dd54ecc523c185e26b09d79a0","versionType":"git","status":"affected"},{"version":"495e90fa334828d4119061e2726af51d0a0fb4ed","lessThan":"91709ba5d6d709b2b663287b7e871e2c6b480502","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ntfs/attrib.c","fs/ntfs/attrib.h","fs/ntfs/attrlist.c","fs/ntfs/attrlist.h","fs/ntfs/compress.c","fs/ntfs/file.c","fs/ntfs/inode.c","fs/ntfs/mft.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/742797432e8c9b0dd54ecc523c185e26b09d79a0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/91709ba5d6d709b2b663287b7e871e2c6b480502","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98316","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:23.363","lastModified":"2026-10-19T10:18:33.737","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: bcd2000: Fix race between rawmidi and disconnect\n\nAlthough we tried to fix the potential UAF issues at USB disconnect on\nbcd2000 driver, there is still an overlooked case -- namely, when a\nrawmidi trigger callback has been already running at USB disconnect\nhandling, the in-flight function (e.g. bcd2000_midi_send()) could\nstill access the URB, because the previous URB NULL-check & clearance\nwas considered only for the URB complete callbacks, but not about the\nparallel rawmidi operations.\n\nFor addressing the race, this patch introduced a new spinlock that\ncovers each rawmidi operation as well as the rawmidi handling in the\ncomplete callback.  The URB is cleared with the lock, so it guarantees\nthat the pending rawmidi task already finished or a NULL check is\neffective."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/usb/bcd2000/bcd2000.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3c00004f134fc819f9d9e202c6a64acde0a1f8d0","lessThan":"3b824930259d54f5047ce6b5c97bd20db2fc2b98","versionType":"git","status":"affected"},{"version":"6c07aad8a7c9ef8ebc4d03a964b882123a349a2e","lessThan":"c83d6b0a65f7b71bbabcc91c045dfbffdff6ae76","versionType":"git","status":"affected"},{"version":"eb482a06791d6168beb8c78cc904ac5a5ed96a55","lessThan":"0a7ecf52cb59ed77ec525deb52c496ea8fba10b1","versionType":"git","status":"affected"},{"version":"7df3194bdb7479cad9199889655a566a2c0c1d1b","lessThan":"812ca56867bec3065c2a27f1ff5ce04e2a8bf4f0","versionType":"git","status":"affected"},{"version":"b06ebc7fe25a6af4a9f6e4a3d4236a4178ad4b01","lessThan":"9c8b6eff6e7505c128b615d9a1364ef66fa5c18e","versionType":"git","status":"affected"},{"version":"459d3a64766f5ca2f1886daeaf24582831a5f5ab","lessThan":"221253723dc58bb901c3f27a7659823e63fc598c","versionType":"git","status":"affected"},{"version":"9af08677aa57debaca5b57c8045c52a83d3dd376","versionType":"git","status":"affected"},{"version":"5a77febac6faf6da40fbb4555f703eeb91b58130","versionType":"git","status":"affected"},{"version":"5.10.270","lessThan":"5.11","versionType":"semver","status":"affected"},{"version":"5.15.221","lessThan":"5.16","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/usb/bcd2000/bcd2000.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.1.188","lessThan":"6.1.189","versionType":"semver","status":"affected"},{"version":"6.6.157","lessThan":"6.6.158","versionType":"semver","status":"affected"},{"version":"6.12.109","lessThan":"6.12.112","versionType":"semver","status":"affected"},{"version":"6.18.50","lessThan":"6.18.54","versionType":"semver","status":"affected"},{"version":"7.2.4","lessThan":"7.2.8","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0a7ecf52cb59ed77ec525deb52c496ea8fba10b1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/221253723dc58bb901c3f27a7659823e63fc598c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3b824930259d54f5047ce6b5c97bd20db2fc2b98","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/812ca56867bec3065c2a27f1ff5ce04e2a8bf4f0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9c8b6eff6e7505c128b615d9a1364ef66fa5c18e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c83d6b0a65f7b71bbabcc91c045dfbffdff6ae76","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98317","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:23.530","lastModified":"2026-10-19T10:18:33.840","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nneighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.\n\nNDTPA_INTERVAL_PROBE_TIME_MS sets .type and .min but misses\n.validation_type, so no validation is applied:\n\n  # ynl --family rt-neigh --do setneightbl \\\n  --json '{\"name\": \"arp_cache\", \"parms\": {\"interval-probe-time-ms\": 0}}'\n\n  # ynl --family rt-neigh --dump getneightbl --output-json | \\\n  jq '.[] | select(.name == \"arp_cache\" and has(\"config\"))\n          | .parms[\"interval-probe-time-ms\"]'\n  0\n\nMoreover, nla_get_msecs() uses msecs_to_jiffies(), and u64 is\nsilently cast to u32, so a larger value can bypass the min check:\n\n  e.g. 4294967296 == 0x100000000\n\n  # ynl --family rt-neigh --do setneightbl \\\n  --json '{\"name\": \"arp_cache\", \"parms\": {\"interval-probe-time-ms\": 4294967296}}'\n\n  # ynl --family rt-neigh --dump getneightbl --output-json | \\\n  jq '.[] | select(.name == \"arp_cache\" and has(\"config\"))\n          | .parms[\"interval-probe-time-ms\"]'\n  0\n\nmsecs_to_jiffies() returns MAX_JIFFY_OFFSET if the value is\nlarger than INT_MAX.  Also, INT_MAX ms overflows int NEIGH_VAR()\nwhen HZ > 1000 (Alpha, MIPS), and passing a negative integer to\nqueue_delayed_work(unsigned long delay) causes sign extension,\nwhich wraps around the expiry time to the past, resulting in it\nbeing handled as 0 delay in the timer wheel.\n\nLet's use NLA_POLICY_FULL_RANGE() and limit the max to 1 day.\n\nThe same max check is applied to sysctl as well.\n\nNote that this controls the probe interval for NTF_MANAGED\nentries, so the max of 1 day is unlikely to break any\ndeployments."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["Documentation/netlink/specs/rt-neigh.yaml","Documentation/networking/ip-sysctl.rst","net/core/neighbour.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"211da42eaa45db7b0edfde187dd88a85fbd466b5","lessThan":"982c7f66c04134b77126edbfd8a63ecd6928cfd9","versionType":"git","status":"affected"},{"version":"211da42eaa45db7b0edfde187dd88a85fbd466b5","lessThan":"8550b50e49b01b572e653e572f24ddd73949aa74","versionType":"git","status":"affected"},{"version":"211da42eaa45db7b0edfde187dd88a85fbd466b5","lessThan":"6d79b223ec44ada58ad37db42f539b60985a7722","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["Documentation/netlink/specs/rt-neigh.yaml","Documentation/networking/ip-sysctl.rst","net/core/neighbour.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.0","status":"affected"},{"version":"0","lessThan":"6.0","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/6d79b223ec44ada58ad37db42f539b60985a7722","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8550b50e49b01b572e653e572f24ddd73949aa74","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/982c7f66c04134b77126edbfd8a63ecd6928cfd9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98318","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:23.670","lastModified":"2026-10-19T10:18:33.933","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: validate absolute native symlink targets before NT fixups\n\nWith symlinkroot unset, an absolute target is copied without conversion\nto an NT drive path. Later code still assumes an NT prefix is present\nwhen modifying the target and calculating the print name length.\n\nFor \"/ab\", this causes two failures: sym[5] and path[5] are written\npast their allocations, and plen -= 2 * poff subtracts an assumed\n8-byte prefix from a 6-byte UTF-16 target, wrapping u16 plen to 65534.\nThat underflow causes another overflow: memcpy() copies 65534 bytes\ninto a 24-byte buffer. A user with write access to a mounted share\ncan trigger these bugs with default settings.\n\nValidate the NT drive prefix, including an ASCII drive letter, before\naccessing fixed offsets or subtracting the prefix length."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/reparse.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3363da82e02f1bddc54faa92ea430c6532e2cd2e","lessThan":"6913ff607c2bc8694193e1fcc40bf16d75f35f16","versionType":"git","status":"affected"},{"version":"3363da82e02f1bddc54faa92ea430c6532e2cd2e","lessThan":"23c240d9509e15f72e4112fc95f0160ab32ec430","versionType":"git","status":"affected"},{"version":"b6ea7b6c6be65149ab6b8e37a9dd1671f76add1b","versionType":"git","status":"affected"},{"version":"6.15.6","lessThan":"6.16","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/reparse.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/23c240d9509e15f72e4112fc95f0160ab32ec430","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6913ff607c2bc8694193e1fcc40bf16d75f35f16","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98319","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:23.800","lastModified":"2026-10-19T10:18:34.030","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr\n\nWhen an out_fence_ptr is provided but DRM_MODE_PAGE_FLIP_EVENT is not\nset, a drm_pending_vblank_event will be allocated. If later, there is an\nallocation failure or another failure at setup_out_fence(), that event\nwill not have base.fence set and it will not be released at\ncomplete_signaling().\n\nRelease the event and set crtc_state->event to NULL just like in the\nDRM_MODE_PAGE_FLIP_EVENT case when there is a failure at\ndrm_event_reserve_init(). That is, prepare_signaling() releases the\nevent and there is nothing to be done at complete_signaling(). Use\ndrm_event_cancel_free() as that will also undo drm_event_reserve_init()\nin case it has been called."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/drm_atomic_uapi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"92c715fca907686f5298220ece53423e38ba3aed","lessThan":"3d6576ed3de01e8a378397b7020e33ae3d40aa6c","versionType":"git","status":"affected"},{"version":"92c715fca907686f5298220ece53423e38ba3aed","lessThan":"86c33f740aa27e9cdc1259f0cc59c9c58f545e4b","versionType":"git","status":"affected"},{"version":"92c715fca907686f5298220ece53423e38ba3aed","lessThan":"88c450e23b8fd4f1dcd329562f5e81ef05f3d941","versionType":"git","status":"affected"},{"version":"92c715fca907686f5298220ece53423e38ba3aed","lessThan":"780716e2e019186fa6e5aad097a44b87b0b5388f","versionType":"git","status":"affected"},{"version":"92c715fca907686f5298220ece53423e38ba3aed","lessThan":"d0be0516b5224eb5b6f42f8564a8deadb20ae16b","versionType":"git","status":"affected"},{"version":"92c715fca907686f5298220ece53423e38ba3aed","lessThan":"daefd7ff159b0d1fb8c9e64430dcbe2aca1bdd09","versionType":"git","status":"affected"},{"version":"92c715fca907686f5298220ece53423e38ba3aed","lessThan":"b9a68a9ccaada15d8dd0102c188cc6b868ff800b","versionType":"git","status":"affected"},{"version":"92c715fca907686f5298220ece53423e38ba3aed","lessThan":"9eb1a393c89a79c4210230d23e7d88d239c61d7b","versionType":"git","status":"affected"},{"version":"4cd462c7f2b6fcc208aebf44f2c831681feaa925","versionType":"git","status":"affected"},{"version":"4.9.10","lessThan":"4.10","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/drm_atomic_uapi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.10","status":"affected"},{"version":"0","lessThan":"4.10","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3d6576ed3de01e8a378397b7020e33ae3d40aa6c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/780716e2e019186fa6e5aad097a44b87b0b5388f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/86c33f740aa27e9cdc1259f0cc59c9c58f545e4b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/88c450e23b8fd4f1dcd329562f5e81ef05f3d941","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9eb1a393c89a79c4210230d23e7d88d239c61d7b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b9a68a9ccaada15d8dd0102c188cc6b868ff800b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d0be0516b5224eb5b6f42f8564a8deadb20ae16b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/daefd7ff159b0d1fb8c9e64430dcbe2aca1bdd09","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98320","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:23.957","lastModified":"2026-10-19T10:18:34.143","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: hold reference on ct until flow is released\n\nnf_ct_put() releases the ct->ext area inmediately, the rcu typesafe\nsemantics also allow to refer to the wrong conntrack from the flowtable\ndatapath. Hold reference on ct until flow is released after rcu grace\nperiod.\n\nAdd rcu_barrier() on module exit path, to ensure pending flow entries\nare release before module goes away."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/netfilter/nf_flow_table_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0ff90b6c20340e57616a51ae1a1bf18156d6638a","lessThan":"93ff1594be1aad4da364462dd8db050ebcfda2de","versionType":"git","status":"affected"},{"version":"0ff90b6c20340e57616a51ae1a1bf18156d6638a","lessThan":"eed6997e8dc40593a539fcc722e7ed51b18db86c","versionType":"git","status":"affected"},{"version":"0ff90b6c20340e57616a51ae1a1bf18156d6638a","lessThan":"61c6688be282277c6e91ab286a7acd0ae8681ac6","versionType":"git","status":"affected"},{"version":"0ff90b6c20340e57616a51ae1a1bf18156d6638a","lessThan":"a43cd2b67b91e943273c913237a7a88c50cdcfbc","versionType":"git","status":"affected"},{"version":"0ff90b6c20340e57616a51ae1a1bf18156d6638a","lessThan":"8274cdc5f9c57e17ed77fc4ba76212536c840f25","versionType":"git","status":"affected"},{"version":"0ff90b6c20340e57616a51ae1a1bf18156d6638a","lessThan":"12c1ac230f4ca16e0017b62a963ab75e0b48074f","versionType":"git","status":"affected"},{"version":"0ff90b6c20340e57616a51ae1a1bf18156d6638a","lessThan":"d9e6175a3ee48209ee65f294fc567b4e16b29b74","versionType":"git","status":"affected"},{"version":"0ff90b6c20340e57616a51ae1a1bf18156d6638a","lessThan":"e75a9fa1d44bcbd66ea02e8781bcca6ea4076e0d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/netfilter/nf_flow_table_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.16","status":"affected"},{"version":"0","lessThan":"4.16","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/12c1ac230f4ca16e0017b62a963ab75e0b48074f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/61c6688be282277c6e91ab286a7acd0ae8681ac6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8274cdc5f9c57e17ed77fc4ba76212536c840f25","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/93ff1594be1aad4da364462dd8db050ebcfda2de","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a43cd2b67b91e943273c913237a7a88c50cdcfbc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d9e6175a3ee48209ee65f294fc567b4e16b29b74","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e75a9fa1d44bcbd66ea02e8781bcca6ea4076e0d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eed6997e8dc40593a539fcc722e7ed51b18db86c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98321","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:24.117","lastModified":"2026-10-19T10:18:34.267","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_nat: unregister and release hooks on error\n\nIf nf_hook_entries_insert_raw() fails, the NAT hooks get never released,\nresulting in a memleak.\n\nPostpone setting nat_proto_net->nat_hook_ops when the hooks are\nregistered to simplify the error path to decide whether the nat hooks\nneed unwinding."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/netfilter/nf_nat_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1cd472bf036ca038e783ef5f058f54e45b7e8180","lessThan":"79084567cd082fb4482e1ea457580e7d6504dd99","versionType":"git","status":"affected"},{"version":"1cd472bf036ca038e783ef5f058f54e45b7e8180","lessThan":"df80342f4bfc023ad7d6703df5e27f583ff0cb8d","versionType":"git","status":"affected"},{"version":"1cd472bf036ca038e783ef5f058f54e45b7e8180","lessThan":"cbdd39ce42530a193c56beb206a3356cb6d01016","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/netfilter/nf_nat_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.18","status":"affected"},{"version":"0","lessThan":"4.18","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/79084567cd082fb4482e1ea457580e7d6504dd99","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cbdd39ce42530a193c56beb206a3356cb6d01016","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/df80342f4bfc023ad7d6703df5e27f583ff0cb8d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98322","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:24.243","lastModified":"2026-10-19T10:18:34.350","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_nat: fully initialise new_addr in netmap setup\n\nnft_nat_setup_netmap() builds the mapped address in an on-stack\nunion nf_inet_addr. For an IPv4 mapping it writes only the 4-byte .ip\nmember and the loop runs a single 32-bit iteration, but it then copies\nthe whole 16-byte union into range->min_addr and range->max_addr, so the\nupper 12 bytes reach nf_nat_setup_info() uninitialised.\n\nKMSAN reports an uninit-value in nf_nat_setup_info() reached from\nnft_nat_eval(). The IPv6 path fills all 16 bytes and is not affected.\n\nZero-initialise new_addr."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/netfilter/nft_nat.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3ff7ddb1353da9b535e65702704cbadea1da9a00","lessThan":"29365695842db0a97b701a43a09fad1b4f7ecf3e","versionType":"git","status":"affected"},{"version":"3ff7ddb1353da9b535e65702704cbadea1da9a00","lessThan":"7b9380c38c2fd2189416fa602bdbc5c8523b84b2","versionType":"git","status":"affected"},{"version":"3ff7ddb1353da9b535e65702704cbadea1da9a00","lessThan":"eb2030137dba3b59cbb5057a33af70488d6bc231","versionType":"git","status":"affected"},{"version":"3ff7ddb1353da9b535e65702704cbadea1da9a00","lessThan":"e4982c489ee359162eee3ece1fb36082648464a5","versionType":"git","status":"affected"},{"version":"3ff7ddb1353da9b535e65702704cbadea1da9a00","lessThan":"161f5860c92a8ec80b6bdff16e79d70dcd8afc5a","versionType":"git","status":"affected"},{"version":"3ff7ddb1353da9b535e65702704cbadea1da9a00","lessThan":"0ce42c7b84032335abff9eac43762e4ca8224451","versionType":"git","status":"affected"},{"version":"3ff7ddb1353da9b535e65702704cbadea1da9a00","lessThan":"1c43f5db482f74b41987c39c9c375a5e767556eb","versionType":"git","status":"affected"},{"version":"3ff7ddb1353da9b535e65702704cbadea1da9a00","lessThan":"d313499df66159b4b7971d760d16729598ab7e5a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/netfilter/nft_nat.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0ce42c7b84032335abff9eac43762e4ca8224451","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/161f5860c92a8ec80b6bdff16e79d70dcd8afc5a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1c43f5db482f74b41987c39c9c375a5e767556eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/29365695842db0a97b701a43a09fad1b4f7ecf3e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7b9380c38c2fd2189416fa602bdbc5c8523b84b2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d313499df66159b4b7971d760d16729598ab7e5a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e4982c489ee359162eee3ece1fb36082648464a5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eb2030137dba3b59cbb5057a33af70488d6bc231","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98323","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:24.403","lastModified":"2026-10-19T10:18:34.457","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Bound fragmented header copies by the remaining length\n\nsiw_get_hdr() can receive an extended DDP/RDMAP header across more than\none TCP callback. The first callback may receive most of the header,\nwhile the next one still limits the copy to hdrlen - MIN_DDP_HDR instead\nof the number of missing bytes. This makes the destination move past the\nend of the header and overwrite the receive state, including\nfpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd\nvalue as a copy offset, which creates an OOB write.\n\nUse the number of header bytes already received when calculating the\nnext copy length."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/sw/siw/siw_qp_rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e3917c85f41ef1df64e27dc0e46ab0d803c5e73e","lessThan":"2c6fbcf4bfac0b2b186acc8d91154c0fa24468a7","versionType":"git","status":"affected"},{"version":"308cd50f174c95a507527037f4de1a0396aa4325","lessThan":"af9f5b474a260ad23ffb9793d716a5e3bbce3b48","versionType":"git","status":"affected"},{"version":"754209850df8367c954ac1de7671c7430b1f342c","lessThan":"262dcd809723723ed8a4e05437ec7e9c21a8f17e","versionType":"git","status":"affected"},{"version":"754209850df8367c954ac1de7671c7430b1f342c","lessThan":"eb4d7a946970469b3ab0c762432bf161d5b0836c","versionType":"git","status":"affected"},{"version":"754209850df8367c954ac1de7671c7430b1f342c","lessThan":"8628f8ebf41669302513fb3f0bf0eba38b226742","versionType":"git","status":"affected"},{"version":"754209850df8367c954ac1de7671c7430b1f342c","lessThan":"b72dcfb9bf1f0f0147cda03dc59e4002a315067f","versionType":"git","status":"affected"},{"version":"754209850df8367c954ac1de7671c7430b1f342c","lessThan":"e6bdfdf3bcb02d0d626a45e8c98b7e63d2fddf9d","versionType":"git","status":"affected"},{"version":"754209850df8367c954ac1de7671c7430b1f342c","lessThan":"9ff797e516dbc1ecb73701ec4c24055712d44411","versionType":"git","status":"affected"},{"version":"e09caa38e10bcf027100cc22b0e3cc745a39ef0a","versionType":"git","status":"affected"},{"version":"0c14f795a9eab9344230f9933798b8ee496f497d","versionType":"git","status":"affected"},{"version":"7fada7c6962219b6fc4ff4e62e46a936af110dd9","versionType":"git","status":"affected"},{"version":"5.10.150","lessThan":"5.10.271","versionType":"semver","status":"affected"},{"version":"5.15.75","lessThan":"5.15.222","versionType":"semver","status":"affected"},{"version":"5.4.220","lessThan":"5.5","versionType":"semver","status":"affected"},{"version":"5.19.17","lessThan":"5.20","versionType":"semver","status":"affected"},{"version":"6.0.3","lessThan":"6.1","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/sw/siw/siw_qp_rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.1","status":"affected"},{"version":"0","lessThan":"6.1","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/262dcd809723723ed8a4e05437ec7e9c21a8f17e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2c6fbcf4bfac0b2b186acc8d91154c0fa24468a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8628f8ebf41669302513fb3f0bf0eba38b226742","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9ff797e516dbc1ecb73701ec4c24055712d44411","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/af9f5b474a260ad23ffb9793d716a5e3bbce3b48","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b72dcfb9bf1f0f0147cda03dc59e4002a315067f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e6bdfdf3bcb02d0d626a45e8c98b7e63d2fddf9d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eb4d7a946970469b3ab0c762432bf161d5b0836c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98324","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:24.573","lastModified":"2026-10-19T10:18:34.593","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: pxa: fix double counting of the hw descriptors\n\npxad_alloc_desc() was converted from\n\n        kzalloc(struct_size(sw_desc, hw_desc, nb_hw_desc), GFP_NOWAIT)\n\nto kzalloc_flex(), which sets the __counted_by() counter sw_desc->nb_desc\nitself - but only where the compiler has __builtin_counted_by_ref(), so\nfrom gcc 15.1 or clang 22.1 on. The loop below it still increments\nnb_desc, which makes it come out doubled there and correct elsewhere.\n\nnb_desc is what pxad_free_desc() iterates over and what\nset_updater_desc() indexes from, so set it explicitly and drop the\nincrement. The error path has to lower it to the number of descriptors\nallocated so far, otherwise pxad_free_desc() would free entries that were\nnever allocated."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/dma/pxa_dma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"69050f8d6d075dc01af7a5f2f550a8067510366f","lessThan":"1de93785f32b450e9eae1e4fcfb7d03eb49eb27e","versionType":"git","status":"affected"},{"version":"69050f8d6d075dc01af7a5f2f550a8067510366f","lessThan":"f6504be006aa4bb4bd26285f410a885c17920d65","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/dma/pxa_dma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.0","status":"affected"},{"version":"0","lessThan":"7.0","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1de93785f32b450e9eae1e4fcfb7d03eb49eb27e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f6504be006aa4bb4bd26285f410a885c17920d65","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98325","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:24.693","lastModified":"2026-10-19T10:18:34.697","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: set up the TX info early to fix failure paths\n\nThe previous commit 2c51457d930f (\"wifi: mac80211: free ack status\nframe on TX header build failure\") cleaned up the leak, but still\nleft the code a bit messy and the failed SKB didn't get reported\nto userspace.\n\nFix this up by initialising skb->cb[] earlier, which allows using\nieee80211_free_txskb() and therefore reports it for the failure\nin ieee80211_build_hdr(), and unifies the ieee80211_skb_resize()\nfailure path with it."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/mac80211/tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c3e7724b6bc2f25e46c38dbe68f09d71fafeafb8","lessThan":"df711e9fa20d7e996711c7f43a11a71805bef78d","versionType":"git","status":"affected"},{"version":"c3e7724b6bc2f25e46c38dbe68f09d71fafeafb8","lessThan":"420fcc2fdeae6ecd682d2b1605a0a54c88aed4aa","versionType":"git","status":"affected"},{"version":"c3e7724b6bc2f25e46c38dbe68f09d71fafeafb8","lessThan":"36e6f0a5e6d7238f4023e77f423c1c1414374309","versionType":"git","status":"affected"},{"version":"c3e7724b6bc2f25e46c38dbe68f09d71fafeafb8","lessThan":"0fb37d2b6cb829cebdaea80f39011469f474bdcc","versionType":"git","status":"affected"},{"version":"c3e7724b6bc2f25e46c38dbe68f09d71fafeafb8","lessThan":"03d67414bd05b86029afc14535238a9393eac1c6","versionType":"git","status":"affected"},{"version":"c3e7724b6bc2f25e46c38dbe68f09d71fafeafb8","lessThan":"50d3d79dc0743b616afb00d01a626c76758721f7","versionType":"git","status":"affected"},{"version":"fd39be7ff6f81f2dc91ba6e5f87944abef5b4802","versionType":"git","status":"affected"},{"version":"3.6.3","lessThan":"3.7","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/mac80211/tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.7","status":"affected"},{"version":"0","lessThan":"3.7","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/03d67414bd05b86029afc14535238a9393eac1c6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0fb37d2b6cb829cebdaea80f39011469f474bdcc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/36e6f0a5e6d7238f4023e77f423c1c1414374309","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/420fcc2fdeae6ecd682d2b1605a0a54c88aed4aa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/50d3d79dc0743b616afb00d01a626c76758721f7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/df711e9fa20d7e996711c7f43a11a71805bef78d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98326","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:24.840","lastModified":"2026-10-19T10:18:34.797","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: mesh: release the channel if start fails\n\nieee80211_join_mesh() acquires a channel context and then calls\nieee80211_start_mesh(), which can fail. In that case, the chanctx\nisn't released then interface removal will attempt to unassign it\nafter it's removed from the driver, hitting:\n\n  wlan0: Failed check-sdata-in-driver check, flags: 0x0\n  WARNING: net/mac80211/driver-ops.c:366 at drv_unassign_vif_chanctx\n   ieee80211_assign_link_chanctx\n   __ieee80211_link_release_channel\n   ieee80211_link_release_channel\n   ieee80211_teardown_sdata\n   unregister_netdevice_many_notify\n   _cfg80211_unregister_wdev\n   ieee80211_remove_interfaces\n   ieee80211_unregister_hw\n   mac80211_hwsim_del_radio\n   hwsim_exit_net\n\nCorrectly release the channel on start failures."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/mac80211/cfg.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2b5e19677592c167d012c2d129407f39d2bdeb8d","lessThan":"f0afcec2129c166e61821d6ae097061155f01b12","versionType":"git","status":"affected"},{"version":"2b5e19677592c167d012c2d129407f39d2bdeb8d","lessThan":"b51f5a310bd6888b90bb9546a8081215dcfe6fbe","versionType":"git","status":"affected"},{"version":"2b5e19677592c167d012c2d129407f39d2bdeb8d","lessThan":"632f7acfe6dac1278a9314eaaab14fada400ddaf","versionType":"git","status":"affected"},{"version":"2b5e19677592c167d012c2d129407f39d2bdeb8d","lessThan":"41bee71112db53651ba9a9030de1b843255a4a7f","versionType":"git","status":"affected"},{"version":"2b5e19677592c167d012c2d129407f39d2bdeb8d","lessThan":"4a4e3fa77ea36d3419d806fb5883ef425a605a5d","versionType":"git","status":"affected"},{"version":"2b5e19677592c167d012c2d129407f39d2bdeb8d","lessThan":"ae97fff6495a8764bc0ef281cfe5444f701e527f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/mac80211/cfg.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.9","status":"affected"},{"version":"0","lessThan":"3.9","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/41bee71112db53651ba9a9030de1b843255a4a7f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4a4e3fa77ea36d3419d806fb5883ef425a605a5d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/632f7acfe6dac1278a9314eaaab14fada400ddaf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ae97fff6495a8764bc0ef281cfe5444f701e527f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b51f5a310bd6888b90bb9546a8081215dcfe6fbe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f0afcec2129c166e61821d6ae097061155f01b12","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98327","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:24.980","lastModified":"2026-10-19T10:18:34.890","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: mesh: reset the CSA state when leaving\n\nifmsh->csa is allocated in ieee80211_mesh_csa_beacon() and only freed\nin ieee80211_mesh_finish_csa(), i.e. when the channel switch completes.\nLeaving the mesh while a switch is still pending therefore leaks it.\n\nAdditionally, ifmsh->csa_role and ifmsh->chsw_ttl have their state leak\nin this case, so things can get mixed up in addition to the memory\nleak.\n\nRefactor the reset and call it in ieee80211_stop_mesh() to fix it all."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/mac80211/mesh.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b8456a14e9d2770846fcf74de18ff95b676149a3","lessThan":"aba8dfb45864441199748c33ce3c1c8ca121c8bd","versionType":"git","status":"affected"},{"version":"b8456a14e9d2770846fcf74de18ff95b676149a3","lessThan":"bd3b21145ae2e781daac1bbd19216a63ab4e0cbd","versionType":"git","status":"affected"},{"version":"b8456a14e9d2770846fcf74de18ff95b676149a3","lessThan":"ba5bf83a81e8832cb84bb3a2da67512f81f57a02","versionType":"git","status":"affected"},{"version":"b8456a14e9d2770846fcf74de18ff95b676149a3","lessThan":"860134b3af77970e006feab7e5decb8c84771c7f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/mac80211/mesh.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.13","status":"affected"},{"version":"0","lessThan":"3.13","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/860134b3af77970e006feab7e5decb8c84771c7f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aba8dfb45864441199748c33ce3c1c8ca121c8bd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ba5bf83a81e8832cb84bb3a2da67512f81f57a02","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bd3b21145ae2e781daac1bbd19216a63ab4e0cbd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98328","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:25.110","lastModified":"2026-10-19T10:18:34.977","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: add HE 6 GHz capability in the scan elems len\n\nThe HE 6 GHz Band Capability element is in the probe request for\nevery band if 6 GHz is supported, so add the size to scan_ies_len.\n\nOtherwise, building probe request elements can fail, triggering the\nWARN_ON in __ieee80211_start_scan()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/mac80211/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2ad2274c58ee2dcaf9ccde5c63ff30f59b138f77","lessThan":"db19d5414227d86cee77a000607a6710d7f36853","versionType":"git","status":"affected"},{"version":"2ad2274c58ee2dcaf9ccde5c63ff30f59b138f77","lessThan":"be7bfdea1ec9b672a80c736bd6ed932e1adebef8","versionType":"git","status":"affected"},{"version":"2ad2274c58ee2dcaf9ccde5c63ff30f59b138f77","lessThan":"8659bd6c4c852096b6621086d1ea38eed84b454a","versionType":"git","status":"affected"},{"version":"2ad2274c58ee2dcaf9ccde5c63ff30f59b138f77","lessThan":"ad5bd0f6a0c337a80c141ea8e6c7a1d9c145be79","versionType":"git","status":"affected"},{"version":"2ad2274c58ee2dcaf9ccde5c63ff30f59b138f77","lessThan":"9d83c08dcce808c732988a5291e3ef4f59d09edb","versionType":"git","status":"affected"},{"version":"2ad2274c58ee2dcaf9ccde5c63ff30f59b138f77","lessThan":"cd54bf333f5631d3630bab0a832e9ae648f73515","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/mac80211/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/8659bd6c4c852096b6621086d1ea38eed84b454a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9d83c08dcce808c732988a5291e3ef4f59d09edb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ad5bd0f6a0c337a80c141ea8e6c7a1d9c145be79","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/be7bfdea1ec9b672a80c736bd6ed932e1adebef8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cd54bf333f5631d3630bab0a832e9ae648f73515","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/db19d5414227d86cee77a000607a6710d7f36853","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98329","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:25.250","lastModified":"2026-10-19T10:18:35.063","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: don't allow injecting frames wider than the chanctx\n\nFrames injected on a monitor interface can carry a radiotap\nfield requesting a bandwidth, which mac80211 passes down to\nthe driver regardless of the the actual operational bandwidth.\n\nIf the bandwidth requested is too wide, that triggers a warning\nin hwsim:\n\n  WARN_ON(hwsim_get_chanwidth(bw) > hwsim_get_chanwidth(confbw))\n\nDrop such frames entirely instead since they cannot be sent."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/net/mac80211.h","net/mac80211/iface.c","net/mac80211/tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"646e76bb5daf4ca38438c69ffb72cccb605f3466","lessThan":"a5c715eda066cba5ce3372759188ba8636dca629","versionType":"git","status":"affected"},{"version":"646e76bb5daf4ca38438c69ffb72cccb605f3466","lessThan":"73f48f7e16cadfc74f444ccd10c1d3ae253e2e27","versionType":"git","status":"affected"},{"version":"646e76bb5daf4ca38438c69ffb72cccb605f3466","lessThan":"c69718519a81e87284494d0c6e6eb7bdd834707a","versionType":"git","status":"affected"},{"version":"646e76bb5daf4ca38438c69ffb72cccb605f3466","lessThan":"e14bf37bb2b3853012ff160131d1c6233f7a9cc9","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/net/mac80211.h","net/mac80211/iface.c","net/mac80211/tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.7","status":"affected"},{"version":"0","lessThan":"4.7","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/73f48f7e16cadfc74f444ccd10c1d3ae253e2e27","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a5c715eda066cba5ce3372759188ba8636dca629","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c69718519a81e87284494d0c6e6eb7bdd834707a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e14bf37bb2b3853012ff160131d1c6233f7a9cc9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98330","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:25.387","lastModified":"2026-10-19T10:18:35.153","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: get the wiphy out of a dying network namespace\n\nWhen a network namespace is destroyed, cfg80211_pernet_exit() moves any\nwiphy back to the initial namespace, and just warns if that fails. But\nmoving an interface can fail (due to allocation failures), and then the\nwiphy is left behind with a garbage netns pointer:\n\n  Kernel mode fault at addr 0x30\n  genlmsg_multicast_netns.constprop.0+0x46/0xcf [cfg80211]\n  nl80211_notify_wiphy+0xcd/0xe8 [cfg80211]\n  wiphy_unregister+0x169/0x3fc [cfg80211]\n\nNote that commit debac3a20dec (\"net: Remove conflicting altnames for\ndying netns in __dev_change_net_namespace().\") fixed another path\nthat could reach it without allocation failures.\n\nRemove interfaces that cannot be moved instead of failing the switch,\nso that the wiphy always ends up in the initial namespace. In this\ncase the netdev core will unregister the interfaces anyway."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/wireless/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"463d018323851a608eef52a9427b0585005c647f","lessThan":"caa02072b2986d4b0e7a824de05782ef7b03a0ba","versionType":"git","status":"affected"},{"version":"463d018323851a608eef52a9427b0585005c647f","lessThan":"b949b2720688691f1e41bdbfbe3df2b6dc77c34d","versionType":"git","status":"affected"},{"version":"463d018323851a608eef52a9427b0585005c647f","lessThan":"4635b1a1c1d693178a537446a6e09963f0fdae52","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/wireless/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.32","status":"affected"},{"version":"0","lessThan":"2.6.32","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/4635b1a1c1d693178a537446a6e09963f0fdae52","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b949b2720688691f1e41bdbfbe3df2b6dc77c34d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/caa02072b2986d4b0e7a824de05782ef7b03a0ba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98331","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:25.517","lastModified":"2026-10-19T10:18:35.267","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: unlist vifs when their netdev is unregistered\n\nmac80211 only removes vifs from the local->interfaces list when\nan interface is removed via ieee80211_if_remove(), before it\nunregisters the netdev. However, it's possible for a netdev to\nbe unregistered without going through that: When the netns that\nholds the wiphy is destroyed, the wiphy is supposed to move to\nthe init_ns, but that can run into allocation failures.\n\nThen, mac80211 has an interface listed that doesn't exist, and\nwill eventually hit\n\n  BUG: failure at net/wireless/core.h:141/wiphy_to_rdev()!\n  ...\n  _cfg80211_unregister_wdev+0x24/0x36a [cfg80211]\n  cfg80211_unregister_wdev+0x15/0x1d [cfg80211]\n  ieee80211_remove_interfaces+0x1ff/0x257 [mac80211]\n  ieee80211_unregister_hw+0x73/0x1d1 [mac80211]\n  mac80211_hwsim_del_radio+0x114/0x166 [mac80211_hwsim]\n\nRemove the interface from the list in ->ndo_uninit if it's still\naround to avoid this."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/mac80211/iface.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"463d018323851a608eef52a9427b0585005c647f","lessThan":"a22c02863439993095acd0c3db97fa53cd515f4f","versionType":"git","status":"affected"},{"version":"463d018323851a608eef52a9427b0585005c647f","lessThan":"20a56e96a6f7b4dfbd13f8732fd2673409fc7ba0","versionType":"git","status":"affected"},{"version":"463d018323851a608eef52a9427b0585005c647f","lessThan":"b735ad1a9aca6080192c1316cf2706e5e1318762","versionType":"git","status":"affected"},{"version":"463d018323851a608eef52a9427b0585005c647f","lessThan":"d45bf731ec7085d2cc2c5d179d3b3b6c743d4fb1","versionType":"git","status":"affected"},{"version":"463d018323851a608eef52a9427b0585005c647f","lessThan":"821bab0456dfca12acef6df702c8f2477d313227","versionType":"git","status":"affected"},{"version":"463d018323851a608eef52a9427b0585005c647f","lessThan":"eee2efd82867b623982ac51925b5a1812a74c50d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/mac80211/iface.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.32","status":"affected"},{"version":"0","lessThan":"2.6.32","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/20a56e96a6f7b4dfbd13f8732fd2673409fc7ba0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/821bab0456dfca12acef6df702c8f2477d313227","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a22c02863439993095acd0c3db97fa53cd515f4f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b735ad1a9aca6080192c1316cf2706e5e1318762","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d45bf731ec7085d2cc2c5d179d3b3b6c743d4fb1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eee2efd82867b623982ac51925b5a1812a74c50d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98332","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:25.657","lastModified":"2026-10-19T10:18:35.410","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: only operate on TDLS peers in the TDLS code\n\nieee80211_tdls_oper() can operate on the AP station, which then\nyields various warnings when the AP station is removed then or\nat a later point in time after being confused for a TDLS peer.\n\nAlways check that the station is a TDLS peer."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/mac80211/tdls.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"dfe018bf99537e42c816d3f543620a7e09fcf3cd","lessThan":"0cd452ccaa5c5971440256ce72c64611eca176c1","versionType":"git","status":"affected"},{"version":"dfe018bf99537e42c816d3f543620a7e09fcf3cd","lessThan":"6f0a100df8539ce90f37c14e1945f396ca2410bc","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/mac80211/tdls.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.2","status":"affected"},{"version":"0","lessThan":"3.2","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0cd452ccaa5c5971440256ce72c64611eca176c1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6f0a100df8539ce90f37c14e1945f396ca2410bc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98333","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:25.780","lastModified":"2026-10-19T10:18:35.513","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: reset the LED state when ifup fails\n\nWhen the first interface comes up, the radio LED is turned on. This can\nstart the TPT trigger timer, which continues running.\n\nBut if bringing up the interface fails then the timer keeps running and\nwon't be stopped by anything, eventually it can be freed:\n\n  ODEBUG: free active (active state 0) object: ffff888127e12130 object type: timer_list hint: tpt_trig_timer+0x0/0x300 net/mac80211/led.c:145\n  WARNING: CPU: 0 PID: 5923 at lib/debugobjects.c:612 debug_print_object+0x1a2/0x2b0\n   debug_check_no_obj_freed+0x4b7/0x600 lib/debugobjects.c:1129\n   kfree+0x436/0x670 mm/slub.c:6818\n   ieee80211_led_exit+0x162/0x1c0 net/mac80211/led.c:210\n   ieee80211_unregister_hw+0x27e/0x3a0 net/mac80211/main.c:1706\n   rt2x00lib_remove_dev+0x55b/0x670\n\nUndo the LED state in the error path."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/mac80211/iface.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"67408c8c7b9daf28b50e33be3541334c07d15789","lessThan":"de6f9561db572df86d65c05545eb2397313bb8a5","versionType":"git","status":"affected"},{"version":"67408c8c7b9daf28b50e33be3541334c07d15789","lessThan":"78183e8331958fda11cd2b6850bb424a9747c4b2","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/mac80211/iface.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.38","status":"affected"},{"version":"0","lessThan":"2.6.38","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/78183e8331958fda11cd2b6850bb424a9747c4b2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/de6f9561db572df86d65c05545eb2397313bb8a5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98334","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:25.903","lastModified":"2026-10-19T10:18:35.627","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: reset state when starting AP fails\n\nieee80211_start_ap() can set enable_beacon (and beacon_int) and fail\nlater, leaving it set forever. Scanning can then attempt to restore\nbeaconing on such an interface, leading to:\n\n  Oops: divide error: 0000 [#1] SMP KASAN NOPTI\n  RIP: 0010:mac80211_hwsim_link_info_changed+0xca7/0xf00\n  Call Trace:\n   drv_link_info_changed+0x413/0x860 net/mac80211/driver-ops.c:495\n   ieee80211_link_info_change_notify+0x24b/0x3c0 net/mac80211/main.c:427\n   ieee80211_offchannel_return+0x381/0x580 net/mac80211/offchannel.c:160\n   __ieee80211_scan_completed+0x993/0xe30 net/mac80211/scan.c:519\n   ieee80211_scan_work+0x472/0x2010 net/mac80211/scan.c:1193\n   cfg80211_wiphy_work+0x2b7/0x550 net/wireless/core.c:538\n\nin hwsim. Also, cfg80211 then allows changing the interface type,\nand the off-channel path getgs confused about beaconing as well,\nleading to another warning:\n\n  WARNING: net/mac80211/driver-ops.c:468 at drv_link_info_changed+0x583/0x880\n   ieee80211_link_info_change_notify+0x24b/0x3c0 net/mac80211/main.c:427\n   ieee80211_offchannel_stop_vifs+0x328/0x5c0 net/mac80211/offchannel.c:122\n   ieee80211_start_sw_scan net/mac80211/scan.c:583 [inline]\n   __ieee80211_start_scan+0xfb6/0x1af0 net/mac80211/scan.c:882\n\nReset the state on failures to always have it correct."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/mac80211/cfg.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d6a83228823fc0cc8d79d95c9f0bf568b7317862","lessThan":"d83da43e9b3b3b1bad99ac5a1065f1c63ad5fc32","versionType":"git","status":"affected"},{"version":"d6a83228823fc0cc8d79d95c9f0bf568b7317862","lessThan":"5d5ff5b36f5748a2a077f875a73ccb26860d3fcc","versionType":"git","status":"affected"},{"version":"d6a83228823fc0cc8d79d95c9f0bf568b7317862","lessThan":"6eac225f59c1c2277ac74f8a716d6df0ba3b8d28","versionType":"git","status":"affected"},{"version":"d6a83228823fc0cc8d79d95c9f0bf568b7317862","lessThan":"3f28551d0241254a75626d868041c6340285088b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/mac80211/cfg.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.9","status":"affected"},{"version":"0","lessThan":"3.9","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3f28551d0241254a75626d868041c6340285088b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5d5ff5b36f5748a2a077f875a73ccb26860d3fcc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6eac225f59c1c2277ac74f8a716d6df0ba3b8d28","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d83da43e9b3b3b1bad99ac5a1065f1c63ad5fc32","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98335","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:26.040","lastModified":"2026-10-19T10:18:35.743","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: abort chanswitch when leaving a mesh\n\nThe code in ieee80211_stop_mesh() leaves CSA active, but leaving\nthe mesh released the channel context, so the CSA finalize work\ncrashes:\n\n  Oops: general protection fault, probably for non-canonical address\n        0xdffffc0000000003\n  KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]\n  RIP: 0010:ieee80211_put_srates_elem+0x42/0x640 net/mac80211/util.c:3272\n  Call Trace:\n   ieee80211_mesh_build_beacon+0xa83/0x1b50 net/mac80211/mesh.c:1093\n   ieee80211_mesh_rebuild_beacon+0xc7/0x170 net/mac80211/mesh.c:1147\n   ieee80211_mesh_finish_csa+0x131/0x210 net/mac80211/mesh.c:1542\n   ieee80211_set_after_csa_beacon net/mac80211/cfg.c:4085 [inline]\n   __ieee80211_csa_finalize net/mac80211/cfg.c:4133 [inline]\n   ieee80211_csa_finalize+0x633/0x1150 net/mac80211/cfg.c:4155\n   cfg80211_wiphy_work+0x2ab/0x450 net/wireless/core.c:438\n\nAbort the channel switch properly."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/mac80211/mesh.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b8456a14e9d2770846fcf74de18ff95b676149a3","lessThan":"bc544ef02327edf61c94d2b6bae9d14b217009b2","versionType":"git","status":"affected"},{"version":"b8456a14e9d2770846fcf74de18ff95b676149a3","lessThan":"2e1d6e80148495e728a85a9250176f266312e55c","versionType":"git","status":"affected"},{"version":"b8456a14e9d2770846fcf74de18ff95b676149a3","lessThan":"d222fdc973bb8dbf0357772bd9042ffdc8291939","versionType":"git","status":"affected"},{"version":"b8456a14e9d2770846fcf74de18ff95b676149a3","lessThan":"ac7472a24bd433b81c06582835dd1d5547c10da9","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/mac80211/mesh.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.13","status":"affected"},{"version":"0","lessThan":"3.13","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2e1d6e80148495e728a85a9250176f266312e55c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ac7472a24bd433b81c06582835dd1d5547c10da9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bc544ef02327edf61c94d2b6bae9d14b217009b2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d222fdc973bb8dbf0357772bd9042ffdc8291939","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98336","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:26.170","lastModified":"2026-10-19T10:18:35.850","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: don't offload TC setup on AP_VLAN interfaces\n\nAP_VLAN interfaces are purely virtual, so don't try to offload\nTC setup to drivers. We can't really use the AP interface either\nsince we may not know it all the time, and it could technically\neven change.\n\nJust reject the TC offload so things get done in software."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/mac80211/iface.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"61587f1556fec39e8bafc40c8715f560639a4cf2","lessThan":"790221efbfece13a2347563b3785aaca48f192e2","versionType":"git","status":"affected"},{"version":"61587f1556fec39e8bafc40c8715f560639a4cf2","lessThan":"40bc8a268c3b6e21fa3a8dd1b4fd85aa905b9718","versionType":"git","status":"affected"},{"version":"61587f1556fec39e8bafc40c8715f560639a4cf2","lessThan":"9c34f01b8f2177dd4e1ee524ca1f9ca3fcd85a11","versionType":"git","status":"affected"},{"version":"61587f1556fec39e8bafc40c8715f560639a4cf2","lessThan":"ea3ef2165e4751df2ee3bc1c07a192243a08faa5","versionType":"git","status":"affected"},{"version":"61587f1556fec39e8bafc40c8715f560639a4cf2","lessThan":"362bd5bce29ed0f6fd3d39a7065567777d70606e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/mac80211/iface.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.4","status":"affected"},{"version":"0","lessThan":"6.4","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/362bd5bce29ed0f6fd3d39a7065567777d70606e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/40bc8a268c3b6e21fa3a8dd1b4fd85aa905b9718","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/790221efbfece13a2347563b3785aaca48f192e2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9c34f01b8f2177dd4e1ee524ca1f9ca3fcd85a11","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ea3ef2165e4751df2ee3bc1c07a192243a08faa5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98337","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:26.303","lastModified":"2026-10-19T10:18:35.953","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: don't start a ROC while scanning\n\nThe ROC work can be pending when a scan starts (which requires\nROC list to be empty, but that's possible), and then a new ROC\ncan be added to the list and the work will pick it up.\n\nAvoid starting that ROC if a scan made it between things, as\notherwise we'll hit a warning later:\n\n  WARNING: net/mac80211/offchannel.c:404 at ieee80211_start_next_roc+0x256/0x2d0\n  Workqueue: events_unbound cfg80211_wiphy_work\n  Call Trace:\n   __ieee80211_scan_completed+0x4fd/0xe40 net/mac80211/scan.c:537\n   ieee80211_scan_work+0x472/0x1ff0 net/mac80211/scan.c:1193\n   cfg80211_wiphy_work+0x410/0x570 net/wireless/core.c:513"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/mac80211/offchannel.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"aaa016ccd5df89d73483d0d51ee1f692978ccc35","lessThan":"5dc8ec2f8d1d62914661577c23ec151f5c9734a4","versionType":"git","status":"affected"},{"version":"aaa016ccd5df89d73483d0d51ee1f692978ccc35","lessThan":"81baab8b645ec532bad2b7a8464191c720ef8fd9","versionType":"git","status":"affected"},{"version":"aaa016ccd5df89d73483d0d51ee1f692978ccc35","lessThan":"58b806f699052c572dec6cab2c376f884f27e98f","versionType":"git","status":"affected"},{"version":"aaa016ccd5df89d73483d0d51ee1f692978ccc35","lessThan":"733f0fde95392ed5f61a4e36aee661ea8d0e8581","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/mac80211/offchannel.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.5","status":"affected"},{"version":"0","lessThan":"4.5","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/58b806f699052c572dec6cab2c376f884f27e98f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5dc8ec2f8d1d62914661577c23ec151f5c9734a4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/733f0fde95392ed5f61a4e36aee661ea8d0e8581","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/81baab8b645ec532bad2b7a8464191c720ef8fd9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98338","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:26.437","lastModified":"2026-10-19T10:18:36.067","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: ibss: ref BSS entry for joined event\n\nWhen the IBSS is joined, we only record the BSSID/channel in the event\nand look up the BSS entry when processing it. However, that's racy,\ne.g. a new scan with NL80211_SCAN_FLAG_FLUSH can remove it, causing a\nwarning in the event work:\n\n  !bss\n  WARNING: net/wireless/ibss.c:37 at __cfg80211_ibss_joined+0x3d3/0x440\n  Workqueue: cfg80211 cfg80211_event_work\n   cfg80211_process_wdev_events+0x39f/0x5b0 net/wireless/util.c:1144\n   cfg80211_process_rdev_events+0xa1/0x110 net/wireless/util.c:1179\n   cfg80211_event_work+0x2f/0x40 net/wireless/core.c:393\n\nDo the lookup early (the driver is expected to only join an IBSS that\nhas a BSS entry) and keep a reference to it."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/wireless/core.h","net/wireless/ibss.c","net/wireless/util.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"667503ddcb96f3b10211f997fe55907fa7509841","lessThan":"b0e3f019e461ac42e45aa3ec1216cefaca2f4a8b","versionType":"git","status":"affected"},{"version":"667503ddcb96f3b10211f997fe55907fa7509841","lessThan":"708f9d43d6a2eb9c6b83fe62af628de9dffd9314","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/wireless/core.h","net/wireless/ibss.c","net/wireless/util.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.32","status":"affected"},{"version":"0","lessThan":"2.6.32","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/708f9d43d6a2eb9c6b83fe62af628de9dffd9314","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b0e3f019e461ac42e45aa3ec1216cefaca2f4a8b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98339","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:26.560","lastModified":"2026-10-19T10:18:36.170","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: don't filter by BSS type when removing stale entries\n\nWhen an assoc AP switches to a channel that already has a BSS entry,\ncfg80211_update_assoc_bss_entry() removes that entry before rehashing\nthe real one, since the two would otherwise collide in the BSS rbtree.\n\nThe lookup for that entry also required it to match the connection's BSS\ntype, so an entry advertising e.g. the IBSS capability bit was left in\nplace, and the following cfg80211_rehash_bss() then ran into it:\n\n  WARN_ON(!cmp)\n\nChanging the type shouldn't really happen, but can be triggered by a\nrogue AP/device, so drop the check and remove any entries matching\nthe comparison."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/wireless/scan.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0afd425b1b64251f19b5d8d8b49bf56fefbc643f","lessThan":"6ef87a853327434ae1cd9c5a2c27a557fb4047fc","versionType":"git","status":"affected"},{"version":"0afd425b1b64251f19b5d8d8b49bf56fefbc643f","lessThan":"1380ee3a202dbb9f8e8b3c3b87eb410450d57799","versionType":"git","status":"affected"},{"version":"0afd425b1b64251f19b5d8d8b49bf56fefbc643f","lessThan":"fb445ec7480da5d2b82bf681e3b4313603722729","versionType":"git","status":"affected"},{"version":"0afd425b1b64251f19b5d8d8b49bf56fefbc643f","lessThan":"65fdb973bd905bc3f5cb045a04c1828f2d2a7e24","versionType":"git","status":"affected"},{"version":"0afd425b1b64251f19b5d8d8b49bf56fefbc643f","lessThan":"64e23a36d8f04811372365b44cfca325f8e0f4bb","versionType":"git","status":"affected"},{"version":"0afd425b1b64251f19b5d8d8b49bf56fefbc643f","lessThan":"6d2fd26185678038ef2ea11dd4d2e6eccbf2dd25","versionType":"git","status":"affected"},{"version":"0afd425b1b64251f19b5d8d8b49bf56fefbc643f","lessThan":"0aa44982125c86b47961be5ac1c82eddab8080f3","versionType":"git","status":"affected"},{"version":"0afd425b1b64251f19b5d8d8b49bf56fefbc643f","lessThan":"b377e1000d963e7182a987082b4b06580bd7ac84","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/wireless/scan.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.4","status":"affected"},{"version":"0","lessThan":"5.4","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0aa44982125c86b47961be5ac1c82eddab8080f3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1380ee3a202dbb9f8e8b3c3b87eb410450d57799","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/64e23a36d8f04811372365b44cfca325f8e0f4bb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/65fdb973bd905bc3f5cb045a04c1828f2d2a7e24","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6d2fd26185678038ef2ea11dd4d2e6eccbf2dd25","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6ef87a853327434ae1cd9c5a2c27a557fb4047fc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b377e1000d963e7182a987082b4b06580bd7ac84","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fb445ec7480da5d2b82bf681e3b4313603722729","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98340","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:26.720","lastModified":"2026-10-19T10:18:36.320","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: only group hidden BSSes with beacon entries\n\nWhen a probe response for an unknown BSS comes in, __cfg80211_bss_update()\nlooks for an existing entry with the same BSSID and a hidden (zero-length\nor NUL-filled) SSID, and if it finds one it groups them, using the beacon\nIEs from the existing entry.\n\nBut that could find another entry without a beacon, if it was also from a\nprobe response (with SSID), so there's a group without beacon elements.\n\nIf a beacon with a hidden SSID for that BSSID arrives later,\ncfg80211_combine_bsses() goes looking for the probe response entries that\nbelong to it - i.e. entries with the same BSSID and channel that have no\nbeacon IEs - and finds those two. They are already grouped with each\nother, so it hits its\n\n  WARN_ON_ONCE(bss->pub.hidden_beacon_bss)\n  WARN_ON_ONCE(!list_empty(&bss->hidden_list))\n\nwhich are there because an entry without beacon elements is not supposed\nto be part of a group yet.\n\nOnly combine entries when a beacon was already received, ones that are\nkept separate will be combined when a beacon arrives."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/wireless/scan.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4593c4cbe1c96b3995727dc42f6aa103f4ff5afc","lessThan":"4cd6a518ce7527284bbc9baab5fa2453a7d477c2","versionType":"git","status":"affected"},{"version":"4593c4cbe1c96b3995727dc42f6aa103f4ff5afc","lessThan":"74ed0d992f392c75e1969415527e06df3f7a4034","versionType":"git","status":"affected"},{"version":"4593c4cbe1c96b3995727dc42f6aa103f4ff5afc","lessThan":"3658093df69849daf4f813a8f087f358e13be203","versionType":"git","status":"affected"},{"version":"4593c4cbe1c96b3995727dc42f6aa103f4ff5afc","lessThan":"73365b81630b57e1a1f9d50dc87281797855c2ac","versionType":"git","status":"affected"},{"version":"4593c4cbe1c96b3995727dc42f6aa103f4ff5afc","lessThan":"7405dd19bda4537a2843637d8d7bed1efd4776cf","versionType":"git","status":"affected"},{"version":"4593c4cbe1c96b3995727dc42f6aa103f4ff5afc","lessThan":"86235be788094131912e9bd8412b358d91d99f49","versionType":"git","status":"affected"},{"version":"4593c4cbe1c96b3995727dc42f6aa103f4ff5afc","lessThan":"332ea1502c46f53375cb109fa82bfaff818f3a41","versionType":"git","status":"affected"},{"version":"4593c4cbe1c96b3995727dc42f6aa103f4ff5afc","lessThan":"068843ed0902c552a13860c5ec6b2ca65b57a065","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/wireless/scan.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.9","status":"affected"},{"version":"0","lessThan":"3.9","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/068843ed0902c552a13860c5ec6b2ca65b57a065","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/332ea1502c46f53375cb109fa82bfaff818f3a41","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3658093df69849daf4f813a8f087f358e13be203","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4cd6a518ce7527284bbc9baab5fa2453a7d477c2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/73365b81630b57e1a1f9d50dc87281797855c2ac","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7405dd19bda4537a2843637d8d7bed1efd4776cf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/74ed0d992f392c75e1969415527e06df3f7a4034","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/86235be788094131912e9bd8412b358d91d99f49","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98341","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:26.873","lastModified":"2026-10-19T10:18:36.450","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: don't free driver-owned scan requests\n\nWhen an interface goes down while a scan is running, cfg80211 completes\nthe scan towards userspace and frees the scan request. However, the\ndriver can be convinced that it owns the request, since the cancellation\nis (intended to be) asynchronous.\n\nThe WARN_ON() in the netdev notifier was meant to catch this, but it's\nnot actually avoidable, so it triggers and we get a UAF in scan_done().\n\nThere doesn't seem to be a great way around it, so just track that the\ndriver is still convinced it owns the request, and then just free it on\ncompletion if it was already cancelled. Also remove the warnings since\nthey can trigger in the intended architecture."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/wireless/core.c","net/wireless/core.h","net/wireless/rdev-ops.h","net/wireless/scan.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4a58e7c38443154fce1b47910e1a9184f65c5d72","lessThan":"e8c75736cfd0c6c87562cda2312e3fe5e2227955","versionType":"git","status":"affected"},{"version":"4a58e7c38443154fce1b47910e1a9184f65c5d72","lessThan":"cf6da29d17994865f73ca70976495ea856909c63","versionType":"git","status":"affected"},{"version":"4a58e7c38443154fce1b47910e1a9184f65c5d72","lessThan":"dab68a74e90b8e07f08ed9deaa5884857a3cfe89","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/wireless/core.c","net/wireless/core.h","net/wireless/rdev-ops.h","net/wireless/scan.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.14","status":"affected"},{"version":"0","lessThan":"3.14","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/cf6da29d17994865f73ca70976495ea856909c63","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dab68a74e90b8e07f08ed9deaa5884857a3cfe89","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e8c75736cfd0c6c87562cda2312e3fe5e2227955","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98342","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:27.003","lastModified":"2026-10-19T10:18:36.560","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: wait for RCU readers before releasing dma_device\n\ndma_issue_pending_all() walks the dma_device_list with\nlist_for_each_entry_rcu() under rcu_read_lock(). dma_device_release()\nunlinks the device with list_del_rcu() and then calls\ndevice->device_release() (which in many drivers, such as plx_dma.c,\ndirectly calls kfree()).\n\nBecause there is no grace period between unlinking the device and\nfreeing it, concurrent RCU readers in dma_issue_pending_all() can\naccess the device after it has been freed.\n\nThe lockless walk originally relied on clients holding a dmaengine\nreference to pin the provider module, and therefore the device, for as\nlong as they might traverse the list. Commit 8ad342a86359 (\"dmaengine:\nAdd reference counting to dma_device struct\") decoupled the dma_device\nlifetime from the module reference, so the device can now be released\nwhile a reader is still walking the list.\n\nAdd synchronize_rcu() before the device is freed, so RCU readers are\nguaranteed to have finished. Keep it unconditional: providers that do\nnot implement device_release() free the device themselves once\ndma_async_device_unregister() returns. This call will delay for a grace\nperiod with dma_list_mutex held, which is safe and only teardown path is\ndelayed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/dma/dmaengine.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2ba05622b8b143b0c95968ba59bddfbd6d2f2559","lessThan":"ac8ce9f89638d6d79875cca7d8ae42566a9bde15","versionType":"git","status":"affected"},{"version":"2ba05622b8b143b0c95968ba59bddfbd6d2f2559","lessThan":"14578c78405d51fa92e4ada4502a45f537c0fcb8","versionType":"git","status":"affected"},{"version":"2ba05622b8b143b0c95968ba59bddfbd6d2f2559","lessThan":"cbb3310a5167e868a5e763e32b9a23b4d50669ee","versionType":"git","status":"affected"},{"version":"2ba05622b8b143b0c95968ba59bddfbd6d2f2559","lessThan":"8577a5ec4f7e00443015ef99f646def093121a1b","versionType":"git","status":"affected"},{"version":"2ba05622b8b143b0c95968ba59bddfbd6d2f2559","lessThan":"4448a539a0c39141cccc67be6cacde0f35024313","versionType":"git","status":"affected"},{"version":"2ba05622b8b143b0c95968ba59bddfbd6d2f2559","lessThan":"fc1f4884f1d46fc7a8cee6e2997ecc9e8d1c7f77","versionType":"git","status":"affected"},{"version":"2ba05622b8b143b0c95968ba59bddfbd6d2f2559","lessThan":"4aed7e47a10b94ea3c5171e8d1382081accd2e03","versionType":"git","status":"affected"},{"version":"2ba05622b8b143b0c95968ba59bddfbd6d2f2559","lessThan":"dc750422170a563c7a81f6e49d36bb02c62ae37f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/dma/dmaengine.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.29","status":"affected"},{"version":"0","lessThan":"2.6.29","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/14578c78405d51fa92e4ada4502a45f537c0fcb8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4448a539a0c39141cccc67be6cacde0f35024313","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4aed7e47a10b94ea3c5171e8d1382081accd2e03","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8577a5ec4f7e00443015ef99f646def093121a1b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ac8ce9f89638d6d79875cca7d8ae42566a9bde15","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cbb3310a5167e868a5e763e32b9a23b4d50669ee","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dc750422170a563c7a81f6e49d36bb02c62ae37f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fc1f4884f1d46fc7a8cee6e2997ecc9e8d1c7f77","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98343","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:27.163","lastModified":"2026-10-19T10:18:36.690","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()\n\nWhen dma_device_put() drops the last reference on chan->device->ref,\ndma_device_release() runs and may free the dma_device along with its\nchannels.\n\ndma_chan_put() then still reads chan->device->owner via\ndma_chan_to_owner() for the trailing module_put(). KASAN catches it:\n\n\tslab-use-after-free in dma_chan_put+0x3e6/0x4c0\n\tRead of size 8 by task insmod/6319\n\tFreed by task 6319:\n\t  kfree+0x225/0x470\n\t  dma_chan_put+0x395/0x4c0\n\t  dmaengine_put+0xf8/0x160\n\nCache the module owner in dma_chan_put() before the put so the trailing\nmodule_put() does not need chan->device."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/dma/dmaengine.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8ad342a863590b24ce77681b7e081363fb3333f7","lessThan":"b92c502595336a3cc5bb7a060170891366745a5d","versionType":"git","status":"affected"},{"version":"8ad342a863590b24ce77681b7e081363fb3333f7","lessThan":"855187a88bdf762c46b6849307597e3e02bfc1d9","versionType":"git","status":"affected"},{"version":"8ad342a863590b24ce77681b7e081363fb3333f7","lessThan":"c9780b601438137494b407eb4301bb3de2587ac9","versionType":"git","status":"affected"},{"version":"8ad342a863590b24ce77681b7e081363fb3333f7","lessThan":"07eb075b60d565a5e465a1945a80cc62807492ad","versionType":"git","status":"affected"},{"version":"8ad342a863590b24ce77681b7e081363fb3333f7","lessThan":"9319dd64d5cdef851841c091f30424faa2284c31","versionType":"git","status":"affected"},{"version":"8ad342a863590b24ce77681b7e081363fb3333f7","lessThan":"6cf31716b77a71c0d634106f4f3951377b8dc6dc","versionType":"git","status":"affected"},{"version":"8ad342a863590b24ce77681b7e081363fb3333f7","lessThan":"02bd02c585293634b213b142cba63cbf77891f6b","versionType":"git","status":"affected"},{"version":"8ad342a863590b24ce77681b7e081363fb3333f7","lessThan":"e873c74132f0c5f1452816cd9bb26208f0bba1e1","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/dma/dmaengine.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.6","status":"affected"},{"version":"0","lessThan":"5.6","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/02bd02c585293634b213b142cba63cbf77891f6b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/07eb075b60d565a5e465a1945a80cc62807492ad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6cf31716b77a71c0d634106f4f3951377b8dc6dc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/855187a88bdf762c46b6849307597e3e02bfc1d9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9319dd64d5cdef851841c091f30424faa2284c31","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b92c502595336a3cc5bb7a060170891366745a5d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c9780b601438137494b407eb4301bb3de2587ac9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e873c74132f0c5f1452816cd9bb26208f0bba1e1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98344","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:27.323","lastModified":"2026-10-19T10:18:36.827","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: Fix device kref underflow in dma_chan_put()\n\ndma_chan_get() takes chan->device->ref only on the slow path:\n\n\t/* no kref on fast path */\n\tif (chan->client_count) {\n\t\t__module_get(owner);\n\t\tchan->client_count++;\n\t\treturn 0;\n\t}\n\tif (!try_module_get(owner))\n\t\treturn -ENODEV;\n\tif (!dma_device_get(chan->device)) { // calls kref_get_unless_zero()\n\ndma_chan_put() drops the ref unconditionally, so every fast-path\nget/put pair drops one extra device reference.\n\nThe bug fires when two conditions hold together: a non-private\nprovider has a persistent client holding chan->client_count > 0\nand another client cycles dmaengine_get()/dmaengine_put().\nWhen the kref hits zero, the subsequent dma_find_channel() returns\nNULL even though the provider module is still loaded.\n\nFix this by dropping device->ref only on the last put, matching the\nsingle slow-path get."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/dma/dmaengine.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8ad342a863590b24ce77681b7e081363fb3333f7","lessThan":"036b527f92570206da4b8c40b38f8d689e29d0f3","versionType":"git","status":"affected"},{"version":"8ad342a863590b24ce77681b7e081363fb3333f7","lessThan":"5fb1797a8c9485e40e5492fa0338ab5c7d1f3fef","versionType":"git","status":"affected"},{"version":"8ad342a863590b24ce77681b7e081363fb3333f7","lessThan":"57f7f1c6827be7d8f80feca48d2125fb91c6f6ed","versionType":"git","status":"affected"},{"version":"8ad342a863590b24ce77681b7e081363fb3333f7","lessThan":"7c3f4ce651d43705f9ec7f778f642a90d5ff4fba","versionType":"git","status":"affected"},{"version":"8ad342a863590b24ce77681b7e081363fb3333f7","lessThan":"de2677e57d3161390d8a508f08cddec6ef7e4b23","versionType":"git","status":"affected"},{"version":"8ad342a863590b24ce77681b7e081363fb3333f7","lessThan":"1a0d9b406febf23054ad595fd47b29325e70fb2d","versionType":"git","status":"affected"},{"version":"8ad342a863590b24ce77681b7e081363fb3333f7","lessThan":"77906ac448d2fa81fa710ae26c0e591ebdc81154","versionType":"git","status":"affected"},{"version":"8ad342a863590b24ce77681b7e081363fb3333f7","lessThan":"44dab659064eb5c10adb0306510eebe848ed592d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/dma/dmaengine.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.6","status":"affected"},{"version":"0","lessThan":"5.6","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/036b527f92570206da4b8c40b38f8d689e29d0f3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1a0d9b406febf23054ad595fd47b29325e70fb2d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/44dab659064eb5c10adb0306510eebe848ed592d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/57f7f1c6827be7d8f80feca48d2125fb91c6f6ed","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5fb1797a8c9485e40e5492fa0338ab5c7d1f3fef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/77906ac448d2fa81fa710ae26c0e591ebdc81154","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7c3f4ce651d43705f9ec7f778f642a90d5ff4fba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/de2677e57d3161390d8a508f08cddec6ef7e4b23","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98345","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:27.480","lastModified":"2026-10-19T10:18:36.957","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: check IP header size in cfg80211_classify8021d()\n\nA frame that looks like IP can be transmitted, but be too short, so\nthe DS field is read incorrectly:\n\n  BUG: KMSAN: uninit-value in cfg80211_classify8021d+0x99d/0x12b0 net/wireless/util.c:1027\n   cfg80211_classify8021d+0x99d/0x12b0 net/wireless/util.c:1027\n   ieee80211_select_queue+0x37a/0x9e0 net/mac80211/wme.c:180\n   __ieee80211_subif_start_xmit+0x60f/0x1d90 net/mac80211/tx.c:4304\n   ieee80211_subif_start_xmit+0xa8/0x6d0 net/mac80211/tx.c:4538\n   ...\n   packet_sendmsg+0x9173/0xa2a0 net/packet/af_packet.c:3108\n\nUse skb_header_pointer() like the MPLS case."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/wireless/util.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e31a16d6f64ef0e324c6f54d5112703c3f13a9c4","lessThan":"18d5547327c202cda33ad2bbd203220c2c62c8a7","versionType":"git","status":"affected"},{"version":"e31a16d6f64ef0e324c6f54d5112703c3f13a9c4","lessThan":"3ff17ffa8d02e0e3f6b2f6e57af4aac511f5b734","versionType":"git","status":"affected"},{"version":"e31a16d6f64ef0e324c6f54d5112703c3f13a9c4","lessThan":"c4fbcf1e614ef0755fcc751fdfca21b0bf4e0ef7","versionType":"git","status":"affected"},{"version":"e31a16d6f64ef0e324c6f54d5112703c3f13a9c4","lessThan":"12c0abd4d1c1b04a7663d04ba85268bc9ad9c017","versionType":"git","status":"affected"},{"version":"e31a16d6f64ef0e324c6f54d5112703c3f13a9c4","lessThan":"f33ad4e2f846e55cf4637419268f093ac9f1a765","versionType":"git","status":"affected"},{"version":"e31a16d6f64ef0e324c6f54d5112703c3f13a9c4","lessThan":"a2cdb4a675ca04c4ac8cc962848082d8ce065008","versionType":"git","status":"affected"},{"version":"e31a16d6f64ef0e324c6f54d5112703c3f13a9c4","lessThan":"65893c8d28f239c7ddad5a83683be193a9133e9b","versionType":"git","status":"affected"},{"version":"e31a16d6f64ef0e324c6f54d5112703c3f13a9c4","lessThan":"48b2c5c628b09cf36cbeca53e0432fc2a7518be7","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/wireless/util.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.31","status":"affected"},{"version":"0","lessThan":"2.6.31","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/12c0abd4d1c1b04a7663d04ba85268bc9ad9c017","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/18d5547327c202cda33ad2bbd203220c2c62c8a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3ff17ffa8d02e0e3f6b2f6e57af4aac511f5b734","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/48b2c5c628b09cf36cbeca53e0432fc2a7518be7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/65893c8d28f239c7ddad5a83683be193a9133e9b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a2cdb4a675ca04c4ac8cc962848082d8ce065008","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c4fbcf1e614ef0755fcc751fdfca21b0bf4e0ef7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f33ad4e2f846e55cf4637419268f093ac9f1a765","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98346","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:27.633","lastModified":"2026-10-19T10:18:37.103","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: don't get the radio mask for netdev-less wdevs\n\ncfg80211_calculate_bi_data() calls rdev_get_radio_mask() with\nwdev->netdev, which can be NULL and then crashes in mac80211.\n\nTo avoid that, invert the order of checks since wdev->netdev\nis always valid for beaconing interfaces."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/wireless/util.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"abb4cfe3661aa05426916b21164f88ca5a405a3a","lessThan":"5b313159c970e945ee125ca87fad0d96ed913e55","versionType":"git","status":"affected"},{"version":"abb4cfe3661aa05426916b21164f88ca5a405a3a","lessThan":"693d777846d525b8b218bad97a1befa5d9bd4334","versionType":"git","status":"affected"},{"version":"abb4cfe3661aa05426916b21164f88ca5a405a3a","lessThan":"7166da84a7fe3553f9065782fd80299a37b150e5","versionType":"git","status":"affected"},{"version":"abb4cfe3661aa05426916b21164f88ca5a405a3a","lessThan":"a7783e585360ee05dfe21d3173dbbe985c94f29e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/wireless/util.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5b313159c970e945ee125ca87fad0d96ed913e55","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/693d777846d525b8b218bad97a1befa5d9bd4334","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7166da84a7fe3553f9065782fd80299a37b150e5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a7783e585360ee05dfe21d3173dbbe985c94f29e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98347","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:27.773","lastModified":"2026-10-19T10:18:37.207","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nIB/IPoIB: Avoid restoring OPER_UP after multicast flush\n\nipoib_ib_dev_flush_light() temporarily clears IPOIB_FLAG_OPER_UP to\nprevent multicast joins while ipoib_mcast_dev_flush() is running, and\nrestores the flag afterwards if it was previously set.\n\nThis restore races with ipoib_ib_dev_down(). If the interface is brought\ndown while the flush is in progress, ipoib_ib_dev_down() clears\nIPOIB_FLAG_OPER_UP, but the flush path may set it again after the device\nhas already gone down.\n\nSince commit 894021a75291 (\"IB/ipoib: Make the carrier_on_task race\naware\"), ipoib_mcast_carrier_on_task() relies on IPOIB_FLAG_OPER_UP\nbeing cleared to terminate its rtnl_trylock() retry loop. If the flag is\nleft set after shutdown, the workqueue retries forever, causing teardown\nto deadlock when ipoib_ndo_uninit() waits in destroy_workqueue() while\nholding RTNL.\n\nInstead of overloading IPOIB_FLAG_OPER_UP to block multicast joins\nduring a light flush, introduce a dedicated IPOIB_FLAG_MCAST_FLUSH flag.\nUse it together with IPOIB_FLAG_OPER_UP to determine whether multicast\njoins are allowed, avoiding the race with device shutdown."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/ulp/ipoib/ipoib.h","drivers/infiniband/ulp/ipoib/ipoib_ib.c","drivers/infiniband/ulp/ipoib/ipoib_multicast.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"344bacca8cd811809fc33a249f2738ab757d327f","lessThan":"f973769fb7cb33ba0d4a64b7dcfee0cabaead938","versionType":"git","status":"affected"},{"version":"344bacca8cd811809fc33a249f2738ab757d327f","lessThan":"b72f38929f4b5aa83161fd3b22a7327207e51ec5","versionType":"git","status":"affected"},{"version":"344bacca8cd811809fc33a249f2738ab757d327f","lessThan":"1b11e4b55b41d9e69a8e8d07622614202e2eaca9","versionType":"git","status":"affected"},{"version":"344bacca8cd811809fc33a249f2738ab757d327f","lessThan":"326f7d34bd7e64de535566b65c0533b640df5a81","versionType":"git","status":"affected"},{"version":"344bacca8cd811809fc33a249f2738ab757d327f","lessThan":"5ad925d45f28464a5e043c9620880bb6a030da89","versionType":"git","status":"affected"},{"version":"344bacca8cd811809fc33a249f2738ab757d327f","lessThan":"188b334a6db36a8e0bfaaf59bc4020639a0f3aad","versionType":"git","status":"affected"},{"version":"344bacca8cd811809fc33a249f2738ab757d327f","lessThan":"1ff3add37c329704ec46181b4ae4f00f9f16ce6f","versionType":"git","status":"affected"},{"version":"344bacca8cd811809fc33a249f2738ab757d327f","lessThan":"9a141d3dc869d18b2eab35e999f4790a9b84e40f","versionType":"git","status":"affected"},{"version":"a289c65ca49d2680a3d797e633e57a45573d1df2","versionType":"git","status":"affected"},{"version":"b81459c78935e4579a577b2366c5f8878d3c7fee","versionType":"git","status":"affected"},{"version":"8a9d8dc9ce83a90bfbbe69181acc4cf1beff46f5","versionType":"git","status":"affected"},{"version":"dfe809702a11bd7fb91c882fb55620e39ce22109","versionType":"git","status":"affected"},{"version":"87160fb51bc343793cc8f5f031a87f1a35aecb82","versionType":"git","status":"affected"},{"version":"749fd55dd210f9676f0d445a6efaaa3bec65174a","versionType":"git","status":"affected"},{"version":"3.2.84","lessThan":"3.3","versionType":"semver","status":"affected"},{"version":"3.10.105","lessThan":"3.11","versionType":"semver","status":"affected"},{"version":"3.12.65","lessThan":"3.13","versionType":"semver","status":"affected"},{"version":"3.16.39","lessThan":"3.17","versionType":"semver","status":"affected"},{"version":"4.4.24","lessThan":"4.5","versionType":"semver","status":"affected"},{"version":"4.7.7","lessThan":"4.8","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/ulp/ipoib/ipoib.h","drivers/infiniband/ulp/ipoib/ipoib_ib.c","drivers/infiniband/ulp/ipoib/ipoib_multicast.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.8","status":"affected"},{"version":"0","lessThan":"4.8","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/188b334a6db36a8e0bfaaf59bc4020639a0f3aad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1b11e4b55b41d9e69a8e8d07622614202e2eaca9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1ff3add37c329704ec46181b4ae4f00f9f16ce6f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/326f7d34bd7e64de535566b65c0533b640df5a81","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5ad925d45f28464a5e043c9620880bb6a030da89","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9a141d3dc869d18b2eab35e999f4790a9b84e40f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b72f38929f4b5aa83161fd3b22a7327207e51ec5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f973769fb7cb33ba0d4a64b7dcfee0cabaead938","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98348","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:27.963","lastModified":"2026-10-19T10:18:37.357","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libipw: reject too-short association responses\n\nlibipw_handle_assoc_resp() reads the capability, status and aid fields\nof the 30-byte association response prefix and then computes the\ninformation element length as\n\n\tstats->len - sizeof(*frame)\n\nstats->len is a u16 and sizeof() has type size_t, so the subtraction is\nevaluated as size_t and wraps instead of going negative.  Truncating\nthat to the u16 length parameter of libipw_parse_info_param() turns a\nframe shorter than the fixed fields into a length near 64 KiB, and the\nparser then reads past the receive buffer.\n\nBoth the ipw2100 and ipw2200 management receive paths reach this\nfunction having established only that the frame carries the generic\n24-byte three-address header.\n\nReject the frame before any fixed field is touched.\n\nFound by an AI-assisted review of length arithmetic in management frame\nparsers.  Verified with a KUnit case under Generic KASAN on arm64 under\nQEMU; I do not have the hardware, so it is not tested on a real device."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/ipw2x00/libipw_rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9e8571affd1c54b9638b4ff9844e47aae07310f6","lessThan":"766268b429ae26d8ca599031fa962b0fe4673120","versionType":"git","status":"affected"},{"version":"9e8571affd1c54b9638b4ff9844e47aae07310f6","lessThan":"d70bdb84cf1782039384c1ffa7a18b0303c286a7","versionType":"git","status":"affected"},{"version":"9e8571affd1c54b9638b4ff9844e47aae07310f6","lessThan":"400b89217058fac672134a0d4092c8493dadb8ad","versionType":"git","status":"affected"},{"version":"9e8571affd1c54b9638b4ff9844e47aae07310f6","lessThan":"46aa75291056b6dc5faaf956dffdb3e9662477b0","versionType":"git","status":"affected"},{"version":"9e8571affd1c54b9638b4ff9844e47aae07310f6","lessThan":"e3025ecdb2057f866c09e059fc1466e81d6f243e","versionType":"git","status":"affected"},{"version":"9e8571affd1c54b9638b4ff9844e47aae07310f6","lessThan":"14cb425ba1f3a5d849e3bbc3d02d84e0ae195dbb","versionType":"git","status":"affected"},{"version":"9e8571affd1c54b9638b4ff9844e47aae07310f6","lessThan":"af1b69be19c34e28c0ae54bee954b58cd076969a","versionType":"git","status":"affected"},{"version":"9e8571affd1c54b9638b4ff9844e47aae07310f6","lessThan":"adb7118b7d2cfd7e8213c17d7d2829f353017754","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/ipw2x00/libipw_rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.15","status":"affected"},{"version":"0","lessThan":"2.6.15","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":4.2}]},"references":[{"url":"https://git.kernel.org/stable/c/14cb425ba1f3a5d849e3bbc3d02d84e0ae195dbb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/400b89217058fac672134a0d4092c8493dadb8ad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/46aa75291056b6dc5faaf956dffdb3e9662477b0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/766268b429ae26d8ca599031fa962b0fe4673120","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/adb7118b7d2cfd7e8213c17d7d2829f353017754","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/af1b69be19c34e28c0ae54bee954b58cd076969a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d70bdb84cf1782039384c1ffa7a18b0303c286a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e3025ecdb2057f866c09e059fc1466e81d6f243e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98349","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:28.127","lastModified":"2026-10-19T10:18:37.510","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libipw: reject too-short beacon and probe responses\n\nlibipw_process_probe_response() and the libipw_network_init() call it\nmakes assume the frame contains the full 36-byte beacon and probe\nresponse prefix, but the ipw2100 and ipw2200 receive paths only\nestablish that a management frame carries the generic 24-byte\nthree-address header.\n\nlibipw_network_init() then computes the information element length as\n\n\tstats->len - sizeof(*beacon)\n\nstats->len is a u16 and sizeof() has type size_t, so the subtraction is\nevaluated as size_t and wraps instead of going negative.  Truncating\nthat to the u16 length parameter of libipw_parse_info_param() yields\n65524 for a 24-byte beacon, and the parser then walks the receive\nbuffer as if it held almost 64 KiB of information elements, reading\npast the allocation.\n\nReject the frame before any fixed field is touched.\n\nFound by an AI-assisted review of length arithmetic in management frame\nparsers.  Verified with a KUnit case under Generic KASAN on arm64 under\nQEMU; I do not have the hardware, so it is not tested on a real device."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/ipw2x00/libipw_rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b453872c35cfcbdbf5a794737817f7d4e7b1b579","lessThan":"cee6f141b3bebe62eb0363fd147acb52023935f0","versionType":"git","status":"affected"},{"version":"b453872c35cfcbdbf5a794737817f7d4e7b1b579","lessThan":"23afeb5d2bdfd34c8a0a661876291a4fa9978293","versionType":"git","status":"affected"},{"version":"b453872c35cfcbdbf5a794737817f7d4e7b1b579","lessThan":"89959ff00a978f3172726d3d5f861ee6f1aae26d","versionType":"git","status":"affected"},{"version":"b453872c35cfcbdbf5a794737817f7d4e7b1b579","lessThan":"14ae269c1306053ddf1ccf37c4bd66e085a652d1","versionType":"git","status":"affected"},{"version":"b453872c35cfcbdbf5a794737817f7d4e7b1b579","lessThan":"ff756e6647722b7d225d882f7bdb186d8eee318e","versionType":"git","status":"affected"},{"version":"b453872c35cfcbdbf5a794737817f7d4e7b1b579","lessThan":"2c87bbc00dc93149d1dc4f803ad92d92e4ef3758","versionType":"git","status":"affected"},{"version":"b453872c35cfcbdbf5a794737817f7d4e7b1b579","lessThan":"19959fb60228f6dccc40d55507f8b1a751c2dc89","versionType":"git","status":"affected"},{"version":"b453872c35cfcbdbf5a794737817f7d4e7b1b579","lessThan":"5ce5721e8cbe3e80db8f43851cc2a2a92485ef4b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/ipw2x00/libipw_rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.14","status":"affected"},{"version":"0","lessThan":"2.6.14","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":4.2}]},"references":[{"url":"https://git.kernel.org/stable/c/14ae269c1306053ddf1ccf37c4bd66e085a652d1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/19959fb60228f6dccc40d55507f8b1a751c2dc89","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/23afeb5d2bdfd34c8a0a661876291a4fa9978293","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2c87bbc00dc93149d1dc4f803ad92d92e4ef3758","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5ce5721e8cbe3e80db8f43851cc2a2a92485ef4b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/89959ff00a978f3172726d3d5f861ee6f1aae26d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cee6f141b3bebe62eb0363fd147acb52023935f0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ff756e6647722b7d225d882f7bdb186d8eee318e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98350","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:28.283","lastModified":"2026-10-19T10:18:37.673","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: cyw: pass PMKID to firmware if present\n\nZero out auth_status on initialization. Otherwise, garbage will\nleak from the stack to the firmware (when ssid is less than 32 bytes\nand/or when params->pmkid is set). Then, pass the params->pmkid to the\nfirmware (without it, the firmware caches a garbage PMKID on successful\nauthentication and denies a subsequent association request that includes\nthe PMKID)."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"66f909308a7c05082919ff214a0bbe2a76aa0283","lessThan":"c2cf589c7d546557ed60c43f2ec014279265dfbf","versionType":"git","status":"affected"},{"version":"66f909308a7c05082919ff214a0bbe2a76aa0283","lessThan":"6fba6233e9ca7718661e53555a3961c58772c21a","versionType":"git","status":"affected"},{"version":"66f909308a7c05082919ff214a0bbe2a76aa0283","lessThan":"e2de8d5eb2984416affdd9559e55f37c7f1bbf47","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/6fba6233e9ca7718661e53555a3961c58772c21a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c2cf589c7d546557ed60c43f2ec014279265dfbf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e2de8d5eb2984416affdd9559e55f37c7f1bbf47","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98351","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:28.437","lastModified":"2026-10-19T10:18:37.777","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: virt_wifi: free skb when disconnected\n\nWhen the simulated link is disconnected, virt_wifi_start_xmit() returns\nNET_XMIT_DROP without freeing the skb. dev_hard_start_xmit() treats this\nreturn value as consumed, so every packet sent while disconnected leaks its\nskb.\n\nFree the skb before returning the drop status."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/virtual/virt_wifi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c7cdba31ed8b87526db978976392802d3f93110c","lessThan":"38d3a5df85345f158f78b478b265ca906224454e","versionType":"git","status":"affected"},{"version":"c7cdba31ed8b87526db978976392802d3f93110c","lessThan":"ee053ea35c759135460f03d1c574f4ed08de844a","versionType":"git","status":"affected"},{"version":"c7cdba31ed8b87526db978976392802d3f93110c","lessThan":"d177eca79e1106834bc423d3969a4a2e3987996a","versionType":"git","status":"affected"},{"version":"c7cdba31ed8b87526db978976392802d3f93110c","lessThan":"36727a702cf8e3399e3da60d0856378f6afcfb34","versionType":"git","status":"affected"},{"version":"c7cdba31ed8b87526db978976392802d3f93110c","lessThan":"56469996c10a0240653fc00576b4d33bdfb4cc51","versionType":"git","status":"affected"},{"version":"c7cdba31ed8b87526db978976392802d3f93110c","lessThan":"4f266738af45675faa0e8afee08c6e780afa8b06","versionType":"git","status":"affected"},{"version":"c7cdba31ed8b87526db978976392802d3f93110c","lessThan":"46371442847a725cc0df3697fea2eba1dd54b82b","versionType":"git","status":"affected"},{"version":"c7cdba31ed8b87526db978976392802d3f93110c","lessThan":"f9edf7cf63b96d2b776fca8d258d3c5256e40c8e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/virtual/virt_wifi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.0","status":"affected"},{"version":"0","lessThan":"5.0","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/36727a702cf8e3399e3da60d0856378f6afcfb34","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/38d3a5df85345f158f78b478b265ca906224454e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/46371442847a725cc0df3697fea2eba1dd54b82b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4f266738af45675faa0e8afee08c6e780afa8b06","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/56469996c10a0240653fc00576b4d33bdfb4cc51","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d177eca79e1106834bc423d3969a4a2e3987996a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee053ea35c759135460f03d1c574f4ed08de844a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f9edf7cf63b96d2b776fca8d258d3c5256e40c8e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98352","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:28.587","lastModified":"2026-10-19T10:18:37.897","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted\n\nThe client borrows shared CQ credits in the ADDR_RESOLVED handler via\nib_cq_pool_get(), before the peer is connected. create_cm() can return\n-ERESTARTSYS from wait_event_interruptible_timeout() without destroying\nthe CM ID. The init_conns() and stop-and-destroy paths then call\ndestroy_con_cq_qp() while cq is still NULL (no PUT) and only afterwards\nrdma_destroy_id().\n\nCMA serializes the handler against rdma_destroy_id() with handler_mutex,\nbut that does not order the GET against destroy_con_cq_qp(). If\nADDR_RESOLVED has already passed the DESTROYING check, it can take\ncon_mutex, GET credits, and then lose the con to kfree. Device\nunregister later hits WARN_ON(cq->cqe_used) in ib_cq_pool_cleanup().\n\nSet a per-connection flag under con_mutex before CQ/QP teardown so a\nracing ADDR_RESOLVED cannot borrow credits after teardown has begun."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/ulp/rtrs/rtrs-clt.c","drivers/infiniband/ulp/rtrs/rtrs-clt.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3b89e92c2a95a39c38a3808f4528e502a39bd94d","lessThan":"a82cca40139d9fcae8208901856bd5bb4051f097","versionType":"git","status":"affected"},{"version":"3b89e92c2a95a39c38a3808f4528e502a39bd94d","lessThan":"74c4ed55e61f1b65ddbebc5b635d136461a1c3da","versionType":"git","status":"affected"},{"version":"3b89e92c2a95a39c38a3808f4528e502a39bd94d","lessThan":"6f8020fe7465f49e234a576c04e415e9d08c7878","versionType":"git","status":"affected"},{"version":"3b89e92c2a95a39c38a3808f4528e502a39bd94d","lessThan":"31024e158b45358370a0a14ed96589e6aa62d6cb","versionType":"git","status":"affected"},{"version":"3b89e92c2a95a39c38a3808f4528e502a39bd94d","lessThan":"8f253d5893f991742464b9e7203c43fc08d0aa11","versionType":"git","status":"affected"},{"version":"3b89e92c2a95a39c38a3808f4528e502a39bd94d","lessThan":"bf88ac4867050112a6c819c8d1a7209bf48ef427","versionType":"git","status":"affected"},{"version":"3b89e92c2a95a39c38a3808f4528e502a39bd94d","lessThan":"2ae16aaa78b5edc6e6d0904c84fd9cdfb762bcda","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/ulp/rtrs/rtrs-clt.c","drivers/infiniband/ulp/rtrs/rtrs-clt.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2ae16aaa78b5edc6e6d0904c84fd9cdfb762bcda","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/31024e158b45358370a0a14ed96589e6aa62d6cb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6f8020fe7465f49e234a576c04e415e9d08c7878","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/74c4ed55e61f1b65ddbebc5b635d136461a1c3da","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8f253d5893f991742464b9e7203c43fc08d0aa11","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a82cca40139d9fcae8208901856bd5bb4051f097","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bf88ac4867050112a6c819c8d1a7209bf48ef427","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98353","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:28.750","lastModified":"2026-10-21T13:21:26.170","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables\n\nLocked QP and CQ lookups from EQ interrupts can deadlock with\ncreate-path XArray updates. If an interrupt arrives while the create\npath holds the plain xa_lock, the lookup spins forever trying to\nacquire the same lock.\n\nUse IRQ-safe XArray helpers for all QP and CQ create-path updates,\nincluding the GSI QP store and error paths. Initialize both arrays with\nXA_FLAGS_LOCK_IRQ so sleeping allocations preserve interrupt state."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/hw/erdma/erdma_main.c","drivers/infiniband/hw/erdma/erdma_verbs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1fc9c1933959d2776a1ce7bf424251b8b5b586cd","lessThan":"e32aa1d85126e6d5ef6efd594ced3f75178886ce","versionType":"git","status":"affected"},{"version":"4545f355654d044d35a31cd01cc46f491a8a7c36","lessThan":"74d4085221a7ec5440996af199ccadfa75b9eb0e","versionType":"git","status":"affected"},{"version":"98df2aee1459ee1c62c70cbe9b370d2a532aea36","lessThan":"00baeade709fb66da647e8327e8398bb532e30f7","versionType":"git","status":"affected"},{"version":"610ef81797bb4f709e8675c1d8d093bb9ccdcbd8","versionType":"git","status":"affected"},{"version":"c0a83f29a24c7e7f8516630848ef6db4c174deed","versionType":"git","status":"affected"},{"version":"05b8ca493dd02319bca93c640b259c2ba51ef321","versionType":"git","status":"affected"},{"version":"233f1b7fe2980e4e238fe03dd3ceddfd082cb4c8","versionType":"git","status":"affected"},{"version":"6e32f84b63c054e09392153125d7202abab2d14b","versionType":"git","status":"affected"},{"version":"ec987c0654651036dad6a42f7fa2a6d7c16a3687","versionType":"git","status":"affected"},{"version":"c92686867638cda954fdb2bdbac8a75e3aa6eaae","versionType":"git","status":"affected"},{"version":"6.1.188","lessThan":"6.2","versionType":"semver","status":"affected"},{"version":"6.6.157","lessThan":"6.7","versionType":"semver","status":"affected"},{"version":"6.12.110","lessThan":"6.13","versionType":"semver","status":"affected"},{"version":"6.6.160","lessThan":"6.7","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/hw/erdma/erdma_main.c","drivers/infiniband/hw/erdma/erdma_verbs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.18.52","lessThan":"6.18.58","versionType":"semver","status":"affected"},{"version":"7.2.6","lessThan":"7.2.8","versionType":"semver","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/00baeade709fb66da647e8327e8398bb532e30f7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/74d4085221a7ec5440996af199ccadfa75b9eb0e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e32aa1d85126e6d5ef6efd594ced3f75178886ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98354","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:28.883","lastModified":"2026-10-19T10:18:38.097","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mad: Fix receive buffer leak when PKey enforcement fails\n\nib_mad_complete_recv() initializes mad_recv_wc->rmpp_list and then runs\nib_mad_enforce_security() before linking recv_buf onto that list.  On\nfailure it calls ib_free_recv_mad(), which only walks rmpp_list and frees\nthe ib_mad_private of every buffer found there.  As the list is still\nempty at that point, nothing is freed at all.\n\nThe caller cannot clean up either: ib_mad_recv_done() sets recv to NULL\nright after ib_mad_complete_recv() returns, assuming the MAD layer took\nownership of the buffer.  Every MAD that fails the PKey check therefore\nleaks one ib_mad_private (about 300 bytes per IB port MAD, ~2K for OPA),\nand a remote node can trigger this repeatedly by sending MADs with a\nwrong PKey.\n\nLink recv_buf onto rmpp_list right after the list is initialized, so the\nerror path has something to free."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/core/mad.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"47a2b338fe63200d716d2e24131cdb49f17c77da","lessThan":"4617c9a856188674dddb0ca66979746d07688579","versionType":"git","status":"affected"},{"version":"47a2b338fe63200d716d2e24131cdb49f17c77da","lessThan":"8e2036fb47a5b152d53eadbd35abf311bd34cc7f","versionType":"git","status":"affected"},{"version":"47a2b338fe63200d716d2e24131cdb49f17c77da","lessThan":"bad289e42f512646a988f278f536d21547df73f1","versionType":"git","status":"affected"},{"version":"47a2b338fe63200d716d2e24131cdb49f17c77da","lessThan":"752b30e9d339008e5ce7eed412e9446078916129","versionType":"git","status":"affected"},{"version":"47a2b338fe63200d716d2e24131cdb49f17c77da","lessThan":"39c4ea72a40503e102ae07e6776005f96ca078a6","versionType":"git","status":"affected"},{"version":"47a2b338fe63200d716d2e24131cdb49f17c77da","lessThan":"5091e25ec503f7fc02723ca435226467b68caac7","versionType":"git","status":"affected"},{"version":"47a2b338fe63200d716d2e24131cdb49f17c77da","lessThan":"c0d8df85db146d6275e226cb950023be69dd6c77","versionType":"git","status":"affected"},{"version":"47a2b338fe63200d716d2e24131cdb49f17c77da","lessThan":"3476c28c9addfa253f505e6bd87f1f5598b961d0","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/core/mad.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.13","status":"affected"},{"version":"0","lessThan":"4.13","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3476c28c9addfa253f505e6bd87f1f5598b961d0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/39c4ea72a40503e102ae07e6776005f96ca078a6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4617c9a856188674dddb0ca66979746d07688579","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5091e25ec503f7fc02723ca435226467b68caac7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/752b30e9d339008e5ce7eed412e9446078916129","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8e2036fb47a5b152d53eadbd35abf311bd34cc7f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bad289e42f512646a988f278f536d21547df73f1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c0d8df85db146d6275e226cb950023be69dd6c77","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98355","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:29.040","lastModified":"2026-10-19T10:18:38.210","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rtrs: guard against null kobj name\n\nIn the client, if `init_path()` errors, the callee tries to clean up\nwith `rtrs_clt_close_conns()`. However, this can lead to calling the\nevent tracing code with `clt_path->kobj->name` being `NULL` and thus\ncausing a null pointer dereference when trying to copy from it.\n\nThis just adds a guard to check that the name is not `NULL` before\ncopying from it. The server appears to have a similar pattern."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h","drivers/infiniband/ulp/rtrs/rtrs-srv-trace.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5a93929d9f9a1d82946ddd49e260b6dd1756ad6d","lessThan":"f79cf42ff23f9120246cd6740eaa26f59c632a4a","versionType":"git","status":"affected"},{"version":"5a93929d9f9a1d82946ddd49e260b6dd1756ad6d","lessThan":"99c24a8968ebef0573825b5cb89d5985d51635b9","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h","drivers/infiniband/ulp/rtrs/rtrs-srv-trace.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.1","status":"affected"},{"version":"0","lessThan":"6.1","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/99c24a8968ebef0573825b5cb89d5985d51635b9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f79cf42ff23f9120246cd6740eaa26f59c632a4a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98356","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:29.160","lastModified":"2026-10-19T10:18:38.297","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup\n\nbnxt_re_init_dcb_wq() ignores a failed allocation. The async DCB\nhandler later calls queue_work() on the NULL pointer."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/hw/bnxt_re/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"51dc5312dcd929efea7647c0c0e75afa461531b5","lessThan":"a0fb2007d00b440fd1adddd9b042f01744ed0efc","versionType":"git","status":"affected"},{"version":"51dc5312dcd929efea7647c0c0e75afa461531b5","lessThan":"727bbda37d9758960c346546004eea4ad49242e1","versionType":"git","status":"affected"},{"version":"51dc5312dcd929efea7647c0c0e75afa461531b5","lessThan":"6c368f7baaea63c1c7c28c6df271511f2a1562c9","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/hw/bnxt_re/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.14","status":"affected"},{"version":"0","lessThan":"6.14","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/6c368f7baaea63c1c7c28c6df271511f2a1562c9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/727bbda37d9758960c346546004eea4ad49242e1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a0fb2007d00b440fd1adddd9b042f01744ed0efc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98357","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:29.293","lastModified":"2026-10-19T10:18:38.383","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nIB/isert: wait for deferred control PDU completions before releasing the connection\n\nisert_send_done() hands ISTATE_SEND_TASKMGTRSP, ISTATE_SEND_REJECT and\nISTATE_SEND_TEXTRSP completions off to isert_comp_wq and returns.  The work\nitem then runs isert_completion_put() -> isert_put_cmd(), which reads\nisert_conn->conn and takes conn->cmd_lock.\n\nNothing orders that work item against teardown.  isert_wait_conn() queues\nisert_release_work, which frees isert_conn, and iscsit_close_connection()\nfrees the iscsit_conn right after it returns, so the queued work can run\nagainst freed memory.\n\nCount the deferred control PDU completions per connection and let\nisert_wait_conn() wait for them before the release work is queued.\n\nISTATE_SEND_LOGOUTRSP is deliberately not counted: that branch runs\niscsit_logout_post_handler(), which ends up waiting for\nconn->conn_wait_comp, and that completion is only sent by\niscsit_close_connection() after it has called iscsit_wait_conn().\nWaiting for it here would deadlock.  Its wait stays the existing\nisert_wait4logout().\n\nThe splat below is from a kernel with tracing printk()s and an msleep(200)\ninjected into isert_do_control_comp() to widen the window:\n\n  BUG: KASAN: slab-use-after-free in isert_put_cmd+0x53d/0x620\n  Read of size 8 at addr ffff8881054f1038 by task kworker/u17:1/182\n\n  CPU: 0 UID: 0 PID: 182 Comm: kworker/u17:1 Tainted: G    B               7.2.0-rc5-TWIDE-gb8babf08acc7 #1 PREEMPT(lazy)\n  Tainted: [B]=BAD_PAGE\n  Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n  Workqueue: isert_comp_wq isert_do_control_comp\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x53/0x70\n   print_report+0xd0/0x630\n   ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n   ? _raw_spin_unlock_irqrestore+0x3e/0x70\n   ? isert_put_cmd+0x53d/0x620\n   kasan_report+0xce/0x100\n   ? isert_put_cmd+0x53d/0x620\n   isert_put_cmd+0x53d/0x620\n   ? isert_completion_put+0x305/0x330\n   ? isert_do_control_comp+0x2ef/0x310\n   process_one_work+0x633/0x1030\n   ? assign_work+0x11d/0x370\n   worker_thread+0x45b/0xd10\n   ? __pfx_worker_thread+0x10/0x10\n   ? __pfx_worker_thread+0x10/0x10\n   kthread+0x2c6/0x3b0\n   ? recalc_sigpending+0x15c/0x1e0\n   ? __pfx_kthread+0x10/0x10\n   ret_from_fork+0x36e/0x5a0\n   ? __pfx_ret_from_fork+0x10/0x10\n   ? __switch_to+0x572/0xdd0\n   ? __pfx_kthread+0x10/0x10\n   ret_from_fork_asm+0x1a/0x30\n   </TASK>\n\n  Allocated by task 48:\n   kasan_save_stack+0x33/0x60\n   kasan_save_track+0x14/0x30\n   __kasan_kmalloc+0x8f/0xa0\n   __kmalloc_cache_noprof+0x158/0x370\n   isert_cma_handler+0x1e3/0x2ae0\n   cma_cm_event_handler+0x3e/0x240\n   cma_ib_req_handler+0x17d9/0x4490\n   cm_process_work+0x41/0x330\n   cm_work_handler+0x5727/0xc160\n   process_one_work+0x633/0x1030\n   worker_thread+0x45b/0xd10\n   kthread+0x2c6/0x3b0\n   ret_from_fork+0x36e/0x5a0\n   ret_from_fork_asm+0x1a/0x30\n\n  Freed by task 184:\n   kasan_save_stack+0x33/0x60\n   kasan_save_track+0x14/0x30\n   kasan_save_free_info+0x3b/0x60\n   __kasan_slab_free+0x43/0x70\n   kfree+0x121/0x380\n   iscsit_close_connection+0x7cf/0x1e60\n   iscsit_take_action_for_connection_exit+0x1b6/0x360\n   iscsi_target_tx_thread+0x472/0x690\n   kthread+0x2c6/0x3b0\n   ret_from_fork+0x36e/0x5a0\n   ret_from_fork_asm+0x1a/0x30"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/ulp/isert/ib_isert.c","drivers/infiniband/ulp/isert/ib_isert.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b8d26b3be8b33682cf163274ed07479a70554633","lessThan":"f5613acbe2e346d5c466ef0bd264fca936b69f82","versionType":"git","status":"affected"},{"version":"b8d26b3be8b33682cf163274ed07479a70554633","lessThan":"ccdb1523f12bc8a9646de65055d1aafed9e9bcc6","versionType":"git","status":"affected"},{"version":"b8d26b3be8b33682cf163274ed07479a70554633","lessThan":"0e230917670c6e6fe3243abfa11299fcbe05b1f4","versionType":"git","status":"affected"},{"version":"b8d26b3be8b33682cf163274ed07479a70554633","lessThan":"505b242d9351690d1385bbe508ab4666f60363ce","versionType":"git","status":"affected"},{"version":"b8d26b3be8b33682cf163274ed07479a70554633","lessThan":"7edb8a88d6c76237c8b4435765bee1009e26a50a","versionType":"git","status":"affected"},{"version":"b8d26b3be8b33682cf163274ed07479a70554633","lessThan":"b96b8b3e41c308f606ffd10cfef1a7b9f97414cd","versionType":"git","status":"affected"},{"version":"b8d26b3be8b33682cf163274ed07479a70554633","lessThan":"7908fbc597a694bbd99bfb59ece73bc3daded68e","versionType":"git","status":"affected"},{"version":"b8d26b3be8b33682cf163274ed07479a70554633","lessThan":"a8fe3dfce8c0d8a76dc3d8486a5bff5feebe156f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/ulp/isert/ib_isert.c","drivers/infiniband/ulp/isert/ib_isert.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.10","status":"affected"},{"version":"0","lessThan":"3.10","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0e230917670c6e6fe3243abfa11299fcbe05b1f4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/505b242d9351690d1385bbe508ab4666f60363ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7908fbc597a694bbd99bfb59ece73bc3daded68e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7edb8a88d6c76237c8b4435765bee1009e26a50a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a8fe3dfce8c0d8a76dc3d8486a5bff5feebe156f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b96b8b3e41c308f606ffd10cfef1a7b9f97414cd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ccdb1523f12bc8a9646de65055d1aafed9e9bcc6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f5613acbe2e346d5c466ef0bd264fca936b69f82","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98358","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:29.477","lastModified":"2026-10-19T10:18:38.547","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nIB/iser: reject a remote invalidation of an unregistered direction\n\nA write command whose data is sent entirely as immediate data is not\nregistered.  iser_reg_mem_fastreg() takes the DMA key path and leaves\nrdma_reg[ISER_DIR_OUT].desc at NULL, while iser_dma_map_task_data() has\nalready set dir[ISER_DIR_OUT].\n\niser_check_remote_inv() looks at dir[] alone and hands the descriptor to\niser_inv_desc(), which reads desc->sig_protected.  A target that answers\nsuch a command with IB_WR_SEND_WITH_INV faults the initiator.\nLeaving those commands unregistered is deliberate.\n\nThe same function already terminates the connection when a target sends\na remote invalidation the initiator did not ask for.  A target that\ninvalidates a direction that was never registered is in the same class,\nso give it the same answer.\n\n  Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN NOPTI\n  KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]\n  CPU: 0 UID: 0 PID: 40 Comm: kworker/u8:2 Not tainted 7.2.0-rc5-ISERHOST-gf5098b6bae76-dirty #3 PREEMPT(lazy)\n  Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n  Workqueue: rxe_wq do_work\n  RIP: 0010:iser_task_rsp+0x6d6/0xec0\n  Code: 48 c1 ea 03 80 3c 02 00 0f 85 ba 06 00 00 48 8b 9b 78 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 20 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 06 0f 8e 76 06 00 00 80 7b 20 00 0f 84 3d 04\n  RSP: 0018:ffff88811b008db8 EFLAGS: 00010202\n  RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000001848\n  RDX: 0000000000000004 RSI: 1ffff11021587b12 RDI: 0000000000000020\n  RBP: ffff88810adc1ae4 R08: ffff888109b7f860 R09: ffffffff90a922c0\n  R10: ffff88810adc1a1c R11: 000000000000003c R12: ffff888109b7f800\n  R13: ffff88810adc1acc R14: ffff888109b7f820 R15: 0000000000000000\n  FS:  0000000000000000(0000) GS:ffff88818a676000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00000000005afe2b CR3: 000000010af23005 CR4: 0000000000770ef0\n  PKRU: 55555554\n  Call Trace:\n   <IRQ>\n   __ib_process_cq+0xe1/0x390\n   ib_poll_handler+0x6e/0x200\n   irq_poll_softirq+0x1df/0x480\n   ? clockevents_program_event+0x2ba/0x860\n   ? __pfx_irq_poll_softirq+0x10/0x10\n   handle_softirqs+0x18e/0x590\n   ? __pfx_handle_softirqs+0x10/0x10\n   ? __hrtimer_rearm_deferred+0x156/0x450\n   do_softirq+0x3b/0x60\n   </IRQ>\n   <TASK>\n   __local_bh_enable_ip+0x61/0x70\n   __alloc_skb+0x732/0x890\n   ? _raw_spin_lock_irqsave+0x85/0xe0\n   ? __pfx___alloc_skb+0x10/0x10\n   ? _raw_read_unlock_irqrestore+0x16/0x50\n   rxe_init_packet+0x16b/0x4f0\n   prepare_ack_packet+0xb8/0x830\n   rxe_receiver+0x499/0x9980\n   ? __pfx_rxe_receiver+0x10/0x10\n   ? rxe_completer+0x29e5/0x38c0\n   ? hrtimer_start_range_ns_common+0x75f/0x1730\n   ? hrtimer_start_range_ns+0xa6/0x2c0\n   ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n   ? __pfx_rxe_receiver+0x10/0x10\n   do_work+0x144/0x470\n   process_one_work+0x633/0x1030\n   ? assign_work+0x11d/0x370\n   worker_thread+0x45b/0xd10\n   ? __pfx_worker_thread+0x10/0x10\n   kthread+0x2c6/0x3b0\n   ? recalc_sigpending+0x15c/0x1e0\n   ? __pfx_kthread+0x10/0x10\n   ret_from_fork+0x36e/0x5a0\n   ? __pfx_ret_from_fork+0x10/0x10\n   ? __switch_to+0x572/0xdd0\n   ? __pfx_kthread+0x10/0x10\n   ret_from_fork_asm+0x1a/0x30\n   </TASK>\n  Modules linked in:\n  ---[ end trace 0000000000000000 ]---"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/ulp/iser/iser_initiator.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"59caaed7a72a0e3750dfb84636dae6b781559310","lessThan":"198e4db9add54a50cce60a5d80b8f0ee5456b65a","versionType":"git","status":"affected"},{"version":"59caaed7a72a0e3750dfb84636dae6b781559310","lessThan":"b9e37452915feaa8422af87dea5d0c16a7d1ff13","versionType":"git","status":"affected"},{"version":"59caaed7a72a0e3750dfb84636dae6b781559310","lessThan":"19ddd4af7fce9200e70882f622011e9dd130f427","versionType":"git","status":"affected"},{"version":"59caaed7a72a0e3750dfb84636dae6b781559310","lessThan":"9d145a2d8d6f8f2cc460b80df41870819048f2a0","versionType":"git","status":"affected"},{"version":"59caaed7a72a0e3750dfb84636dae6b781559310","lessThan":"b4d278c91209931199db9c0836dc2e21a7593dad","versionType":"git","status":"affected"},{"version":"59caaed7a72a0e3750dfb84636dae6b781559310","lessThan":"6ed3ebaff3345837f0528d85bd39ce573c7b9a41","versionType":"git","status":"affected"},{"version":"59caaed7a72a0e3750dfb84636dae6b781559310","lessThan":"ceecf3f9c322fc6937a66682942a26ad13a34a07","versionType":"git","status":"affected"},{"version":"59caaed7a72a0e3750dfb84636dae6b781559310","lessThan":"d85f0f0a7c85756fc992c70d869706f19dac9259","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/ulp/iser/iser_initiator.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.5","status":"affected"},{"version":"0","lessThan":"4.5","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/198e4db9add54a50cce60a5d80b8f0ee5456b65a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/19ddd4af7fce9200e70882f622011e9dd130f427","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6ed3ebaff3345837f0528d85bd39ce573c7b9a41","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9d145a2d8d6f8f2cc460b80df41870819048f2a0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b4d278c91209931199db9c0836dc2e21a7593dad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b9e37452915feaa8422af87dea5d0c16a7d1ff13","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ceecf3f9c322fc6937a66682942a26ad13a34a07","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d85f0f0a7c85756fc992c70d869706f19dac9259","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98359","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:29.660","lastModified":"2026-10-19T10:18:38.680","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Reject unregistering netdevs in ib_get_eth_speed\n\nib_device_get_netdev() intentionally returns a referenced net_device even\nwhen it is unregistering, so matching and cleanup callers can still find\nthe association. The reference keeps struct net_device allocated, but does\nnot guarantee that the device remains operational.\n\nib_get_eth_speed() uses the returned device operationally by invoking its\nethtool callback. Although that call is made under RTNL, the function does\nnot verify the registration state first. An asynchronous RDMA port query\ncan therefore call into a netdev after NETDEV_UNREGISTER and ndo_uninit\nhave completed.\n\nCheck for NETREG_REGISTERED while holding RTNL and return -ENODEV for a\ndevice which is being unregistered. Keeping RTNL across the check and the\nethtool operation prevents unregister from starting between them.\n\nKeep the speed fallback and warning under RTNL as well, so the warning can\nsafely read netdev->name. Drop the netdev reference before releasing RTNL\nonce all accesses to the device are complete."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/core/verbs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d41861942fc55c14b6280d9568a0d0112037f065","lessThan":"be4b44c8b47c67a04c08b1a0aba18006b749ae6a","versionType":"git","status":"affected"},{"version":"d41861942fc55c14b6280d9568a0d0112037f065","lessThan":"45c60ffc79771bad154f224a05753191cf1b37bc","versionType":"git","status":"affected"},{"version":"d41861942fc55c14b6280d9568a0d0112037f065","lessThan":"520cd057f138ed8dbe8e05f0eae3a8ed4c5d3a5e","versionType":"git","status":"affected"},{"version":"d41861942fc55c14b6280d9568a0d0112037f065","lessThan":"a219459fbd1b2598e63c81a52847eba6c28b72d2","versionType":"git","status":"affected"},{"version":"d41861942fc55c14b6280d9568a0d0112037f065","lessThan":"5bd42f74ec3b4f4687fb600f367af0828d513b3c","versionType":"git","status":"affected"},{"version":"d41861942fc55c14b6280d9568a0d0112037f065","lessThan":"ef9fbe1b93f3b617b96e86d5cd76b3fa44514cb5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/core/verbs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.14","status":"affected"},{"version":"0","lessThan":"4.14","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/45c60ffc79771bad154f224a05753191cf1b37bc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/520cd057f138ed8dbe8e05f0eae3a8ed4c5d3a5e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5bd42f74ec3b4f4687fb600f367af0828d513b3c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a219459fbd1b2598e63c81a52847eba6c28b72d2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/be4b44c8b47c67a04c08b1a0aba18006b749ae6a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ef9fbe1b93f3b617b96e86d5cd76b3fa44514cb5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98360","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:29.803","lastModified":"2026-10-19T10:18:38.803","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds\n\nrxe_get_mcg() publishes a newly allocated multicast group in\nrxe->mcg_tree before programming the backing Ethernet multicast address\nwith rxe_mcast_add(), which runs outside mcg_lock. A local userspace\nRDMA client reaches this path with ATTACH_MCAST on a UD QP; if\nrxe_mcast_add() then returns an error (for example -ENODEV when the\nbacking netdev has been removed, or a propagated dev_mc_add() error),\nthe unwind frees the published group without removing it from the tree.\nA later lookup of the same MGID dereferences the freed struct rxe_mcg\nfrom __rxe_lookup_mcg().\n\nFix this by keeping the new mcg private until rxe_mcast_add() succeeds.\nSplit the tree publication into __rxe_publish_mcg(), call rxe_mcast_add()\nbefore taking the tree reference, and free the still-private mcg on\nfailure. Because the group is never visible in mcg_tree until the\nmulticast address is programmed, no concurrent caller can look it up or\nattach a QP to a group that is about to be torn down, so the error path\nneeds no conditional unwind. If another caller publishes the same MGID\nwhile the address is being programmed, the post-add re-check under\nmcg_lock finds the winner; this caller then drops its private object and\nbalances its own rxe_mcast_add() with rxe_mcast_del() before returning\nthe winner.\n\nReproduced by forcing the rxe_mcast_add() error return under KASAN:\nwithout the change the next attach to the same MGID reports a\nslab-use-after-free in __rxe_lookup_mcg(); with it the forced failure\nreturns cleanly. A no-injection attach/detach regression, including a\ntwo-QP shared join/leave and re-attach, stays KASAN- and leak-clean."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/sw/rxe/rxe_mcast.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a926a903b7dc39a8a949150258c09290998dd812","lessThan":"ddb43ac0926d4a931bc9b7744b93627f627457e5","versionType":"git","status":"affected"},{"version":"a926a903b7dc39a8a949150258c09290998dd812","lessThan":"c79a789aa15180a1543b5db49c343d12e3ec214d","versionType":"git","status":"affected"},{"version":"a926a903b7dc39a8a949150258c09290998dd812","lessThan":"faae1fb4ccf8205806a8802c008798dabeb0205b","versionType":"git","status":"affected"},{"version":"a926a903b7dc39a8a949150258c09290998dd812","lessThan":"02c0a2fa69c16248a7432af8a6d64ab2a73a5283","versionType":"git","status":"affected"},{"version":"a926a903b7dc39a8a949150258c09290998dd812","lessThan":"d4fc4e37f8a143b0fe83b42c8fb48cf542154fee","versionType":"git","status":"affected"},{"version":"a926a903b7dc39a8a949150258c09290998dd812","lessThan":"1caceeb2d74bbe88223aea55eb8626b4c5f076fd","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/sw/rxe/rxe_mcast.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.18","status":"affected"},{"version":"0","lessThan":"5.18","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/02c0a2fa69c16248a7432af8a6d64ab2a73a5283","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1caceeb2d74bbe88223aea55eb8626b4c5f076fd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c79a789aa15180a1543b5db49c343d12e3ec214d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d4fc4e37f8a143b0fe83b42c8fb48cf542154fee","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ddb43ac0926d4a931bc9b7744b93627f627457e5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/faae1fb4ccf8205806a8802c008798dabeb0205b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98361","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:29.960","lastModified":"2026-10-19T10:18:38.937","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths\n\nCommit 0b261d7c1cd3 (\"RDMA/rxe: Break endless pagefault loop for RO\npages\") dropped the access permission test from rxe_check_pagefault()\nand left only HMM_PFN_VALID. A page faulted in read-only, for example\na page-cache folio behind a PROT_READ file mapping, then satisfies the\ncheck and ODP write operations (RDMA WRITE, RDMA READ response, SEND\npayload, atomics) modify it through kmap without ever breaking CoW.\n\nAn unprivileged user can register an ODP MR over such a mapping and\nhave incoming RDMA traffic overwrite the page cache of a file it only\nholds O_RDONLY, including /etc/passwd or setuid binaries. This is the\nsame primitive class as Dirty COW and CVE-2022-2590.\n\nmlx5 has the missing invariant: its ODP path sets the device write bit\nonly for pfns that carry HMM_PFN_WRITE. Restore it in rxe by requiring\nHMM_PFN_WRITE in rxe_check_pagefault() for every operation except\nRXE_PAGEFAULT_RDONLY. A write to a non-writable VMA now fails the one\nfault attempt with -EPERM from hmm_vma_fault() instead of re-faulting\nforever. For a writable VMA the fault breaks CoW and the write lands\nin the private page.\n\nKeep pmem flushes on the read-only check. arch_wb_cache_pmem() never\nmodifies memory, and the FLUSH access bits do not make the umem\nwritable, so classifying flushes as writes would make every flush\nagainst a flush-only MR fail."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/sw/rxe/rxe_odp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0b261d7c1cd32dc93cbc92425fb55e67b24c6638","lessThan":"c6f56982ec5c7da83c4bdfcce3b6db18bcfe6425","versionType":"git","status":"affected"},{"version":"0b261d7c1cd32dc93cbc92425fb55e67b24c6638","lessThan":"2d6c6f94d3e1cde049fe5db71dbd5549f10b2de1","versionType":"git","status":"affected"},{"version":"0b261d7c1cd32dc93cbc92425fb55e67b24c6638","lessThan":"769001ce838d907ecaa95f1d0a4e8fc86f761f9f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/sw/rxe/rxe_odp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/2d6c6f94d3e1cde049fe5db71dbd5549f10b2de1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/769001ce838d907ecaa95f1d0a4e8fc86f761f9f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c6f56982ec5c7da83c4bdfcce3b6db18bcfe6425","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98362","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:30.090","lastModified":"2026-10-19T10:18:39.057","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nclk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate\n\ndvfs_get_idx() may return an out-of-range index if the SCP firmware is\nbuggy or returns a stale value. Only negative indexes were rejected, so a\nlarge index walked past info->opps and could treat garbage as a clock rate\n(KASAN OOB / wrong frequency to consumers). The missing upper bound dates\nback to the original SCPI clock driver.\n\nTreat indexes >= opp count as invalid and return 0, same as idx < 0."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/clk/clk-scpi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cd52c2a4b5c43631e429d06dce12e08b0cab477f","lessThan":"6e3b55823da8ef0d99621efb422cc29f50d7f280","versionType":"git","status":"affected"},{"version":"cd52c2a4b5c43631e429d06dce12e08b0cab477f","lessThan":"7204095917aeaac89db7377c29a457351a19b076","versionType":"git","status":"affected"},{"version":"cd52c2a4b5c43631e429d06dce12e08b0cab477f","lessThan":"0f89e2ac0e945da2ce798f6a61aebf9d291c2e0a","versionType":"git","status":"affected"},{"version":"cd52c2a4b5c43631e429d06dce12e08b0cab477f","lessThan":"56b7a9d89c67932bf11b71e3b6d17941fc24a393","versionType":"git","status":"affected"},{"version":"cd52c2a4b5c43631e429d06dce12e08b0cab477f","lessThan":"a82b274697d0876b478594ca78ad1e6cb062467b","versionType":"git","status":"affected"},{"version":"cd52c2a4b5c43631e429d06dce12e08b0cab477f","lessThan":"e1188332a9110cf3635fe286481ee38305b3c2b6","versionType":"git","status":"affected"},{"version":"cd52c2a4b5c43631e429d06dce12e08b0cab477f","lessThan":"108c46e8dacc4a0e472a74f98171115d49cbc079","versionType":"git","status":"affected"},{"version":"cd52c2a4b5c43631e429d06dce12e08b0cab477f","lessThan":"70f4b78d560e592cbf3325b162424737d032fc1d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/clk/clk-scpi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.4","status":"affected"},{"version":"0","lessThan":"4.4","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0f89e2ac0e945da2ce798f6a61aebf9d291c2e0a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/108c46e8dacc4a0e472a74f98171115d49cbc079","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/56b7a9d89c67932bf11b71e3b6d17941fc24a393","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e3b55823da8ef0d99621efb422cc29f50d7f280","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/70f4b78d560e592cbf3325b162424737d032fc1d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7204095917aeaac89db7377c29a457351a19b076","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a82b274697d0876b478594ca78ad1e6cb062467b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e1188332a9110cf3635fe286481ee38305b3c2b6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98363","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:30.297","lastModified":"2026-10-19T10:18:39.177","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS\n\nscpi_dvfs_get_info() already rejected a zero opp_count, but still trusted\nany larger value from the SCP firmware. The shared-memory reply only holds\nMAX_DVFS_OPPS entries in buf.opps[]; a bigger count over-reads that array\nand then sizes the allocated OPP table incorrectly (garbage OPPs / OOB).\nThe missing upper bound dates back to the original SCPI DVFS support.\n\nReject zero and out-of-range counts in one check and return -EINVAL."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/firmware/arm_scpi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8cb7cf56c9fe5412de238465b27ef35b4d2801aa","lessThan":"e9887eeaa138c6b5697af3d2f7c71dc82407b154","versionType":"git","status":"affected"},{"version":"8cb7cf56c9fe5412de238465b27ef35b4d2801aa","lessThan":"1aadbef648e92ca642125f188f99b0a26628e3ba","versionType":"git","status":"affected"},{"version":"8cb7cf56c9fe5412de238465b27ef35b4d2801aa","lessThan":"7daaa684097377b66b98a832de307688a7f3bbc7","versionType":"git","status":"affected"},{"version":"8cb7cf56c9fe5412de238465b27ef35b4d2801aa","lessThan":"f17865332cc4ceaac846bcd7c28badbaedfabeff","versionType":"git","status":"affected"},{"version":"8cb7cf56c9fe5412de238465b27ef35b4d2801aa","lessThan":"0130f9ad3974a5b2ad0fa03d0b300a9fb83ed901","versionType":"git","status":"affected"},{"version":"8cb7cf56c9fe5412de238465b27ef35b4d2801aa","lessThan":"69ec03cd481973e4be44a7158ed6c0fa06a9a5f9","versionType":"git","status":"affected"},{"version":"8cb7cf56c9fe5412de238465b27ef35b4d2801aa","lessThan":"cc563a59aded6f3b02d75dcc3c0bc5e90755d99e","versionType":"git","status":"affected"},{"version":"8cb7cf56c9fe5412de238465b27ef35b4d2801aa","lessThan":"32471d84a487c7fd74532bc96be56f8028cf4a3f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/firmware/arm_scpi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.4","status":"affected"},{"version":"0","lessThan":"4.4","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0130f9ad3974a5b2ad0fa03d0b300a9fb83ed901","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1aadbef648e92ca642125f188f99b0a26628e3ba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/32471d84a487c7fd74532bc96be56f8028cf4a3f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/69ec03cd481973e4be44a7158ed6c0fa06a9a5f9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7daaa684097377b66b98a832de307688a7f3bbc7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cc563a59aded6f3b02d75dcc3c0bc5e90755d99e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e9887eeaa138c6b5697af3d2f7c71dc82407b154","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f17865332cc4ceaac846bcd7c28badbaedfabeff","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98364","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:30.547","lastModified":"2026-10-19T10:18:39.290","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: hold net_device reference under RCU in bundle creation\n\nxfrm_bundle_create() and xfrm_create_dummy_bundle() read dst->dev into\na local pointer without taking a device reference, then pass it to\nxfrm_fill_dst(). A concurrent RTM_DELLINK replaces dst->dev via\ndst_dev_put() and frees the old net_device, causing a use-after-free\nwhen xfrm6_fill_dst() later dereferences the stale dev pointer.\n\n  BUG: KASAN: slab-use-after-free in xfrm6_fill_dst+0x82c/0x860\n  (net/ipv6/xfrm6_policy.c:86 netdev_hold())\n  Read of size 8 at addr ffff8880142fe588 by task exploit/153\n  Call Trace:\n   xfrm6_fill_dst+0x82c/0x860\n   xfrm_resolve_and_create_bundle+0x21d4/0x2bd0\n   xfrm_lookup_with_ifid+0x485/0x1640\n   ip6_dst_lookup_flow+0x19b/0x1e0\n   udpv6_sendmsg+0x1443/0x2dd0\n\nFix this by reading dst->dev via dst_dev_rcu() and keeping the RCU\nread-side critical section active until xfrm_fill_dst() has taken the\nrequired device references."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/xfrm/xfrm_policy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"25ee3286dcbc830a833354bb1d15567956844813","lessThan":"8d85d6bc9c46dc41cb2be0eac53f8ab068c3a807","versionType":"git","status":"affected"},{"version":"25ee3286dcbc830a833354bb1d15567956844813","lessThan":"9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/xfrm/xfrm_policy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.25","status":"affected"},{"version":"0","lessThan":"2.6.25","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/8d85d6bc9c46dc41cb2be0eac53f8ab068c3a807","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98365","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:30.677","lastModified":"2026-10-19T10:18:39.407","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access\n\nmr_check_range() validates that [iova, iova+length) falls within the\nregistered MR range using wraparound-prone arithmetic:\n\n    if (iova < mr->ibmr.iova ||\n        iova + length > mr->ibmr.iova + mr->ibmr.length)\n\nA remote peer can craft an RDMA-Write/Read RETH so that iova + length\nwraps to 0 (e.g. iova=0xfffffffffffffff8, length=8), bypassing the\ncheck. rxe_mr_iova_to_index() then computes a huge index (int idx, only\nguarded by WARN_ON) and rxe_mr_copy_xarray() dereferences\nmr->page_info[huge], causing an out-of-bounds read/write and a kernel\noops that is triggerable by an unauthenticated remote peer.\n\nRewrite the check in overflow-safe form; the first two clauses guarantee\nthat the subsequent subtractions do not underflow:\n\n    if (iova < mr->ibmr.iova ||\n        length > mr->ibmr.length ||\n        iova - mr->ibmr.iova > mr->ibmr.length - length)\n\nWith the fix, mr_check_range() returns -EINVAL for the crafted iova and\nthe responder reports REMOTE_ACCESS_ERROR instead of triggering the OOB."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/sw/rxe/rxe_mr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8700e3e7c4857d28ebaa824509934556da0b3e76","lessThan":"b7d2118660545a00b21e83010ded1a231c6fb8c5","versionType":"git","status":"affected"},{"version":"8700e3e7c4857d28ebaa824509934556da0b3e76","lessThan":"5d9426a74fc8cb8f375fcdc19b465a030f9b8cab","versionType":"git","status":"affected"},{"version":"8700e3e7c4857d28ebaa824509934556da0b3e76","lessThan":"2f3b705144e3a3c14184fec6e354680081fe91ec","versionType":"git","status":"affected"},{"version":"8700e3e7c4857d28ebaa824509934556da0b3e76","lessThan":"3431f525718f6b07da308cda6d44f8cb548bbd37","versionType":"git","status":"affected"},{"version":"8700e3e7c4857d28ebaa824509934556da0b3e76","lessThan":"d10e2a08799e858d3e71ea4169bcd018f216d444","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/sw/rxe/rxe_mr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.8","status":"affected"},{"version":"0","lessThan":"4.8","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/2f3b705144e3a3c14184fec6e354680081fe91ec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3431f525718f6b07da308cda6d44f8cb548bbd37","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5d9426a74fc8cb8f375fcdc19b465a030f9b8cab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b7d2118660545a00b21e83010ded1a231c6fb8c5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d10e2a08799e858d3e71ea4169bcd018f216d444","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98366","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:30.823","lastModified":"2026-10-19T10:18:39.543","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: validate access flags before swapping the MR's PD\n\nrxe_rereg_user_mr() reassigns mr->ibmr.pd first and only then\nvalidates the IB_MR_REREG_ACCESS argument:\n\n\tif (flags & IB_MR_REREG_PD) {\n\t\trxe_put(old_pd);\n\t\trxe_get(pd);\n\t\tmr->ibmr.pd = ibpd;\n\t}\n\n\tif (flags & IB_MR_REREG_ACCESS) {\n\t\tif (access & ~RXE_ACCESS_SUPPORTED_MR)\n\t\t\treturn ERR_PTR(-EOPNOTSUPP);\n\t\tmr->access = access;\n\t}\n\nBoth flags pass the entry check because RXE_MR_REREG_SUPPORTED is\nIB_MR_REREG_PD | IB_MR_REREG_ACCESS, so a caller can reach the access\ncheck with mr->ibmr.pd already reassigned.\n\nmr->ibmr.pd is owned by the core, which adjusts pd->usecnt only on the\nsuccess path: ib_uverbs_rereg_mr() jumps to put_new_uobj on a driver error\nwithout undoing the reassignment, so mr->pd == new_pd while the usecnts\nstill charge the MR to orig_pd. ib_dereg_mr_user() then decrements\nnew_pd, whose count can reach zero while a memory window still references\nit; uverbs_free_pd() frees the PD on that count alone and rxe_mw_cleanup()\nwrites to freed memory:\n\n  BUG: KASAN: slab-use-after-free in __rxe_put+0x31/0xa0\n  Write of size 4 at addr ffff8881301dd690 by task rxe_poc/591\n   __rxe_put+0x31/0xa0\n   rxe_mw_cleanup+0x42/0x200\n   __rxe_cleanup+0x115/0x370\n   rxe_dealloc_mw+0x4c/0x80\n  Allocated by task 591:\n   ib_uverbs_alloc_pd+0x258/0x540\n  Freed by task 591:\n   ib_dealloc_pd_user+0x174/0x210\n   uverbs_free_pd+0x8d/0xc0\n   ib_uverbs_dealloc_pd+0x18e/0x1d0\n\nValidate the access flags before mutating any state so the callback either\napplies every requested change or none."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/sw/rxe/rxe_verbs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c","lessThan":"08f12745cb72981aa2cabe214af0c7a42a856f0a","versionType":"git","status":"affected"},{"version":"544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c","lessThan":"7230cc456d4bb2221c20c5f1d22b38b8576aa16f","versionType":"git","status":"affected"},{"version":"544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c","lessThan":"fe602c91a52e161ace4afd5bdb8f33270c554c6f","versionType":"git","status":"affected"},{"version":"544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c","lessThan":"4dd7a53f1c5b44693c26dac4b9b5bd5bb9d604c8","versionType":"git","status":"affected"},{"version":"544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c","lessThan":"ae36a5b609ae79f4de966328b78d2584be9719a4","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/sw/rxe/rxe_verbs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.5","status":"affected"},{"version":"0","lessThan":"6.5","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/08f12745cb72981aa2cabe214af0c7a42a856f0a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4dd7a53f1c5b44693c26dac4b9b5bd5bb9d604c8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7230cc456d4bb2221c20c5f1d22b38b8576aa16f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ae36a5b609ae79f4de966328b78d2584be9719a4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fe602c91a52e161ace4afd5bdb8f33270c554c6f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98367","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:30.970","lastModified":"2026-10-19T10:18:39.687","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept\n\nWe need to clear cep before release state_lock as siw_qp_llp_close and\nsiw_qp_modify->siw_qp_llp_close did.\n\nOtherwise if siw_qp_modify() fails in siw_accept(), the QP's state_lock\nis released before the error path cleanup. A concurrent ibv_modify_qp()\ntransitioning the QP to ERROR can race in this window:\n\n  siw_accept()                       ibv_modify_qp(ERROR)\n  ----------------------             ----------------------\n  siw_qp_modify() fails\n  up_write(&qp->state_lock)\n                                     down_write(&qp->state_lock)\n                                     nextstate_from_idle():\n\t\t\t\t     if (qp->cep)\n                                       siw_cep_put(qp->cep) <- frees cep\n                                       qp->cep = NULL\n  goto error\n    cep->qp = NULL                   <- UAF\n\nClear qp->cep and drop the association reference taken by siw_cep_get(),\nall under the write lock held from the initial down_write(&qp->state_lock).\nThread B therefore sees qp->cep == NULL, skips its own put, and cannot free\nthe cep before siw_accept() is done with it."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/sw/siw/siw_cm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6c52fdc244b5ccc468006fd65a504d4ee33743c7","lessThan":"f11e09fe2fc3a11ccdf8f932b68181b0bb1d2078","versionType":"git","status":"affected"},{"version":"6c52fdc244b5ccc468006fd65a504d4ee33743c7","lessThan":"e3f039082856adab7e195dea1af45d93dd6a3f1c","versionType":"git","status":"affected"},{"version":"6c52fdc244b5ccc468006fd65a504d4ee33743c7","lessThan":"ad50d19f3d1ce052b3a146143581e930a1efb33e","versionType":"git","status":"affected"},{"version":"6c52fdc244b5ccc468006fd65a504d4ee33743c7","lessThan":"030306bbb9273af80f14d7af20129661964cd9a7","versionType":"git","status":"affected"},{"version":"6c52fdc244b5ccc468006fd65a504d4ee33743c7","lessThan":"df2584750314336edcbcc21fb388e04b260f35b7","versionType":"git","status":"affected"},{"version":"6c52fdc244b5ccc468006fd65a504d4ee33743c7","lessThan":"9dcc0f4e488b70cff81e0e5717a498c929cf5de3","versionType":"git","status":"affected"},{"version":"6c52fdc244b5ccc468006fd65a504d4ee33743c7","lessThan":"bfdc744bf20ae4c3ef2e470298de5237c5c9a13c","versionType":"git","status":"affected"},{"version":"6c52fdc244b5ccc468006fd65a504d4ee33743c7","lessThan":"32cd87f54dd1070020e664ccb0312a9f0fea79b4","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/sw/siw/siw_cm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.3","status":"affected"},{"version":"0","lessThan":"5.3","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/030306bbb9273af80f14d7af20129661964cd9a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/32cd87f54dd1070020e664ccb0312a9f0fea79b4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9dcc0f4e488b70cff81e0e5717a498c929cf5de3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ad50d19f3d1ce052b3a146143581e930a1efb33e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bfdc744bf20ae4c3ef2e470298de5237c5c9a13c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/df2584750314336edcbcc21fb388e04b260f35b7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e3f039082856adab7e195dea1af45d93dd6a3f1c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f11e09fe2fc3a11ccdf8f932b68181b0bb1d2078","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98368","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:31.130","lastModified":"2026-10-19T10:18:39.853","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nesp: downgrade zerocopy managed frags before mutating skb frags\n\nOn the out-of-place output path (esp->inplace == false) ESP rewrites the\nskb frag array: esp_output_head() appends a trailer frag and\nesp_output_tail() replaces the frags with a destination page, both\nreferenced with get_page().\n\nWhen the skb carries zerocopy managed frags (SKBFL_MANAGED_FRAG_REFS) the\npayload frags are owned by the ubuf and must not be referenced or\nunreferenced individually, but ESP mutates the frag array without ever\ndowngrading the skb.  This breaks the managed-frag invariant two ways:\n\n  - esp_ssg_unref() walks the source scatterlist and drops a page\n    reference for every frag, including the ubuf-owned payload frags,\n    pushing their refcount below the GUP pin bias while the pages are\n    still pinned, i.e. a use-after-free of the zerocopy pages;\n\n  - esp_output_tail() installs its destination page as frag 0 with\n    get_page() but leaves SKBFL_MANAGED_FRAG_REFS set, so\n    skb_release_data() takes the skip_unref branch and never drops that\n    reference, leaking the x->xfrag page at packet rate.\n\nFix this the way every other frag-mutating site does (__ip_append_data(),\n__ip6_append_data(), tcp_sendmsg_locked()) and call\nskb_zcopy_downgrade_managed() before ESP touches the frag array: it takes\na real reference on each existing frag and clears SKBFL_MANAGED_FRAG_REFS,\nso the per-frag unref in esp_ssg_unref() and the frag release in\nskb_release_data() are both balanced and no mixed-ownership frag array is\nleft behind."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv4/esp4.c","net/ipv6/esp6.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"753f1ca4e1e50248a1b760c9774d6d6b354562cc","lessThan":"2359264f377cdbdef2d95868cc8fb572949e48d3","versionType":"git","status":"affected"},{"version":"753f1ca4e1e50248a1b760c9774d6d6b354562cc","lessThan":"69a768c12398cada8528080332c822623fa7064d","versionType":"git","status":"affected"},{"version":"753f1ca4e1e50248a1b760c9774d6d6b354562cc","lessThan":"6508304ac2c8cdafca2f4ab915df8c707893e134","versionType":"git","status":"affected"},{"version":"753f1ca4e1e50248a1b760c9774d6d6b354562cc","lessThan":"6cab554f2c0f28773f712ed3a5479103f42ce844","versionType":"git","status":"affected"},{"version":"753f1ca4e1e50248a1b760c9774d6d6b354562cc","lessThan":"0d0845ee61c5df47cc68bc446501f48f71e8dcc6","versionType":"git","status":"affected"},{"version":"753f1ca4e1e50248a1b760c9774d6d6b354562cc","lessThan":"f89416eb3db151170a6f3c6dfc5239d26cdce4d2","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv4/esp4.c","net/ipv6/esp6.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.0","status":"affected"},{"version":"0","lessThan":"6.0","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0d0845ee61c5df47cc68bc446501f48f71e8dcc6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2359264f377cdbdef2d95868cc8fb572949e48d3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6508304ac2c8cdafca2f4ab915df8c707893e134","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/69a768c12398cada8528080332c822623fa7064d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6cab554f2c0f28773f712ed3a5479103f42ce844","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f89416eb3db151170a6f3c6dfc5239d26cdce4d2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98369","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:31.280","lastModified":"2026-10-19T10:18:40.010","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()\n\nsyzbot reported a suspicious RCU usage warning in ip6_pkt_drop():\n\n  WARNING: suspicious RCU usage in ip6_pkt_drop\n  include/net/addrconf.h:389 suspicious rcu_dereference_check() usage!\n\n  Call Trace:\n   __in6_dev_get_safely include/net/addrconf.h:389 [inline]\n   ip6_pkt_drop+0x596/0x610 net/ipv6/route.c:4620\n   ip6_pkt_discard+0x1c/0x30 net/ipv6/route.c:4651\n   xfrm_trans_reinject+0x324/0x630 net/xfrm/xfrm_input.c:806\n   process_one_work kernel/workqueue.c:3322 [inline]\n   process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405\n   worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486\n\nWhen commit 4f4920669d21 (\"xfrm: Reinject transport-mode packets through\nworkqueue\") converted xfrm_trans_reinject from a tasklet to a workqueue,\nthe reinjection loop ceased running in softirq context. Workqueue workers\nrun in process context where local_bh_disable() does not enter an RCU\nread-side critical section under CONFIG_PREEMPT_RCU.\n\nBecause finish callbacks (such as ip6_rcv_finish) expect to run under an\nRCU read lock (performing route lookups, l3mdev lookups, and accessing\nRCU-protected data structures), invoking them in workqueue context without\nrcu_read_lock() triggers RCU lockdep warnings.\n\nFurthermore, packets queued to the workqueue via xfrm_trans_queue_net()\nmay carry non-refcounted (noref) dst entries (e.g. from ip_route_input_noref).\nAdditionally, on netdevice unregistration, dst_dev_put() replaces dst->dev\nwith blackhole_netdev, so dst entries do not keep skb->dev alive while\nqueued in the workqueue.\n\nFix these issues by:\n1. Calling skb_dst_force(skb) in xfrm_trans_queue_net() while still in the\n   caller's RCU section to ensure dst is reference-counted before queuing.\n2. Holding a reference on skb->dev via dev_hold()/dev_put() across workqueue\n   deferral so skb->dev remains valid during finish() callback processing.\n3. Acquiring rcu_read_lock() around the finish callback invocation loop in\n   xfrm_trans_reinject()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/xfrm/xfrm_input.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7d98b26684cb2390729525b341ea099f0badbe18","lessThan":"41e47f1664be86c91326f0afe0504a1162d00907","versionType":"git","status":"affected"},{"version":"4f4920669d21e1060b7243e5118dc3b71ced1276","lessThan":"6601d91a85761f33351c71e04ec0bbd294ca07ce","versionType":"git","status":"affected"},{"version":"4f4920669d21e1060b7243e5118dc3b71ced1276","lessThan":"0cda8273265d30cac6423834fd7d4acb75f04fdb","versionType":"git","status":"affected"},{"version":"4f4920669d21e1060b7243e5118dc3b71ced1276","lessThan":"68a317b4aec8ca1868a39d69e40f9e29baa4f40a","versionType":"git","status":"affected"},{"version":"4f4920669d21e1060b7243e5118dc3b71ced1276","lessThan":"6eb3b071be8e260543c604550c54dac66e6b174b","versionType":"git","status":"affected"},{"version":"4f4920669d21e1060b7243e5118dc3b71ced1276","lessThan":"664fc0941df7c1918b2cd4de6ee00469ba77d8e4","versionType":"git","status":"affected"},{"version":"4f4920669d21e1060b7243e5118dc3b71ced1276","lessThan":"d2f5082f9e84653fa1a9e8aebaaff23e688f5e19","versionType":"git","status":"affected"},{"version":"f520075da484306bbb8425afd2c42404ba74816f","versionType":"git","status":"affected"},{"version":"130d9e5017ade1b81d16783563edb38c12a2eab7","versionType":"git","status":"affected"},{"version":"5.15.75","lessThan":"5.15.222","versionType":"semver","status":"affected"},{"version":"5.19.17","lessThan":"5.20","versionType":"semver","status":"affected"},{"version":"6.0.3","lessThan":"6.1","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/xfrm/xfrm_input.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.1","status":"affected"},{"version":"0","lessThan":"6.1","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0cda8273265d30cac6423834fd7d4acb75f04fdb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/41e47f1664be86c91326f0afe0504a1162d00907","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6601d91a85761f33351c71e04ec0bbd294ca07ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/664fc0941df7c1918b2cd4de6ee00469ba77d8e4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/68a317b4aec8ca1868a39d69e40f9e29baa4f40a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6eb3b071be8e260543c604550c54dac66e6b174b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d2f5082f9e84653fa1a9e8aebaaff23e688f5e19","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98370","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:31.450","lastModified":"2026-10-19T10:18:40.183","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: fix compat ALLOCSPI request use-after-free\n\nxfrm_state_netlink() builds the ALLOCSPI response with\ndump_one_state(), which already calls alloc_compat() with the response\nskb and header.\n\nxfrm_alloc_userspi() then calls alloc_compat() again, but passes the\noriginal request skb and its header. For a compat request, the\ntranslator therefore interprets the 228-byte compat xfrm_userspi_info\nas the 232-byte native layout and reads four bytes past the declared\npayload. It also publishes the translated child through the request's\nfrag_list.\n\nA multicast clone of the request shares skb_shared_info and can observe\nthat child. xfrm_user_rcv_msg() frees it after the request handler\nreturns, racing a compat receiver which may still be copying from it and\nresulting in a use-after-free.\n\nRemove the redundant conversion. The response keeps its correct compat\ntranslation from dump_one_state(), and no child is attached to the\ninbound request."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/xfrm/xfrm_user.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3","lessThan":"494f2bee9d8d0ebcfa249ac41bed7fed26d119b4","versionType":"git","status":"affected"},{"version":"5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3","lessThan":"17893987e52918c23945c42e47e894a936305a25","versionType":"git","status":"affected"},{"version":"5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3","lessThan":"42971ea17c7a8afc0bdd5ca40648bf4e5bb7b810","versionType":"git","status":"affected"},{"version":"5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3","lessThan":"2b63341e2ebc9b6f73cbd9214dbe7d46dd98c718","versionType":"git","status":"affected"},{"version":"5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3","lessThan":"bb63ab52a18273ec68340ac49aebbaa7b514ccd5","versionType":"git","status":"affected"},{"version":"5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3","lessThan":"248433942155b42a0ef04a5806c8aca024ea7c33","versionType":"git","status":"affected"},{"version":"5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3","lessThan":"e70f639aee2ff0def155c256cace9e0f81d998e2","versionType":"git","status":"affected"},{"version":"5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3","lessThan":"d1ebd9081879fd9ae9c8fb7e8928f19cc88ae320","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/xfrm/xfrm_user.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.10","status":"affected"},{"version":"0","lessThan":"5.10","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/17893987e52918c23945c42e47e894a936305a25","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/248433942155b42a0ef04a5806c8aca024ea7c33","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2b63341e2ebc9b6f73cbd9214dbe7d46dd98c718","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/42971ea17c7a8afc0bdd5ca40648bf4e5bb7b810","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/494f2bee9d8d0ebcfa249ac41bed7fed26d119b4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bb63ab52a18273ec68340ac49aebbaa7b514ccd5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d1ebd9081879fd9ae9c8fb7e8928f19cc88ae320","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e70f639aee2ff0def155c256cace9e0f81d998e2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98371","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:31.613","lastModified":"2026-10-19T10:18:40.323","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: iptfs: fix runt reassembly panic from short inner tot_len\n\nWhen the start of an inner packet is split across two outer packets\nsuch that fewer than 4 bytes land at the end of the first one,\n__input_process_payload() saves those bytes as a runt and skips the\niplen/iphlen validation performed for in-place packets. When the\ncontinuation packet arrives, iptfs_reassem_cont() only requires the\ndeclared inner length to be >= sizeof(ra_runt) (6) before allocating\nthe reassembly skb with that attacker-controlled length.\n\nHowever, __iptfs_iphlen() always returns the fixed minimum IP header\nsize (20 for IPv4, 40 for IPv6), so for an inner IPv4 tot_len in\n[6, 19] the header-completion copy writes past the declared packet\nlength, and the subsequent \"ipremain -= copylen\" underflows to ~4GB,\nleaving the payload copy length bounded only by blkoff (up to 64KB).\nAt runtime the skb_put() tailroom check turns this into\nskb_over_panic(), i.e. an unprivileged kernel panic (DoS), reachable\nlocally via userns+netns IPTFS SAs and remotely against IPTFS VPN\ngateways when the decrypted outer skb is linear (e.g. AF_PACKET taps,\ntun/tap delivery).\n\nAlign the runt path with the normal path by requiring the declared\ninner length to cover at least the IP header size. This also subsumes\nthe previous >= sizeof(ra_runt) check, since the minimum IP header\nis always larger than the runt buffer.\n\nThis issue was found by the autokbug dynamic kernel fuzzer at\nTencent Yunding Lab."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/xfrm/xfrm_iptfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"07569476544681816335099929ff3494dfbf6b05","lessThan":"a7018ee0ea8622ed59edc064be4e0f2c26464f53","versionType":"git","status":"affected"},{"version":"07569476544681816335099929ff3494dfbf6b05","lessThan":"5b8afb56ccb7c014b0f1ac40341708b200443c2d","versionType":"git","status":"affected"},{"version":"07569476544681816335099929ff3494dfbf6b05","lessThan":"dc33262be1fe43d0eb0b84fb58c6ed42e2f64a8c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/xfrm/xfrm_iptfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.14","status":"affected"},{"version":"0","lessThan":"6.14","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5b8afb56ccb7c014b0f1ac40341708b200443c2d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a7018ee0ea8622ed59edc064be4e0f2c26464f53","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dc33262be1fe43d0eb0b84fb58c6ed42e2f64a8c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-98372","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-10-06T09:18:31.743","lastModified":"2026-10-19T10:18:40.427","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()\n\niptfs_skb_reset_frag_walk() advances to the fragment containing @offset\nwith an unbounded loop:\n\n\twhile (offset >= walk->past + walk->frags[walk->fragi].len)\n\t\twalk->past += walk->frags[walk->fragi++].len;\n\nwalk->fragi is advanced and walk->frags[walk->fragi] is dereferenced\nwithout ever checking fragi against walk->nr_frags. When the requested\noffset is at or beyond the total length spanned by the walk's fragments,\nfragi runs past nr_frags and off the end of the fixed-size on-stack\nfrags[MAX_SKB_FRAGS + 1] array, reading out-of-bounds stack memory.\n\nThe two callers behave differently: iptfs_skb_add_frags() already guards\nagainst this with\n\n\tif (!walk->nr_frags ||\n\t    offset >= walk->total + walk->initial_offset)\n\t\treturn len;\n\nbut iptfs_skb_can_add_frags() has no such guard and calls\niptfs_skb_reset_frag_walk() unconditionally, so it performs the\nout-of-range walk. Its own \"fragi < walk->nr_frags\" bound check runs only\nafterwards, too late to prevent the read.\n\nThis is reachable from the receive path: a crafted IP-TFS (AGGFRAG)\npayload delivered to an IPTFS SA drives iptfs_reassem_cont() ->\niptfs_skb_can_add_frags() with an offset past the fragment total, e.g.:\n\n  BUG: KASAN: stack-out-of-bounds in iptfs_skb_reset_frag_walk+0x235/0x250\n  Read of size 4 at addr ffff888008ad7210 by task repro/345\n   iptfs_skb_reset_frag_walk+0x235/0x250 net/xfrm/xfrm_iptfs.c:392\n   iptfs_skb_can_add_frags+0x155/0x310  net/xfrm/xfrm_iptfs.c:420\n   iptfs_reassem_cont+0xcf8/0x1140      net/xfrm/xfrm_iptfs.c:902\n   iptfs_input_ordered+0x552/0x670      net/xfrm/xfrm_iptfs.c:1280\n   iptfs_input+0x3d6/0xde0              net/xfrm/xfrm_iptfs.c:1741\n   xfrm_input+0x282f/0x6140             net/xfrm/xfrm_input.c:700\n   xfrm4_esp_rcv+0x93/0x120             net/ipv4/xfrm4_protocol.c:104\n   ip_rcv+0x278/0x2d0                   net/ipv4/ip_input.c:612\n\nGive iptfs_skb_can_add_frags() the same up-front guard that\niptfs_skb_add_frags() already has, so the walk is never entered with an\nout-of-range offset. When it triggers, the caller falls back to the\nexisting linearize-and-copy path, which is safe."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/xfrm/xfrm_iptfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7","lessThan":"7e1c6884a0b494b7e3f204877f94c1e07a117bf7","versionType":"git","status":"affected"},{"version":"5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7","lessThan":"da56d0ee93d1bad779b0486f2fab92d1bc1f0cf3","versionType":"git","status":"affected"},{"version":"5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7","lessThan":"d042487dc118e494db2e2c1382310255c90ff544","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/xfrm/xfrm_iptfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.14","status":"affected"},{"version":"0","lessThan":"6.14","versionType":"semver","status":"unaffected"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/7e1c6884a0b494b7e3f204877f94c1e07a117bf7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d042487dc118e494db2e2c1382310255c90ff544","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/da56d0ee93d1bad779b0486f2fab92d1bc1f0cf3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-80327","sourceIdentifier":"responsible-disclosure@pingidentity.com","published":"2026-10-06T10:16:52.117","lastModified":"2026-10-06T16:00:36.547","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An open redirect vulnerability exists in the PingGateway Fragment Filter feature. This issue affects PingGateway versions 7.1.0 and later, 2023.2.0 through 2024.11.1, and 2025.3.0 through 2025.11.1. It is fixed in versions 2024.11.2, 2025.11.2, and 2026.3.0 (and later)."}],"affected":[{"source":"responsible-disclosure@pingidentity.com","affectedData":[{"vendor":"Ping Identity","product":"PingGateway","defaultStatus":"unaffected","versions":[{"version":"7.1.0","lessThanOrEqual":"7.2.0","versionType":"semver","status":"affected"},{"version":"2023.2.0","lessThanOrEqual":"2024.11.1","versionType":"date","status":"affected"},{"version":"2025.3.0","lessThanOrEqual":"2025.11.1","versionType":"date","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"responsible-disclosure@pingidentity.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:U/V:X/RE:M/U:Amber","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"PRESENT","Automatable":"NO","Recovery":"USER","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"AMBER"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T11:29:26.726005Z","id":"CVE-2026-80327","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"responsible-disclosure@pingidentity.com","type":"Secondary","description":[{"lang":"en","value":"CWE-601"}]}],"references":[{"url":"https://docs.pingidentity.com/pinggateway/release-notes/preface.html","source":"responsible-disclosure@pingidentity.com"},{"url":"https://product-downloads.pingidentity.com/browse/ig/featured","source":"responsible-disclosure@pingidentity.com"},{"url":"https://support.pingidentity.com/s/article/SECADV202602-Open-Redirect-in-PingGateway-Fragment-Filter","source":"responsible-disclosure@pingidentity.com"}]}},{"cve":{"id":"CVE-2026-84854","sourceIdentifier":"2fc02b1f-71e7-4514-a878-169626f68903","published":"2026-10-06T10:16:54.230","lastModified":"2026-10-15T02:20:16.870","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"In the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of a kernel buffer could cause small amounts of data to be written outside the intended kernel buffer. This can lead to a system crash. Under unfavorable circumstances, adjacent kernel memory may be modified."}],"affected":[{"source":"2fc02b1f-71e7-4514-a878-169626f68903","affectedData":[{"vendor":"wibu-systems-ag","product":"wibukey","defaultStatus":"unaffected","collectionURL":"https://www.wibu.com/products/wibukey.html","versions":[{"version":"0","lessThan":"6.72","versionType":"custom","status":"affected"}]}]},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","affectedData":[{"vendor":"Siemens","product":"PSS(R)SINCAL V21.5","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"*","versionType":"custom","status":"affected"}]},{"vendor":"Siemens","product":"PSS(R)SINCAL V22.0","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"*","versionType":"custom","status":"affected"}]},{"vendor":"Siemens","product":"PSS(R)SINCAL V22.5","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"V22.5 Update 5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"2fc02b1f-71e7-4514-a878-169626f68903","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-84854","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"2fc02b1f-71e7-4514-a878-169626f68903","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-100065.pdf","source":"2fc02b1f-71e7-4514-a878-169626f68903"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-148322.html","source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}]}},{"cve":{"id":"CVE-2026-103831","sourceIdentifier":"cve-coordination@incibe.es","published":"2026-10-06T11:17:13.783","lastModified":"2026-10-06T15:18:12.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize() function without restrictions on the classes allowed when retrieving data stored in the cache. An attacker who already has the ability to write manipulated data to the cache backend used by Magento—such as Redis or Memcached—could inject specially crafted PHP objects and trigger their deserialization, potentially leading to arbitrary code execution via gadget strings available in the application environment. Exploitation therefore requires a prerequisite condition that allows writing to the cache infrastructure, either through access to the local file system or to a cache infrastructure accessible from the Magento environment."}],"affected":[{"source":"cve-coordination@incibe.es","affectedData":[{"vendor":"TrueLayer","product":"TrueLayer Magento 2 Plugin","defaultStatus":"unaffected","versions":[{"version":"versions 2.4.0 through 2.4.2.","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@incibe.es","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:48:14.713541Z","id":"CVE-2026-103831","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve-coordination@incibe.es","type":"Primary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-deserialization-truelayer-magento-2-plugin","source":"cve-coordination@incibe.es"}]}},{"cve":{"id":"CVE-2026-105985","sourceIdentifier":"7004884b-51e2-48e8-b4a2-5ca29e80453e","published":"2026-10-06T11:17:16.857","lastModified":"2026-10-07T04:17:46.197","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components.\n\n\n\nAny authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding an EntryType object’s uiLabelFormat and then rendering an Entry that resolves the same request-cached entry type, an attacker can cause arbitrary Twig supplied in the request to be evaluated by renderObjectTemplate().\n\n\n\nThis render path is not sandboxed. A Twig string callable can therefore reach PHP functions such as system(), resulting in operating-system command execution with the privileges of the PHP/web-server process.\n\n\n\nThe issue was reproduced with an active non-admin Craft Team user with no optional permissions enabled. No access to entry-editing, Settings, utility, user-management, project-config, filesystem, Kubernetes, or environment variables was required."}],"affected":[{"source":"7004884b-51e2-48e8-b4a2-5ca29e80453e","affectedData":[{"vendor":"craftcms","product":"cms","defaultStatus":"unaffected","collectionURL":"https://packagist.org","packageName":"craftcms/cms","versions":[{"version":"5.0.0","lessThan":"5.11.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"7004884b-51e2-48e8-b4a2-5ca29e80453e","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"7004884b-51e2-48e8-b4a2-5ca29e80453e","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-105985","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"7004884b-51e2-48e8-b4a2-5ca29e80453e","type":"Secondary","description":[{"lang":"en","value":"CWE-1336"}]}],"references":[{"url":"https://github.com/craftcms/cms","source":"7004884b-51e2-48e8-b4a2-5ca29e80453e"},{"url":"https://github.com/craftcms/cms/releases/tag/5.11.0","source":"7004884b-51e2-48e8-b4a2-5ca29e80453e"},{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-g48f-wc2q-4rrv","source":"7004884b-51e2-48e8-b4a2-5ca29e80453e"},{"url":"https://www.hckrt.com/hacktivity/HCKRT-PVWH7W","source":"7004884b-51e2-48e8-b4a2-5ca29e80453e"}]}},{"cve":{"id":"CVE-2026-75818","sourceIdentifier":"cvd@cert.pl","published":"2026-10-06T11:17:29.730","lastModified":"2026-10-06T15:03:59.427","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on the heap. An attacker who convinces a user to process a malicious compressed file with prezip-bin can trigger memory corruption, leading to a processs crash.\n\n\n\nThis issue was fixed in commit 15b188437f9e0192d4ac4472ad66a4e2f62a782f which will be released in version 0.60.8.3."}],"affected":[{"source":"cvd@cert.pl","affectedData":[{"vendor":"GNU","product":"Aspell","defaultStatus":"unknown","modules":["prezip"],"programFiles":["prog/prezip.c"],"repo":"https://github.com/GNUAspell/aspell","versions":[{"version":"0","lessThan":"0.60.8.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cvd@cert.pl","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":1.8,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T12:50:34.738213Z","id":"CVE-2026-75818","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cvd@cert.pl","type":"Secondary","description":[{"lang":"en","value":"CWE-122"}]}],"references":[{"url":"http://aspell.net/","source":"cvd@cert.pl"},{"url":"https://cert.pl/en/posts/2026/10/CVE-2026-75818","source":"cvd@cert.pl"}]}},{"cve":{"id":"CVE-2026-75819","sourceIdentifier":"cvd@cert.pl","published":"2026-10-06T11:17:29.883","lastModified":"2026-10-06T15:03:59.427","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a heap buffer without validating their bounds. An attacker can trigger this by convincing a user to run aspell with a crafted dictionary file supplied through --master, --dict-dir, or configuration options, leading to heap memory disclosure or a denial of service via application crash.\n\n\n\nThis issue was fixed in commit 941953b25031bc9104e83f58e138a664b8dedc3f which will be released in version 0.60.8.3."}],"affected":[{"source":"cvd@cert.pl","affectedData":[{"vendor":"GNU","product":"Aspell","defaultStatus":"unknown","modules":["ReadOnlyDict::load()"],"programFiles":["readonly_ws.cpp"],"repo":"https://github.com/GNUAspell/aspell","versions":[{"version":"0","lessThan":"0.60.8.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cvd@cert.pl","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":1.8,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T12:50:01.124083Z","id":"CVE-2026-75819","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cvd@cert.pl","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"http://aspell.net/","source":"cvd@cert.pl"},{"url":"https://cert.pl/en/posts/2026/10/CVE-2026-75818","source":"cvd@cert.pl"}]}},{"cve":{"id":"CVE-2026-75820","sourceIdentifier":"cvd@cert.pl","published":"2026-10-06T11:17:30.020","lastModified":"2026-10-06T15:03:59.427","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a personal wordlist, the word length is stored as a single byte, causing truncation for words whose length is a multiple of 256. This leads to heap corruption. An attacker can exploit this by convincing a user to run aspell with a crafted personal wordlist containing such a word, resulting in denial of service.\n\n\n\nThis issue was fixed in commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d which will be released in version 0.60.8.3."}],"affected":[{"source":"cvd@cert.pl","affectedData":[{"vendor":"GNU","product":"Aspell","defaultStatus":"unknown","modules":["WritableDict::add()"],"programFiles":["modules/speller/default/writable.cpp"],"repo":"https://github.com/GNUAspell/aspell","versions":[{"version":"0","lessThan":"0.60.8.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cvd@cert.pl","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":1.8,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T12:49:13.392681Z","id":"CVE-2026-75820","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cvd@cert.pl","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"references":[{"url":"http://aspell.net/","source":"cvd@cert.pl"},{"url":"https://cert.pl/en/posts/2026/10/CVE-2026-75818","source":"cvd@cert.pl"}]}},{"cve":{"id":"CVE-2026-105918","sourceIdentifier":"cna@vuldb.com","published":"2026-10-06T12:16:47.287","lastModified":"2026-10-06T18:16:50.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the function mysql_error of the file login.php of the component Login Endpoint. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Kusalkasilva","product":"Learning-Management-System","cpes":["cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:*"],"modules":["Login Endpoint"],"versions":[{"version":"ffeb873f8803f1e9664384ff75000c7da45466d2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:06:36.935710Z","id":"CVE-2026-105918","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/KusalkaSilva/Learning-Management-System/","source":"cna@vuldb.com"},{"url":"https://github.com/KusalkaSilva/Learning-Management-System/issues/1","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105918","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/992654","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413892","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413892/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-56596","sourceIdentifier":"psirt@hcl.com","published":"2026-10-06T12:16:49.327","lastModified":"2026-10-06T16:00:36.547","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or malformed data, enabling processing errors, business logic bypasses, and unintended application behavior."}],"affected":[{"source":"psirt@hcl.com","affectedData":[{"vendor":"HCL Software","product":"HCL BigFix Service Management","defaultStatus":"unaffected","versions":[{"version":"Version 27","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@hcl.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T12:47:29.783249Z","id":"CVE-2026-56596","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@hcl.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134015","source":"psirt@hcl.com"}]}},{"cve":{"id":"CVE-2026-105834","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-06T13:16:46.597","lastModified":"2026-10-06T17:17:19.303","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files by setting resources.source.N.config.file to any absolute path. Attackers can retrieve file contents through editProjectNodeSourceFile or the apiSourceGetContent endpoint to obtain database passwords, LDAP bind credentials, and other projects' data."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"rundeck","product":"rundeck","defaultStatus":"unaffected","repo":"https://github.com/rundeck/rundeck","versions":[{"version":"0","lessThan":"6.2.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T16:13:30.400585Z","id":"CVE-2026-105834","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/rundeck/rundeck","source":"disclosure@vulncheck.com"},{"url":"https://github.com/rundeck/rundeck/blob/v6.1.0/core/src/main/java/com/dtolabs/rundeck/core/resources/FileResourceModelSource.java","source":"disclosure@vulncheck.com"},{"url":"https://github.com/rundeck/rundeck/commit/5ec3d0ad2ef19c2bf8f206f27d693ba8bf3337a4","source":"disclosure@vulncheck.com"},{"url":"https://github.com/rundeck/rundeck/commit/a462982aa22bf350c9e121d213283ffaa7994b4e","source":"disclosure@vulncheck.com"},{"url":"https://github.com/rundeck/rundeck/pull/10437","source":"disclosure@vulncheck.com"},{"url":"https://github.com/rundeck/rundeck/releases/tag/v6.2.0","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/rundeck-before-6.2.0-arbitrary-file-read-via-file-resource-model-source","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-105835","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-06T13:16:46.760","lastModified":"2026-10-09T02:16:55.380","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token to guess six-digit codes until one succeeds, obtaining a full access token."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"planka","product":"planka","defaultStatus":"unaffected","repo":"https://github.com/plankanban/planka","packageURL":"pkg:github/plankanban/planka","versions":[{"version":"2.2.0","lessThanOrEqual":"2.2.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T00:58:14.866351Z","id":"CVE-2026-105835","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-307"}]}],"references":[{"url":"https://github.com/plankanban/planka","source":"disclosure@vulncheck.com"},{"url":"https://github.com/plankanban/planka/blob/v2.2.1/server/api/controllers/access-tokens/verify-totp.js","source":"disclosure@vulncheck.com"},{"url":"https://github.com/plankanban/planka/commit/de4d7688317829e2a0b665fe9dbf39eaf127b6f9","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/planka-2.2.0-through-2.2.1-totp-brute-force-via-verify-totp-endpoint","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-105836","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-06T13:16:46.913","lastModified":"2026-10-16T19:17:02.007","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign room IDs in the id_rooms parameter to change status, floor, comments, or inactive dates, disrupting availability and bookings."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Webkul","product":"QloApps","defaultStatus":"unaffected","programFiles":["controllers/admin/AdminProductsController.php"],"repo":"https://github.com/Qloapps/QloApps","packageURL":"pkg:github/Qloapps/QloApps","versions":[{"version":"0","lessThanOrEqual":"1.7.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:26:18.829392Z","id":"CVE-2026-105836","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/Qloapps/QloApps","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Qloapps/QloApps/blob/v1.7.0/controllers/admin/AdminProductsController.php#L5344","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Qloapps/QloApps/pull/1892","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@leediay/H189W20qfg","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/qloapps-through-1.7.0-authorization-bypass-via-ajaxprocessbulkupdaterooms","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@leediay/H189W20qfg","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105919","sourceIdentifier":"cna@vuldb.com","published":"2026-10-06T13:16:47.120","lastModified":"2026-10-06T18:16:50.443","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql_query of the file admin/login.php of the component Administrator Login Endpoint. The manipulation of the argument username/password results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Kusalkasilva","product":"Learning-Management-System","cpes":["cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:*"],"modules":["Administrator Login Endpoint"],"versions":[{"version":"ffeb873f8803f1e9664384ff75000c7da45466d2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:11:57.108209Z","id":"CVE-2026-105919","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/KusalkaSilva/Learning-Management-System/","source":"cna@vuldb.com"},{"url":"https://github.com/KusalkaSilva/Learning-Management-System/issues/2","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105919","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/992655","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413893","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413893/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-106016","sourceIdentifier":"security@mozilla.org","published":"2026-10-06T13:16:47.290","lastModified":"2026-10-13T19:18:01.600","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1 and Thunderbird 158."}],"affected":[{"source":"security@mozilla.org","affectedData":[{"vendor":"Mozilla","product":"Firefox","versions":[{"version":"157.0.1","lessThanOrEqual":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Mozilla","product":"Thunderbird","versions":[{"version":"158","lessThanOrEqual":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T21:00:58.433280Z","id":"CVE-2026-106016","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-693"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*","versionEndExcluding":"157.0.1","matchCriteriaId":"F3185F2D-2C7E-4ECE-8AC7-6EA3BE8D2254"}]}]}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2067465","source":"security@mozilla.org","tags":["Permissions Required"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-104/","source":"security@mozilla.org","tags":["Vendor Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-109/","source":"security@mozilla.org"}]}},{"cve":{"id":"CVE-2026-82531","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-06T13:16:50.180","lastModified":"2026-10-06T16:00:36.547","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied verbatim into the regenerated PHP cache file, executing arbitrary PHP on include for remote code execution."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"smarty-php","product":"smarty","defaultStatus":"unaffected","repo":"https://github.com/smarty-php/smarty","packageURL":"pkg:composer/smarty/smarty","versions":[{"version":"0","lessThan":"4.5.8","versionType":"semver","status":"affected"},{"version":"5.0.0","lessThan":"5.8.5","versionType":"semver","status":"affected"},{"version":"4.5.8","versionType":"semver","status":"unaffected"},{"version":"5.8.5","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T12:44:36.819504Z","id":"CVE-2026-82531","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/smarty-php/smarty/commit/1cba51cb813563eb61d963c83d28cd59f26b858d","source":"disclosure@vulncheck.com"},{"url":"https://github.com/smarty-php/smarty/commit/c0fdd4824aca4f67e814b50703cfee1dfde41414","source":"disclosure@vulncheck.com"},{"url":"https://github.com/smarty-php/smarty/releases/tag/v4.5.8","source":"disclosure@vulncheck.com"},{"url":"https://github.com/smarty-php/smarty/releases/tag/v5.8.5","source":"disclosure@vulncheck.com"},{"url":"https://github.com/smarty-php/smarty/security/advisories/GHSA-3w63-v7pm-cq9x","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/smarty-before-4.5.8-and-5-x-before-5.8.5-php-code-injection-via-extends-inheritance-cache","source":"disclosure@vulncheck.com"},{"url":"https://github.com/smarty-php/smarty/security/advisories/GHSA-3w63-v7pm-cq9x","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2025-15591","sourceIdentifier":"security@opentext.com","published":"2026-10-06T14:17:34.087","lastModified":"2026-10-14T13:10:00.187","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Cross-site Scripting (XSS) in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious code into a Forums web page."},{"lang":"es","value":"Cross-site Scripting (XSS) en la característica de Foros del servidor de Content Management de OpenText Content Server podría permitir a un actor malintencionado inyectar código malicioso en una página web de Foros."}],"affected":[{"source":"security@opentext.com","affectedData":[{"vendor":"OpenText","product":"Content Management","defaultStatus":"unaffected","modules":["Forums"],"platforms":["Windows","Linux"],"versions":[{"version":"20.3","lessThanOrEqual":"25.2","versionType":"custom","status":"affected","changes":[{"at":"25.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@opentext.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:58:25.634585Z","id":"CVE-2025-15591","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@opentext.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0874468","source":"security@opentext.com"}]}},{"cve":{"id":"CVE-2026-105788","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T14:17:40.077","lastModified":"2026-10-06T16:17:05.597","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the type_text and launch_app tools in ufo/client/mcp/http_servers/mobile_mcp_server.py pass the authenticated caller-controlled text and package_name parameters into adb shell command argument positions without comprehensive validation. The adb client joins those arguments into a remote command string that the Android shell reparses, allowing shell metacharacters to execute additional commands on an authorized connected device as the Android shell user. Exploitation requires a valid Mobile MCP API key and a reachable device authorized for ADB, and it does not establish host operating-system execution, Android root execution, or access beyond the Android shell-user privileges. This issue is fixed in version 3.0.10."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"microsoft","product":"UFO","versions":[{"version":"< 3.0.10","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T15:05:06.562657Z","id":"CVE-2026-105788","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-88"}]}],"references":[{"url":"https://github.com/microsoft/UFO/commit/214443218bf4a3b8de798fd44e7fd770afefee83","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/UFO/commit/a538791043327a0c33731d5be428867a5fd71794","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/UFO/releases/tag/v3.0.10","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/UFO/security/advisories/GHSA-6ppj-5886-4f26","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/UFO/security/advisories/GHSA-6ppj-5886-4f26","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105789","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T14:17:40.270","lastModified":"2026-10-06T15:18:12.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the execute_command tool in ufo/client/mcp/http_servers/linux_mcp_server.py treats sort and uniq as read-only commands while the free-form command parameter can select their file-output forms. An authenticated caller can use sort -o or the optional second uniq operand to create or overwrite files writable by the UFO server process without shell metacharacters, because the allowed binary opens the destination itself and the argument policy does not reject the operation. This can corrupt configuration or other writable data and disrupt the service, but the demonstrated primitive does not directly disclose files or establish arbitrary code execution. This issue is fixed in version 3.0.9."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"microsoft","product":"UFO","versions":[{"version":"< 3.0.9","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:34:10.551669Z","id":"CVE-2026-105789","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-88"},{"lang":"en","value":"CWE-184"}]}],"references":[{"url":"https://github.com/microsoft/UFO/commit/4f793622794f5d47810d54bed431c61f6a781dd6","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/UFO/pull/349","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/UFO/releases/tag/v3.0.9","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/UFO/security/advisories/GHSA-85w2-wggf-rw49","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105790","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T14:17:40.490","lastModified":"2026-10-06T18:16:46.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, authenticated device registration through /api/devices can supply a permitted attacker-controlled WebSocket endpoint while aip/transport/websocket.py applies pinned_addresses only to the initial destination. The pinned websockets.connect() client follows cross-origin redirects and opens a new TCP connection before Galaxy performs its post-handshake peer-IP validation, allowing WebSocket upgrade requests to internal hosts reachable from the server. The confirmed impact is the internal connection and handshake request, and does not establish arbitrary HTTP methods, response-body disclosure, a completed AIP session, or cloud metadata access. This issue is fixed in version 3.0.9."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"microsoft","product":"UFO","versions":[{"version":"< 3.0.9","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:16:48.217970Z","id":"CVE-2026-105790","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/microsoft/UFO/commit/f31fb5ef7d07b7825a03fe34b88f1f21cb5cfd35","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/UFO/releases/tag/v3.0.9","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/UFO/security/advisories/GHSA-3pgm-xw75-hq27","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/UFO/security/advisories/GHSA-3pgm-xw75-hq27","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/UFO/security/advisories/GHSA-3pgm-xw75-hq27","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/UFO/security/advisories/GHSA-3pgm-xw75-hq27","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/UFO/security/advisories/GHSA-3pgm-xw75-hq27","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105837","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-06T14:17:40.763","lastModified":"2026-10-06T20:17:16.590","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"libmikmod before 3.3.14 contains an integer overflow vulnerability in DSM_Load() in load_dsm.c that allows attackers to trigger heap buffer overflow via crafted track counts. Attackers can supply a DSM module whose numchn and numpat product wraps a 16-bit value, overwriting heap memory to cause crashes or potential code execution."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"sezero","product":"libmikmod","defaultStatus":"unaffected","repo":"https://github.com/sezero/mikmod","packageURL":"pkg:github/sezero/mikmod","versions":[{"version":"0","lessThan":"3.3.14","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:26:57.389656Z","id":"CVE-2026-105837","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"references":[{"url":"https://github.com/sezero/mikmod","source":"disclosure@vulncheck.com"},{"url":"https://github.com/sezero/mikmod/blob/libmikmod-3.3.13/libmikmod/loaders/load_dsm.c#L273","source":"disclosure@vulncheck.com"},{"url":"https://github.com/sezero/mikmod/blob/libmikmod-3.3.14/libmikmod/NEWS","source":"disclosure@vulncheck.com"},{"url":"https://github.com/sezero/mikmod/commit/a125eabbd086f311496ae46d08aaebcad0a1c426","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/libmikmod-before-3.3.14-heap-buffer-overflow-via-dsm-loader-integer-overflow","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-105838","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-06T14:17:40.953","lastModified":"2026-10-06T18:16:47.897","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"libmikmod before 3.3.14 contains a heap out-of-bounds read vulnerability in the Impulse Tracker loader load_it.c that allows attackers to read adjacent heap memory via oversized patterns. Attackers can supply a crafted IT module with more than 200 pattern rows, causing IT_ConvertTrack() to read past the itpat buffer and crash applications."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"sezero","product":"libmikmod","defaultStatus":"unaffected","repo":"https://github.com/sezero/mikmod","packageURL":"pkg:github/sezero/mikmod","versions":[{"version":"0","lessThan":"3.3.14","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:14:00.480152Z","id":"CVE-2026-105838","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/sezero/mikmod","source":"disclosure@vulncheck.com"},{"url":"https://github.com/sezero/mikmod/blob/libmikmod-3.3.13/libmikmod/loaders/load_it.c#L198","source":"disclosure@vulncheck.com"},{"url":"https://github.com/sezero/mikmod/blob/libmikmod-3.3.14/libmikmod/NEWS","source":"disclosure@vulncheck.com"},{"url":"https://github.com/sezero/mikmod/commit/e7c6c9e88fbe3e8af4668a2e116bb8de341383f8","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/libmikmod-before-3.3.14-heap-out-of-bounds-read-via-it-module-loader","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-105839","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-06T14:17:41.133","lastModified":"2026-10-06T17:17:19.783","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"libmikmod before 3.3.14 contains an integer overflow in the Oktalyzer loader OKT_doPBOD() that allows attackers to cause heap buffer overflow via crafted track counts. Attackers can supply an OKT module whose SLEN chunk wraps the 16-bit numtrk value, causing PBOD writes past allocated track pointers for crashes or code execution."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"sezero","product":"libmikmod","defaultStatus":"unaffected","repo":"https://github.com/sezero/mikmod","packageURL":"pkg:github/sezero/mikmod","versions":[{"version":"0","lessThan":"3.3.14","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T16:11:52.474424Z","id":"CVE-2026-105839","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"references":[{"url":"https://github.com/sezero/mikmod","source":"disclosure@vulncheck.com"},{"url":"https://github.com/sezero/mikmod/blob/libmikmod-3.3.13/libmikmod/loaders/load_okt.c#L286","source":"disclosure@vulncheck.com"},{"url":"https://github.com/sezero/mikmod/blob/libmikmod-3.3.14/libmikmod/NEWS","source":"disclosure@vulncheck.com"},{"url":"https://github.com/sezero/mikmod/commit/097b69281fad6ba38a553569e6f55dbfdd71dc2a","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/libmikmod-before-3.3.14-heap-buffer-overflow-via-okt-loader-okt-dopbod","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-105840","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-06T14:17:41.300","lastModified":"2026-10-09T02:16:55.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-pubdir, attackers can send files named with absolute paths to overwrite any file writable by the receiving user."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Uwe Ohse","product":"lrzsz","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"0.13.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T00:59:47.268162Z","id":"CVE-2026-105840","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://ohse.de/uwe/software/lrzsz.html","source":"disclosure@vulncheck.com"},{"url":"https://ohse.de/uwe/software/lrzsz/NEWS-0.13.0.html","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/lrzsz-before-0.13.0-path-traversal-via-lrz-restricted-mode-checkpath","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-105841","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-06T14:17:41.460","lastModified":"2026-10-06T15:25:00.650","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Uwe Ohse","product":"lrzsz","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"0.13.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:56:33.353808Z","id":"CVE-2026-105841","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://ohse.de/uwe/software/lrzsz.html","source":"disclosure@vulncheck.com"},{"url":"https://ohse.de/uwe/software/lrzsz/NEWS-0.13.0.html","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/lrzsz-before-0.13.0-os-command-injection-via-lrz-pipe-mode","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-105842","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-06T14:17:41.620","lastModified":"2026-10-06T20:17:16.720","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Uwe Ohse","product":"lrzsz","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"0.13.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:25:48.261781Z","id":"CVE-2026-105842","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-122"}]}],"references":[{"url":"https://ohse.de/uwe/software/lrzsz.html","source":"disclosure@vulncheck.com"},{"url":"https://ohse.de/uwe/software/lrzsz/NEWS-0.13.0.html","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/lrzsz-before-0.13.0-heap-buffer-overflow-via-lrz-procheader-pathname","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-105920","sourceIdentifier":"cna@vuldb.com","published":"2026-10-06T14:17:41.873","lastModified":"2026-10-09T02:16:56.773","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The impacted element is an unknown function of the file student_signup.php of the component Student Registration Endpoint. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Kusalkasilva","product":"Learning-Management-System","cpes":["cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:*"],"modules":["Student Registration Endpoint"],"versions":[{"version":"ffeb873f8803f1e9664384ff75000c7da45466d2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T00:58:53.254521Z","id":"CVE-2026-105920","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/KusalkaSilva/Learning-Management-System/","source":"cna@vuldb.com"},{"url":"https://github.com/KusalkaSilva/Learning-Management-System/issues/3","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105920","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/992656","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413894","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413894/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-106026","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-06T14:17:42.083","lastModified":"2026-10-06T18:16:50.933","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"tftp-hpa 5.4 before 6.0 contains an out-of-bounds read vulnerability in rewrite_string() in tftpd/remap.c that walks heap memory during jump label searches. Unauthenticated remote attackers can send read or write requests whose filename matches a remap jump rule to crash the forked in.tftpd request handler."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"H. Peter Anvin","product":"tftp-hpa","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/network/tftp/tftp-hpa.git","versions":[{"version":"5.4","lessThan":"6.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:15:26.218941Z","id":"CVE-2026-106026","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://git.kernel.org/pub/scm/network/tftp/tftp-hpa.git/","source":"disclosure@vulncheck.com"},{"url":"https://git.kernel.org/pub/scm/network/tftp/tftp-hpa.git/commit/?id=6735086fb6475c3e1f1daf9829836b3d06f14291","source":"disclosure@vulncheck.com"},{"url":"https://git.kernel.org/pub/scm/network/tftp/tftp-hpa.git/tree/tftpd/remap.c?h=tftp-hpa-5.4#n762","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/tftp-hpa-5.4-before-6.0-out-of-bounds-read-via-tftpd-remap-jump-rule","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-106037","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-06T14:17:42.257","lastModified":"2026-10-06T17:17:23.840","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without authentication on any route. Unauthenticated attackers can call routes such as /api/get, /api/put, /api/remove_all and /api/mount to read cached KV data with user prompts, inject or delete objects, and mount attacker-described segments."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"kvcache-ai","product":"Mooncake","defaultStatus":"unaffected","packageURL":"pkg:pypi/mooncake-transfer-engine","versions":[{"version":"0","lessThanOrEqual":"0.3.13.post1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T16:10:34.488738Z","id":"CVE-2026-106037","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://github.com/kvcache-ai/Mooncake","source":"disclosure@vulncheck.com"},{"url":"https://github.com/kvcache-ai/Mooncake/blob/719735896c86b56fabec6cf3e825fb2ea640597a/mooncake-wheel/mooncake/mooncake_store_service.py#L240-L282","source":"disclosure@vulncheck.com"},{"url":"https://github.com/kvcache-ai/Mooncake/issues/4476","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/mooncake-through-0.3.13-post1-missing-authentication-in-store-rest-service","source":"disclosure@vulncheck.com"},{"url":"https://github.com/kvcache-ai/Mooncake/issues/4476","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-106038","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-06T14:17:42.420","lastModified":"2026-10-09T02:16:57.053","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via Remove, RemoveByRegex, RemoveAll and BatchRemove on the coro_rpc port. Attackers can send forged requests with the force flag set to bypass lease checks, wipe keys matching any regex, or clear the entire store, causing cache loss and request failures."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"kvcache-ai","product":"Mooncake","defaultStatus":"unaffected","packageURL":"pkg:pypi/mooncake-transfer-engine","versions":[{"version":"0","lessThanOrEqual":"0.3.13.post1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:00:42.377484Z","id":"CVE-2026-106038","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://github.com/kvcache-ai/Mooncake","source":"disclosure@vulncheck.com"},{"url":"https://github.com/kvcache-ai/Mooncake/blob/719735896c86b56fabec6cf3e825fb2ea640597a/mooncake-store/src/master_service.cpp#L6416-L6478","source":"disclosure@vulncheck.com"},{"url":"https://github.com/kvcache-ai/Mooncake/issues/4474","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/mooncake-store-through-0.3.13-post1-unauthenticated-object-deletion-via-remove-rpcs","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-106039","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-06T14:17:43.660","lastModified":"2026-10-06T16:17:07.017","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, steal, and falsely complete replication tasks via the coro_rpc port. Attackers can invoke CreateCopyTask, CreateMoveTask, FetchTasks, and MarkTaskToComplete with victim client UUIDs disclosed by QueryTask to hijack task queues and record replication that never occurred."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"kvcache-ai","product":"Mooncake","defaultStatus":"unaffected","packageURL":"pkg:pypi/mooncake-transfer-engine","versions":[{"version":"0","lessThanOrEqual":"0.3.13.post1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T15:32:13.485050Z","id":"CVE-2026-106039","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/kvcache-ai/Mooncake","source":"disclosure@vulncheck.com"},{"url":"https://github.com/kvcache-ai/Mooncake/blob/719735896c86b56fabec6cf3e825fb2ea640597a/mooncake-store/src/master_service.cpp#L12060-L12120","source":"disclosure@vulncheck.com"},{"url":"https://github.com/kvcache-ai/Mooncake/blob/719735896c86b56fabec6cf3e825fb2ea640597a/mooncake-store/src/task_manager.cpp#L113-L135","source":"disclosure@vulncheck.com"},{"url":"https://github.com/kvcache-ai/Mooncake/issues/4475","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/mooncake-store-through-0.3.13-post1-missing-authorization-in-replication-task-rpc","source":"disclosure@vulncheck.com"},{"url":"https://github.com/kvcache-ai/Mooncake/issues/4475","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-106040","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-06T14:17:43.833","lastModified":"2026-10-06T20:17:16.960","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk replica via EvictDiskReplica and BatchEvictDiskReplica. Attackers reaching the coro_rpc master port can evict DISK replicas across all tenants, deleting objects whose only remaining replica is on disk."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"kvcache-ai","product":"Mooncake","defaultStatus":"unaffected","packageURL":"pkg:pypi/mooncake-transfer-engine","versions":[{"version":"0","lessThanOrEqual":"0.3.13.post1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:27:51.000144Z","id":"CVE-2026-106040","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/kvcache-ai/Mooncake","source":"disclosure@vulncheck.com"},{"url":"https://github.com/kvcache-ai/Mooncake/blob/719735896c86b56fabec6cf3e825fb2ea640597a/mooncake-store/src/master_service.cpp#L5507-L5515","source":"disclosure@vulncheck.com"},{"url":"https://github.com/kvcache-ai/Mooncake/issues/4478","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/mooncake-store-through-0.3.13-post1-missing-authorization-via-evictdiskreplica-rpc","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-106041","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-06T14:17:43.983","lastModified":"2026-10-06T18:16:51.063","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed LOCAL_DISK replicas through the NotifyOffloadSuccess RPC. Attackers can mount a local disk segment with a self-chosen client UUID, then attach replicas pointing at attacker-controlled endpoints to serve poisoned disk-tier reads and fake key existence."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"kvcache-ai","product":"Mooncake","defaultStatus":"unaffected","packageURL":"pkg:pypi/mooncake-transfer-engine","versions":[{"version":"0","lessThanOrEqual":"0.3.13.post1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:16:03.472953Z","id":"CVE-2026-106041","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/kvcache-ai/Mooncake","source":"disclosure@vulncheck.com"},{"url":"https://github.com/kvcache-ai/Mooncake/blob/719735896c86b56fabec6cf3e825fb2ea640597a/mooncake-store/src/master_service.cpp#L7365-L7431","source":"disclosure@vulncheck.com"},{"url":"https://github.com/kvcache-ai/Mooncake/issues/4479","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/mooncake-store-through-0.3.13-post1-missing-authorization-via-notifyoffloadsuccess-rpc","source":"disclosure@vulncheck.com"},{"url":"https://github.com/kvcache-ai/Mooncake/issues/4479","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-12380","sourceIdentifier":"iletisim@usom.gov.tr","published":"2026-10-06T14:17:44.150","lastModified":"2026-10-06T20:17:27.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akıllı Ticaret Software Technologies Ltd. Co. E-Commerce Pack allows Reflected XSS.\n\nThis issue affects E-Commerce Pack: through 2026-10-06. NOTE: The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"iletisim@usom.gov.tr","affectedData":[{"vendor":"Akıllı Ticaret Software Technologies Ltd. Co.","product":"E-Commerce Pack","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"2026-10-06","versionType":"date","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"iletisim@usom.gov.tr","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:25:46.732503Z","id":"CVE-2026-12380","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"iletisim@usom.gov.tr","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1256","source":"iletisim@usom.gov.tr"}]}},{"cve":{"id":"CVE-2026-34498","sourceIdentifier":"productsecurity@jci.com","published":"2026-10-06T14:17:45.280","lastModified":"2026-10-06T20:17:28.117","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection.\n\nThis issue affects Illustra Standard - L4L China: before 6.0.0.66394."}],"affected":[{"source":"productsecurity@jci.com","affectedData":[{"vendor":"Johnson Controls","product":"Illustra Standard - L4L China","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"0","lessThan":"6.0.0.66394","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"productsecurity@jci.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:25:49.574695Z","id":"CVE-2026-34498","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"productsecurity@jci.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories","source":"productsecurity@jci.com"}]}},{"cve":{"id":"CVE-2026-77050","sourceIdentifier":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","published":"2026-10-06T14:17:46.017","lastModified":"2026-10-06T15:17:19.377","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.\n`django.utils.translation.get_supported_language_variant()` is subject to\r\na potential denial-of-service attack when processing many distinct, very long\r\nlanguage codes, which are retained as keys in an in-memory cache and\r\nconsume process memory.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Gleb Lizunov for reporting this issue."}],"affected":[{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","affectedData":[{"vendor":"djangoproject","product":"Django","defaultStatus":"unaffected","collectionURL":"https://pypi.org/project/Django/","packageName":"django","repo":"https://github.com/django/django/","versions":[{"version":"6.1","lessThan":"6.1.2","versionType":"python","status":"affected"},{"version":"6.1.2","versionType":"python","status":"unaffected"},{"version":"6.0","lessThan":"6.0.9","versionType":"python","status":"affected"},{"version":"6.0.9","versionType":"python","status":"unaffected"},{"version":"5.2","lessThan":"5.2.18","versionType":"python","status":"affected"},{"version":"5.2.18","versionType":"python","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:20:18.760413Z","id":"CVE-2026-77050","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","type":"Secondary","description":[{"lang":"en","value":"CWE-789"}]}],"references":[{"url":"https://docs.djangoproject.com/en/dev/releases/security/","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"},{"url":"https://github.com/django/django/commit/02a69e3791e3df23d45ea4ea7e7fc489f0eef2be","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"},{"url":"https://github.com/django/django/commit/3d32ee80ae52745d686bf94d3555000ddf073267","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"},{"url":"https://github.com/django/django/commit/7e878b0f8bd42260903e6a0d38996a93b0474a0b","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"},{"url":"https://github.com/django/django/commit/c88b304cc2d90fc37d3bd1f5f3829706fa6c13bc","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"},{"url":"https://groups.google.com/g/django-announce","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"},{"url":"https://www.djangoproject.com/weblog/2026/oct/06/security-releases/","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"}]}},{"cve":{"id":"CVE-2026-77178","sourceIdentifier":"cve@mitre.org","published":"2026-10-06T14:17:46.250","lastModified":"2026-10-06T18:16:55.970","vulnStatus":"Awaiting Analysis","cveTags":[{"sourceIdentifier":"cve@mitre.org","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet (Am79C970A) network device model."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:32:27.645112Z","id":"CVE-2026-77178","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://gist.github.com/entropy1337/cd0d5b368445d20c43aca2590b313892","source":"cve@mitre.org"},{"url":"https://www.oracle.com/","source":"cve@mitre.org"},{"url":"https://www.virtualbox.org/wiki/Download_Old_Builds_7_0","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-82924","sourceIdentifier":"iletisim@usom.gov.tr","published":"2026-10-06T14:17:46.417","lastModified":"2026-10-06T20:17:33.883","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Control of Interaction Frequency vulnerability in Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. Expert Mail allows Brute Force.\n\nThis issue affects Expert Mail: through 2026-09-18."}],"affected":[{"source":"iletisim@usom.gov.tr","affectedData":[{"vendor":"Pusula Communication, IT, and Internet Industry and Trade Co. Ltd.","product":"Expert Mail","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2026-09-18","versionType":"date","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"iletisim@usom.gov.tr","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:27:49.741888Z","id":"CVE-2026-82924","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"iletisim@usom.gov.tr","type":"Secondary","description":[{"lang":"en","value":"CWE-799"}]}],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1257","source":"iletisim@usom.gov.tr"}]}},{"cve":{"id":"CVE-2026-84429","sourceIdentifier":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","published":"2026-10-06T14:17:46.910","lastModified":"2026-10-06T15:17:19.860","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.\n`django.utils.http.parse_header_parameters()` was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An unauthenticated request could reach this parsing through headers such as `Accept` or `Content-Type`, for instance via the content negotiation performed by `HttpRequest.accepts()`. The per-call length limit does not bound the combined size of repeated headers.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Jisung Chae for reporting this issue."}],"affected":[{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","affectedData":[{"vendor":"djangoproject","product":"Django","defaultStatus":"unaffected","collectionURL":"https://pypi.org/project/Django/","packageName":"django","repo":"https://github.com/django/django/","versions":[{"version":"6.1","lessThan":"6.1.2","versionType":"python","status":"affected"},{"version":"6.1.2","versionType":"python","status":"unaffected"},{"version":"6.0","lessThan":"6.0.9","versionType":"python","status":"affected"},{"version":"6.0.9","versionType":"python","status":"unaffected"},{"version":"5.2","lessThan":"5.2.18","versionType":"python","status":"affected"},{"version":"5.2.18","versionType":"python","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:12:40.577982Z","id":"CVE-2026-84429","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","type":"Secondary","description":[{"lang":"en","value":"CWE-407"}]}],"references":[{"url":"https://docs.djangoproject.com/en/dev/releases/security/","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"},{"url":"https://github.com/django/django/commit/3d8f121695c21234aff3071de0d38b6bd38c3f52","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"},{"url":"https://github.com/django/django/commit/6ecd66e09a383be004a78a3a738ea9727ff07b0e","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"},{"url":"https://github.com/django/django/commit/7ff7fcc0508864a4bc39693128ace38b1e95a890","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"},{"url":"https://github.com/django/django/commit/de56deeabd4c48dfb5193f0001469d80102fb367","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"},{"url":"https://groups.google.com/g/django-announce","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"},{"url":"https://www.djangoproject.com/weblog/2026/oct/06/security-releases/","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"}]}},{"cve":{"id":"CVE-2026-85523","sourceIdentifier":"iletisim@usom.gov.tr","published":"2026-10-06T14:17:47.240","lastModified":"2026-10-06T20:17:33.987","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox allows OS Command Injection.\n\nThis issue affects SambaBox: before 5.4.1."}],"affected":[{"source":"iletisim@usom.gov.tr","affectedData":[{"vendor":"Felisify Information Technologies Industry and Trade Inc.","product":"SambaBox","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.4.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"iletisim@usom.gov.tr","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:26:58.792809Z","id":"CVE-2026-85523","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"iletisim@usom.gov.tr","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1258","source":"iletisim@usom.gov.tr"}]}},{"cve":{"id":"CVE-2026-87890","sourceIdentifier":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","published":"2026-10-06T14:17:47.380","lastModified":"2026-10-06T14:17:47.517","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.\nAn incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply `bytes` values to cause the Django process to make network requests via a crafted VRT document referencing an external raster source.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank sicksec for reporting this issue."}],"affected":[{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","affectedData":[{"vendor":"djangoproject","product":"Django","defaultStatus":"unaffected","collectionURL":"https://pypi.org/project/Django/","packageName":"django","repo":"https://github.com/django/django/","versions":[{"version":"6.1","lessThan":"6.1.2","versionType":"python","status":"affected"},{"version":"6.1.2","versionType":"python","status":"unaffected"},{"version":"6.0","lessThan":"6.0.9","versionType":"python","status":"affected"},{"version":"6.0.9","versionType":"python","status":"unaffected"},{"version":"5.2","lessThan":"5.2.18","versionType":"python","status":"affected"},{"version":"5.2.18","versionType":"python","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:06:27.700001Z","id":"CVE-2026-87890","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://docs.djangoproject.com/en/dev/releases/security/","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"},{"url":"https://github.com/django/django/commit/4e77ef1e69c94780006b82795aa7db101996c3af","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"},{"url":"https://github.com/django/django/commit/a2347fe8234a1831d56c875acc0ea51e0742957c","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"},{"url":"https://github.com/django/django/commit/dd0558d1617619e0d66163675ef02135d0f54e5f","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"},{"url":"https://github.com/django/django/commit/ebcb13b327301f28cbc6cd5e4988a719f00575aa","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"},{"url":"https://groups.google.com/g/django-announce","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"},{"url":"https://www.djangoproject.com/weblog/2026/oct/06/security-releases/","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"}]}},{"cve":{"id":"CVE-2026-87975","sourceIdentifier":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","published":"2026-10-06T14:17:47.580","lastModified":"2026-10-06T14:17:47.720","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.\n`django.forms.models.BaseModelFormSet.save_existing_objects()` used the presence of a primary key on a submitted form's instance as evidence that the instance belonged to the formset's limiting queryset. An object outside that queryset is represented by a newly constructed instance whose primary key can still be populated from submitted data when the model's primary key is a field accepted by the form, such as a `OneToOneField` or parent link used as the primary key of an inline formset's model, or a natural or UUID primary key included in the form's fields. This allows an authenticated user permitted to submit such a formset to delete rows outside the limiting queryset, without any permission on the targeted object, via forged management-form data marking an out-of-queryset object for deletion. Models using the default AutoField primary key are not affected.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Seonggwon Yoon for reporting this issue."}],"affected":[{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","affectedData":[{"vendor":"djangoproject","product":"Django","defaultStatus":"unaffected","collectionURL":"https://pypi.org/project/Django/","packageName":"django","repo":"https://github.com/django/django/","versions":[{"version":"6.1","lessThan":"6.1.2","versionType":"python","status":"affected"},{"version":"6.1.2","versionType":"python","status":"unaffected"},{"version":"6.0","lessThan":"6.0.9","versionType":"python","status":"affected"},{"version":"6.0.9","versionType":"python","status":"unaffected"},{"version":"5.2","lessThan":"5.2.18","versionType":"python","status":"affected"},{"version":"5.2.18","versionType":"python","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:51:18.609494Z","id":"CVE-2026-87975","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://docs.djangoproject.com/en/dev/releases/security/","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"},{"url":"https://github.com/django/django/commit/83cbd21be57483e6b3eb6e4688a561c841aff75e","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"},{"url":"https://github.com/django/django/commit/b83ab92bc5474558b083a840ea4628b3261b2cfe","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"},{"url":"https://github.com/django/django/commit/cce6c57ed30ea83725f9d6abb2fe5ee932bab107","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"},{"url":"https://github.com/django/django/commit/ff27883ca055aa9ab23015b50674a5b10dfe5a41","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"},{"url":"https://groups.google.com/g/django-announce","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"},{"url":"https://www.djangoproject.com/weblog/2026/oct/06/security-releases/","source":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"}]}},{"cve":{"id":"CVE-2026-91140","sourceIdentifier":"security@progress.com","published":"2026-10-06T14:17:48.407","lastModified":"2026-10-07T04:18:10.610","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's machine when a user invokes the generator."}],"affected":[{"source":"security@progress.com","affectedData":[{"vendor":"Progress Software","product":"Autonomous REST Connector GenAI Agents","defaultStatus":"unaffected","versions":[{"version":"2.0","lessThan":"2.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@progress.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-91140","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@progress.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://community.progress.com/s/article/Progress-DataDirect-Critical-Security-Alert-Bulletin-September-2026-CVE-2026-91140","source":"security@progress.com"},{"url":"https://github.com/progress/datadirect-arc-ai-model-gen/commit/7ede6d96eb033d647ffdcabf8d8069c098293575","source":"security@progress.com"}]}},{"cve":{"id":"CVE-2025-8352","sourceIdentifier":"security@eset.com","published":"2026-10-06T15:17:10.857","lastModified":"2026-10-14T13:10:00.187","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Allocation of resources without limits or throttling vulnerability in ESET PROTECT On-Prem increased resource consumption (CPU and RAM), leading to conditions for a Denial-of-Service attack."},{"lang":"es","value":"La vulnerabilidad de asignación de recursos sin límites o limitación en ESET PROTECT On-Prem conduce a un consumo excesivo de recursos (CPU y RAM), lo que genera condiciones para un ataque de Denegación de Servicio."}],"affected":[{"source":"security@eset.com","affectedData":[{"vendor":"ESET spol. s.r.o","product":"ESET PROTECT On-Prem","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"12.1.9.0 (with Web Console 12.1.252.0)","versionType":"custom","status":"affected","changes":[{"at":"12.1.11.0 (using Web Console 12.1.260.0 on Apache Tomcat 9.0.107)","status":"unaffected"}]},{"version":"0","lessThanOrEqual":"12.0.13.0  (with Web Console 12.0.289.0)","versionType":"custom","status":"affected","changes":[{"at":"12.0.15.0 (using Web Console 12.0.306.0 on Apache Tomcat 9.0.107)","status":"unaffected"}]},{"version":"0","lessThanOrEqual":"11.1.16.0  (with Web Console 11.1.149.0)","versionType":"custom","status":"affected","changes":[{"at":"11.1.18.0 (using Web Console 11.1.159.0 on Apache Tomcat 9.0.107)","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@eset.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:19:30.826362Z","id":"CVE-2025-8352","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@eset.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://support.eset.com/en/ca8854-eset-customer-advisory-denial-of-service-vulnerability-in-eset-protect-on-prem-fixed","source":"security@eset.com"}]}},{"cve":{"id":"CVE-2026-104069","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-06T15:17:12.237","lastModified":"2026-10-06T17:17:12.083","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafted theme archive containing a PHP file and an .htaccess file to re-enable execution, then request it under the themes directory to execute arbitrary OS commands as the web-server user."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"danielbrendel","product":"hortusfox-web","defaultStatus":"unaffected","repo":"https://github.com/danielbrendel/hortusfox-web","packageURL":"pkg:github/danielbrendel/hortusfox-web","versions":[{"version":"0","lessThan":"6.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T16:09:08.910440Z","id":"CVE-2026-104069","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://github.com/danielbrendel/hortusfox-web/commit/3b87393d38ce408ec6f0946ffb3cbf0d08b5f07c","source":"disclosure@vulncheck.com"},{"url":"https://github.com/danielbrendel/hortusfox-web/releases/tag/v6.2","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/hortusfox-remote-code-execution-via-theme-import","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-105791","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T15:17:15.840","lastModified":"2026-10-09T02:16:54.857","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the run_shell tool in the CommandLineExecutor component of ufo/client/mcp/local_servers/cli_mcp_server.py validates only the first token of the bash_command parameter and permits explorer.exe. On Windows, explorer.exe delegates its following path argument to ShellExecute, so an attacker-influenced agent call can launch an arbitrary executable or script as the desktop user even though the subprocess uses shell=False. Exploitation depends on a user running an affected agent workflow and on inducing the tool call, but successful execution can access or modify that user's files, tokens, and sessions. This issue is fixed in version 3.0.9."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"microsoft","product":"UFO","versions":[{"version":"< 3.0.9","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:01:27.832673Z","id":"CVE-2026-105791","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-88"},{"lang":"en","value":"CWE-184"}]}],"references":[{"url":"https://github.com/microsoft/UFO/commit/3e1262fc091eb319253b7a1338b63f62cc6c82b1","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/UFO/releases/tag/v3.0.9","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/UFO/security/advisories/GHSA-cmq9-vqjf-4q2q","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/UFO/security/advisories/GHSA-cmq9-vqjf-4q2q","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105792","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T15:17:15.980","lastModified":"2026-10-06T18:16:46.957","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the /api/task_result/{task_name} endpoint calls SessionManager.get_result_by_task() in ufo/server/services/session_manager.py, which acquires a non-reentrant lock and then calls SessionManager.get_result() to acquire the same lock again when the task name maps to a session. An authenticated caller who knows or creates a mapped task name can therefore block the request indefinitely, and in the default single-process server configuration the blocked event-loop thread prevents other HTTP, WebSocket, and dependent background interactions. Unknown task names do not reach the nested call and are not affected. This issue is fixed in version 3.0.9."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"microsoft","product":"UFO","versions":[{"version":"< 3.0.9","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:41:44.236030Z","id":"CVE-2026-105792","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-833"}]}],"references":[{"url":"https://github.com/microsoft/UFO/commit/0eeb792333ce76c856bc1c8b05fd65fc26bd3c50","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/UFO/releases/tag/v3.0.9","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/UFO/security/advisories/GHSA-3hwr-qx8m-9xxx","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/UFO/security/advisories/GHSA-3hwr-qx8m-9xxx","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105793","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T15:17:16.123","lastModified":"2026-10-06T16:17:05.703","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the press_key tool in ufo/client/mcp/http_servers/mobile_mcp_server.py accepts a free-form key_code parameter and passes it to `adb shell input keyevent`. The adb client joins the arguments into a remote command string that the Android shell reparses, allowing an authenticated Mobile MCP caller to execute additional commands as the Android shell user on an authorized connected device. Exploitation requires a valid UFO_MCP_API_KEY, adb on the host, and a reachable authorized device, and it does not establish host operating-system execution, Android root execution, or access beyond the Android shell-user privileges. This issue is fixed in version 3.0.9."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"microsoft","product":"UFO","versions":[{"version":"< 3.0.9","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":5.3}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:55:04.730539Z","id":"CVE-2026-105793","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/microsoft/UFO/commit/a538791043327a0c33731d5be428867a5fd71794","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/UFO/releases/tag/v3.0.9","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/UFO/security/advisories/GHSA-5cjx-4375-4877","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/UFO/security/advisories/GHSA-5cjx-4375-4877","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105794","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T15:17:16.260","lastModified":"2026-10-06T18:16:47.073","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-path attacker can therefore present a certificate that does not match the intended target hostname and spoof the server in a man-in-the-middle attack. The Schannel backend is not affected. This issue is fixed in versions 2.4.20, 2.5.11, and 2.6.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"microsoft","product":"msquic","versions":[{"version":"< 2.4.20","status":"affected"},{"version":">= 2.5.0, < 2.5.11","status":"affected"},{"version":">= 2.6.0, < 2.6.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:34:05.356189Z","id":"CVE-2026-105794","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-295"}]}],"references":[{"url":"https://github.com/microsoft/msquic/commit/0591586443cc73a2d2cfb679527d91a144b4a412","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/msquic/commit/508e811370df93e2ad848f5c78347d4fe4f65a91","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/msquic/commit/90fd45498bf9b506b8556fb407088688474d6c81","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/msquic/commit/a01333cf7c2659cce0ff03ef3f21e1ff15bb5b83","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/msquic/pull/6274","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/msquic/pull/6275","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/msquic/pull/6276","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/msquic/pull/6277","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/msquic/releases/tag/v2.4.20","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/msquic/releases/tag/v2.5.11","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/msquic/releases/tag/v2.6.1","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/msquic/security/advisories/GHSA-w5f4-fx9m-m4q7","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105795","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T15:17:16.437","lastModified":"2026-10-06T18:16:47.203","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.response_semantics.oauth_card_path from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe package-relative file reference. Parent-directory traversal, rooted paths, or absolute URIs can therefore reach a consuming host that resolves the reference, allowing the host to cross the intended plugin-package boundary or use an unintended authentication card. Kiota does not itself read a local file or execute code merely while generating the manifest, and impact requires downstream resolution of the unsafe reference. This issue is fixed in version 1.35.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"microsoft","product":"kiota","versions":[{"version":">= 1.25.1, < 1.35.0","status":"affected"}]},{"vendor":"microsoft","product":"Microsoft.OpenApi.Kiota","versions":[{"version":">= 1.25.1, < 1.35.0","status":"affected"}]},{"vendor":"microsoft","product":"Microsoft.OpenApi.Kiota.Builder","versions":[{"version":">= 1.25.1, < 1.35.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:17:41.953926Z","id":"CVE-2026-105795","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/microsoft/kiota/commit/fc0f219b8a665c4c69be8befcff035ba0eb8e4ce","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/kiota/pull/8055","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/kiota/releases/tag/v1.35.0","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/kiota/security/advisories/GHSA-6gw6-rv2g-25mg","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105796","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T15:17:16.590","lastModified":"2026-10-09T02:16:54.973","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Kiota is an OpenAPI based HTTP Client code generator. From 0.5.0 until 1.35.0, Kiota's Java and PHP documentation-comment sanitizers delete block-comment terminators rather than neutralizing them, allowing overlapping characters to reform a terminator and place attacker-controlled OpenAPI text outside a generated documentation comment. The Java sanitizer also removes non-ASCII characters after deleting terminators, which can create a new terminator during normalization. Exploitation requires a developer or build pipeline to generate source from the malicious description and then compile and load the Java output or load the PHP output, after which injected code executes in the consuming application or build environment context. The version range is based on the Java defect and does not assert that PHP generation existed in every affected release. This issue is fixed in version 1.35.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"microsoft","product":"kiota","versions":[{"version":">= 0.5.0, < 1.35.0","status":"affected"}]},{"vendor":"microsoft","product":"Microsoft.OpenApi.Kiota","versions":[{"version":">= 0.5.0, < 1.35.0","status":"affected"}]},{"vendor":"microsoft","product":"Microsoft.OpenApi.Kiota.Builder","versions":[{"version":">= 0.5.0, < 1.35.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:03:40.299954Z","id":"CVE-2026-105796","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/microsoft/kiota/commit/68f33b865be9273464a6efbbe17379760e51f1a4","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/kiota/pull/8017","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/kiota/releases/tag/v1.35.0","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/kiota/security/advisories/GHSA-rm89-rhwj-9j92","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105797","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T15:17:16.733","lastModified":"2026-10-06T18:16:47.320","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so that _reject_non_admin_mcp_stdio skips inspection before the type is restored from metadata. The stored personal action can then reach McpPluginFactory.create_connector, and MCPStdioPlugin.connect starts the attacker-selected operating-system process under the application service identity when the action tool is invoked. Exploitation requires personal plugins to be enabled and governance to permit MCP actions, and it can expose or modify secrets and data available to the service or disrupt the service. This issue is fixed in version 0.261.031."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"microsoft","product":"simplechat","versions":[{"version":"< 0.261.031","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:36:18.199579Z","id":"CVE-2026-105797","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/microsoft/simplechat/commit/73ff7d6998dc4827a0f6ba002386275a7c1ec804","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/simplechat/security/advisories/GHSA-h4mw-qw8m-5x4j","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/simplechat/security/advisories/GHSA-h4mw-qw8m-5x4j","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105798","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T15:17:16.880","lastModified":"2026-10-06T15:25:00.650","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.261.029, POST /api/group_documents/upload stores an attacker-controlled group document filename that group_workspaces.html later interpolates into inline Share event handlers. The escapeGroupHtml function leaves apostrophes unchanged, while escapeHtml produces an HTML entity that the browser decodes before JavaScript evaluation, so either path permits the filename to terminate the handler string. An authenticated group Owner, Admin, or DocumentManager can persist script that executes in the SimpleChat origin when another group member clicks Share, allowing access to victim-visible data and actions with the victim session. This issue is fixed in version 0.261.029."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"microsoft","product":"simplechat","versions":[{"version":"< 0.261.029","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:44:18.403661Z","id":"CVE-2026-105798","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/microsoft/simplechat/commit/537a259eb048b8f6d1c94193fa0c9683ab0bace9","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/simplechat/security/advisories/GHSA-qwcw-r653-j8c6","source":"security-advisories@github.com"},{"url":"https://github.com/microsoft/simplechat/security/advisories/GHSA-qwcw-r653-j8c6","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105799","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T15:17:17.030","lastModified":"2026-10-06T18:16:47.437","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"LangChain is a framework for building LLM-powered applications. Prior to 1.1.1, @langchain/redis does not escape attacker-controlled values in structured RediSearch TAG filters and structured RediSearch TEXT filters, allowing injected RediSearch syntax to alter or broaden the generated search query. When an application uses an attacker-influenceable filter as a tenant or document-access boundary, the modified query can expose indexed documents outside the attacker's intended scope. This issue is fixed in version 1.1.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"langchain-ai","product":"langchainjs","versions":[{"version":"< 1.1.1","status":"affected"}]},{"vendor":"@langchain","product":"redis","versions":[{"version":"< 1.1.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:34:07.530416Z","id":"CVE-2026-105799","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-943"}]}],"references":[{"url":"https://github.com/langchain-ai/langchainjs/commit/880e3969ea643a2147777a4d5e8bd606a697edf7","source":"security-advisories@github.com"},{"url":"https://github.com/langchain-ai/langchainjs/pull/10701","source":"security-advisories@github.com"},{"url":"https://github.com/langchain-ai/langchainjs/releases/tag/@langchain/redis@1.1.1","source":"security-advisories@github.com"},{"url":"https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-5x6v-p487-7qh2","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105800","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T15:17:17.173","lastModified":"2026-10-06T18:16:47.547","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with {{lng}} or {{ns}} can make colon-based input become an absolute URL or, in browsers, make a double-slash namespace become a protocol-relative URL. The resulting request can leave the intended origin and cause URL injection or server-side request forgery. The default /locales/{{lng}}/{{ns}}.json template and templates with a leading path or origin are not affected because the placeholder does not occupy the URL's structural beginning. This issue is fixed in version 4.0.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"i18next","product":"i18next-http-backend","versions":[{"version":"< 4.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:18:55.474264Z","id":"CVE-2026-105800","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/i18next/i18next-http-backend/commit/07e028862b25d0b9251bf3cafb92be2d35285f85","source":"security-advisories@github.com"},{"url":"https://github.com/i18next/i18next-http-backend/releases/tag/v4.0.2","source":"security-advisories@github.com"},{"url":"https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf","source":"security-advisories@github.com"},{"url":"https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105801","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T15:17:17.320","lastModified":"2026-10-09T02:16:55.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious OpenAPI document content before rendering string, docstring, and f-string contexts in generated Python. The generated Python client can contain attacker-controlled Python that executes when a user imports the client, affecting the importing environment's integrity and potentially its confidentiality and availability. This issue is fixed in version 0.29.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"openapi-generators","product":"openapi-python-client","versions":[{"version":"< 0.29.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:06:05.721882Z","id":"CVE-2026-105801","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-116"},{"lang":"en","value":"CWE-150"}]}],"references":[{"url":"https://github.com/openapi-generators/openapi-python-client/commit/1c99af478892e5bbe6583b92acba431c9dec9186","source":"security-advisories@github.com"},{"url":"https://github.com/openapi-generators/openapi-python-client/pull/1483","source":"security-advisories@github.com"},{"url":"https://github.com/openapi-generators/openapi-python-client/releases/tag/v0.29.1","source":"security-advisories@github.com"},{"url":"https://github.com/openapi-generators/openapi-python-client/security/advisories/GHSA-5293-mq8x-g3xj","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105921","sourceIdentifier":"cna@vuldb.com","published":"2026-10-06T15:17:17.497","lastModified":"2026-10-06T16:01:05.803","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an unknown function of the file search_class.php. Such manipulation of the argument school_year leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Kusalkasilva","product":"Learning-Management-System","cpes":["cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:*"],"versions":[{"version":"ffeb873f8803f1e9664384ff75000c7da45466d2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:47:43.198439Z","id":"CVE-2026-105921","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/KusalkaSilva/Learning-Management-System/","source":"cna@vuldb.com"},{"url":"https://github.com/KusalkaSilva/Learning-Management-System/issues/4","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105921","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/992659","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413895","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413895/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105922","sourceIdentifier":"cna@vuldb.com","published":"2026-10-06T15:17:17.727","lastModified":"2026-10-09T14:13:02.383","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty Handler. Performing a manipulation results in denial of service. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"vllm-project","product":"vLLM","cpes":["cpe:2.3:a:vllm-project:vllm:*:*:*:*:*:*:*:*"],"modules":["Penalty Handler"],"versions":[{"version":"0.1","status":"affected"},{"version":"0.2","status":"affected"},{"version":"0.3","status":"affected"},{"version":"0.4","status":"affected"},{"version":"0.5","status":"affected"},{"version":"0.6","status":"affected"},{"version":"0.7","status":"affected"},{"version":"0.8","status":"affected"},{"version":"0.9","status":"affected"},{"version":"0.10","status":"affected"},{"version":"0.11","status":"affected"},{"version":"0.12","status":"affected"},{"version":"0.13","status":"affected"},{"version":"0.14","status":"affected"},{"version":"0.15","status":"affected"},{"version":"0.16","status":"affected"},{"version":"0.17","status":"affected"},{"version":"0.18","status":"affected"},{"version":"0.19","status":"affected"},{"version":"0.20","status":"affected"},{"version":"0.21","status":"affected"},{"version":"0.22","status":"affected"},{"version":"0.23","status":"affected"},{"version":"0.24","status":"affected"},{"version":"0.25","status":"affected"},{"version":"0.26","status":"affected"},{"version":"0.27","status":"affected"},{"version":"0.28","status":"affected"},{"version":"0.29","status":"affected"},{"version":"0.30","status":"affected"},{"version":"0.31.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:N/A:P","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:05:54.753920Z","id":"CVE-2026-105922","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-404"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*","versionEndIncluding":"0.31.0","matchCriteriaId":"2E53EF8C-571D-4174-B956-2F6E2AC62158"}]}]}],"references":[{"url":"https://gist.github.com/Yunzez/5c70a3bb328eaf6d646b9d31e879dc4a#file-repro_prompt_embeds_penalties_engine_crash-py","source":"cna@vuldb.com","tags":["Third Party Advisory"]},{"url":"https://github.com/vllm-project/vllm/","source":"cna@vuldb.com","tags":["Product"]},{"url":"https://github.com/vllm-project/vllm/issues/57719","source":"cna@vuldb.com","tags":["Issue Tracking"]},{"url":"https://vuldb.com/cve/CVE-2026-105922","source":"cna@vuldb.com","tags":["Third Party Advisory"]},{"url":"https://vuldb.com/submit/992707","source":"cna@vuldb.com","tags":["Third Party Advisory"]},{"url":"https://vuldb.com/vuln/413896","source":"cna@vuldb.com","tags":["Third Party Advisory"]},{"url":"https://vuldb.com/vuln/413896/cti","source":"cna@vuldb.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-54472","sourceIdentifier":"security_alert@emc.com","published":"2026-10-06T15:17:18.483","lastModified":"2026-10-08T14:17:15.960","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the csm-docs. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.9.8"}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Container Storage Modules","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.18.0 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:28:12.439501Z","id":"CVE-2026-54472","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-798"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:container_storage_modules:*:*:*:*:*:*:*:*","versionEndExcluding":"1.18.0","matchCriteriaId":"8928435D-6205-42ED-A551-DCF4AEF943A8"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000515771/dsa-2026-448-security-update-for-dell-container-storage-modules-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-61421","sourceIdentifier":"security_alert@emc.com","published":"2026-10-06T15:17:18.767","lastModified":"2026-10-08T14:15:46.670","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM Authorization. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Container Storage Modules","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.18.0 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T15:21:09.908355Z","id":"CVE-2026-61421","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-798"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:container_storage_modules:*:*:*:*:*:*:*:*","versionEndExcluding":"1.18.0","matchCriteriaId":"8928435D-6205-42ED-A551-DCF4AEF943A8"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000515771/dsa-2026-448-security-update-for-dell-container-storage-modules-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-63688","sourceIdentifier":"security_alert@emc.com","published":"2026-10-06T15:17:18.890","lastModified":"2026-10-08T14:15:22.590","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to storage backend administrator credentials for all registered storage arrays."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Dell Container Storage Modules (CSM)","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.18.0 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:18:16.829527Z","id":"CVE-2026-63688","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:container_storage_modules:*:*:*:*:*:*:*:*","versionEndExcluding":"1.18.0","matchCriteriaId":"8928435D-6205-42ED-A551-DCF4AEF943A8"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000515771/dsa-2026-448-security-update-for-dell-container-storage-modules-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-63692","sourceIdentifier":"security_alert@emc.com","published":"2026-10-06T15:17:19.007","lastModified":"2026-10-09T02:17:03.937","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Container Storage Modules","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.18.0 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:04:14.025903Z","id":"CVE-2026-63692","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:container_storage_modules:*:*:*:*:*:*:*:*","versionEndExcluding":"1.18.0","matchCriteriaId":"8928435D-6205-42ED-A551-DCF4AEF943A8"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000515771/dsa-2026-448-security-update-for-dell-container-storage-modules-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-67269","sourceIdentifier":"security_alert@emc.com","published":"2026-10-06T15:17:19.130","lastModified":"2026-10-08T18:18:04.330","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource reconciler. A low privileged remote attacker could potentially exploit this vulnerability, leading to escalation of privileges and gaining root-level access on cluster nodes."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Container Storage Modules (CSM)","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.18.0 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T17:51:43.142134Z","id":"CVE-2026-67269","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:container_storage_modules:*:*:*:*:*:*:*:*","versionEndExcluding":"1.18.0","matchCriteriaId":"8928435D-6205-42ED-A551-DCF4AEF943A8"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000515771/dsa-2026-448-security-update-for-dell-container-storage-modules-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105804","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T16:17:05.823","lastModified":"2026-10-06T20:03:40.690","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Payload is a free and open source headless content management system. Payload versions from 3.0.0 before 3.90.0 and canary versions from 4.0.0-canary.0 before 4.0.0-canary.34 use a lower-than-recommended PBKDF2 work factor for password hashing, reducing the computational effort required to test recovered password hashes. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"payloadcms","product":"payload","versions":[{"version":">= 3.0.0, < 3.90.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.34","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:40:21.525377Z","id":"CVE-2026-105804","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-916"}]}],"references":[{"url":"https://github.com/payloadcms/payload/commit/1bc76e540a10f3ec88340f40591a57dae7456d01","source":"security-advisories@github.com"},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0","source":"security-advisories@github.com"},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-q6mq-ch85-c8mm","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105805","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T16:17:06.013","lastModified":"2026-10-06T20:03:40.690","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query a readable collection, control its sorting, and select a protected field as the sort parameter can infer limited information about field values the user cannot read. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"payloadcms","product":"payload","versions":[{"version":"< 3.88.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.27","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T16:23:26.125014Z","id":"CVE-2026-105805","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/payloadcms/payload/commit/a742140ab4fca3160f7f83e9e7d996552ffc3b5a","source":"security-advisories@github.com"},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.88.0","source":"security-advisories@github.com"},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-9g87-32v6-3c2r","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105806","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T16:17:06.257","lastModified":"2026-10-06T20:03:40.690","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version 3.88.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"payloadcms","product":"payload","versions":[{"version":">= 3.61.0, < 3.88.0","status":"affected"}]},{"vendor":"@payloadcms","product":"plugin-mcp","versions":[{"version":">= 3.61.0, < 3.88.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:34:09.694438Z","id":"CVE-2026-105806","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/payloadcms/payload/commit/025581d8c5ed836039ad85397288a30f0d3c11c1","source":"security-advisories@github.com"},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.88.0","source":"security-advisories@github.com"},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-2q76-m6w6-qgc6","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105844","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T16:17:06.400","lastModified":"2026-10-09T02:16:55.637","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended application behavior that can lead to remote code execution. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"payloadcms","product":"payload","versions":[{"version":">= 3.0.0, < 3.88.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.27","status":"affected"}]},{"vendor":"@payloadcms","product":"plugin-import-export","versions":[{"version":">= 3.0.0, < 3.88.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.27","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:08:06.976631Z","id":"CVE-2026-105844","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1321"}]}],"references":[{"url":"https://github.com/payloadcms/payload/commit/a742140ab4fca3160f7f83e9e7d996552ffc3b5a","source":"security-advisories@github.com"},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.88.0","source":"security-advisories@github.com"},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-qf28-8hc6-vwrp","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105845","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T16:17:06.540","lastModified":"2026-10-06T20:03:40.690","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query readable collections through dynamic filters or joins can submit a request that causes SQL injection in the SQLite and Postgres adapters. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"payloadcms","product":"payload","versions":[{"version":">= 3.0.0, < 3.88.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.27","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:27:22.238496Z","id":"CVE-2026-105845","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/payloadcms/payload/commit/a742140ab4fca3160f7f83e9e7d996552ffc3b5a","source":"security-advisories@github.com"},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.88.0","source":"security-advisories@github.com"},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-v49j-62m6-pgrr","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105950","sourceIdentifier":"cna@vuldb.com","published":"2026-10-06T16:17:06.697","lastModified":"2026-10-06T18:16:50.783","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/DomSanitizer.php of the component URI Sanitizer. Such manipulation of the argument formaction leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.3.13 is recommended to address this issue. The name of the patch is 729701e59c5886685c5a1d477bdc3035e41f18b1. Upgrading the affected component is advised."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"getformwork","product":"formwork","cpes":["cpe:2.3:a:getformwork:formwork:*:*:*:*:*:*:*:*"],"modules":["URI Sanitizer"],"versions":[{"version":"2.3.0","status":"affected"},{"version":"2.3.1","status":"affected"},{"version":"2.3.2","status":"affected"},{"version":"2.3.3","status":"affected"},{"version":"2.3.4","status":"affected"},{"version":"2.3.5","status":"affected"},{"version":"2.3.6","status":"affected"},{"version":"2.3.7","status":"affected"},{"version":"2.3.8","status":"affected"},{"version":"2.3.9","status":"affected"},{"version":"2.3.10","status":"affected"},{"version":"2.3.11","status":"affected"},{"version":"2.3.12","status":"affected"},{"version":"2.3.13","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:20:45.529387Z","id":"CVE-2026-105950","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/getformwork/formwork/","source":"cna@vuldb.com"},{"url":"https://github.com/getformwork/formwork/commit/729701e59c5886685c5a1d477bdc3035e41f18b1","source":"cna@vuldb.com"},{"url":"https://github.com/getformwork/formwork/pull/940","source":"cna@vuldb.com"},{"url":"https://github.com/getformwork/formwork/releases/tag/2.3.13","source":"cna@vuldb.com"},{"url":"https://github.com/getformwork/formwork/security/advisories/GHSA-p78q-v3pr-p87j","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105950","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/992820","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413925","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413925/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-26287","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T16:17:07.180","lastModified":"2026-10-06T20:03:40.690","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the `webhook` generator initialization order incorrectly cleared the label-enforcement flag (`EnforceLabels`) after it was set, resulting in the provider-side check for `external-secrets.io/type=webhook` being skipped (and the operation to succeed while it should have failed with `secret does not contain needed label 'external-secrets.io/type: webhook'. Update secret label to use it with webhook`. Version 1.3.2 contains a patch."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"external-secrets","product":"external-secrets","versions":[{"version":">= 0.10.0, < 1.3.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:21:33.262411Z","id":"CVE-2026-26287","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-696"}]}],"references":[{"url":"https://github.com/external-secrets/external-secrets/commit/25aa09275861e3ed6fc5d2a1a60b9ac3df4a93ba","source":"security-advisories@github.com"},{"url":"https://github.com/external-secrets/external-secrets/pull/5901","source":"security-advisories@github.com"},{"url":"https://github.com/external-secrets/external-secrets/releases/tag/v1.3.2","source":"security-advisories@github.com"},{"url":"https://github.com/external-secrets/external-secrets/security/advisories/GHSA-q7hv-xx6h-q2x8","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-61411","sourceIdentifier":"security_alert@emc.com","published":"2026-10-06T16:17:08.693","lastModified":"2026-10-20T19:47:05.710","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Container Storage Modules","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.18.0 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:19:32.014393Z","id":"CVE-2026-61411","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-532"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:container_storage_modules:*:*:*:*:*:*:*:*","versionEndExcluding":"1.18.0","matchCriteriaId":"8928435D-6205-42ED-A551-DCF4AEF943A8"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000515771/dsa-2026-448-security-update-for-dell-container-storage-modules-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-63689","sourceIdentifier":"security_alert@emc.com","published":"2026-10-06T16:17:08.937","lastModified":"2026-10-20T19:46:00.513","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Container Storage Modules","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.18.0 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T16:27:15.348394Z","id":"CVE-2026-63689","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-532"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:container_storage_modules:*:*:*:*:*:*:*:*","versionEndExcluding":"1.18.0","matchCriteriaId":"8928435D-6205-42ED-A551-DCF4AEF943A8"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000515771/dsa-2026-448-security-update-for-dell-container-storage-modules-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-63690","sourceIdentifier":"security_alert@emc.com","published":"2026-10-06T16:17:09.060","lastModified":"2026-10-20T14:23:01.280","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability in the csi-powerflex; csi-powermax; csi-powerstore. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Container Storage Modules","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.18.0 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:19:51.218446Z","id":"CVE-2026-63690","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:container_storage_modules:*:*:*:*:*:*:*:*","versionEndExcluding":"1.18.0","matchCriteriaId":"8928435D-6205-42ED-A551-DCF4AEF943A8"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000515771/dsa-2026-448-security-update-for-dell-container-storage-modules-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-63691","sourceIdentifier":"security_alert@emc.com","published":"2026-10-06T16:17:09.187","lastModified":"2026-10-20T14:11:32.350","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authorization vulnerability in the Dell CSI Driver for PowerMax - csireverseproxy . An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Unauthorized access."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Container Storage Modules","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.18.0 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:07:10.810827Z","id":"CVE-2026-63691","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:container_storage_modules:*:*:*:*:*:*:*:*","versionEndExcluding":"1.18.0","matchCriteriaId":"8928435D-6205-42ED-A551-DCF4AEF943A8"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000515771/dsa-2026-448-security-update-for-dell-container-storage-modules-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-67270","sourceIdentifier":"security_alert@emc.com","published":"2026-10-06T16:17:09.580","lastModified":"2026-10-20T13:18:17.660","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Container Storage Modules (CSM) versions prior to 1.18.0, contains an Improper Certificate Validation vulnerability in the proxy-server component. An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to information exposure of storage backend administrator credentials."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Container Storage Modules (CSM)","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.18.0 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":1.6,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:06:37.898417Z","id":"CVE-2026-67270","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-295"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:container_storage_modules:*:*:*:*:*:*:*:*","versionEndExcluding":"1.18.0","matchCriteriaId":"8928435D-6205-42ED-A551-DCF4AEF943A8"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000515771/dsa-2026-448-security-update-for-dell-container-storage-modules-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-67273","sourceIdentifier":"security_alert@emc.com","published":"2026-10-06T16:17:09.717","lastModified":"2026-10-20T13:13:56.903","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Container Storage Modules","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.18.0 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":5.8},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T17:50:32.644405Z","id":"CVE-2026-67273","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1336"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:container_storage_modules:*:*:*:*:*:*:*:*","versionEndExcluding":"1.18.0","matchCriteriaId":"8928435D-6205-42ED-A551-DCF4AEF943A8"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000515771/dsa-2026-448-security-update-for-dell-container-storage-modules-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-70411","sourceIdentifier":"security_alert@emc.com","published":"2026-10-06T16:17:09.877","lastModified":"2026-10-20T12:50:06.510","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Container Storage Modules (CSM), versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-tenant gRPC service (TenantService). An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to unauthorized creation of tenant entities, cross-tenant role injection, and modification of storage access control flags."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Container Storage Modules (CSM)","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.18.0 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T17:49:30.696743Z","id":"CVE-2026-70411","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:container_storage_modules:*:*:*:*:*:*:*:*","versionEndExcluding":"1.18.0","matchCriteriaId":"8928435D-6205-42ED-A551-DCF4AEF943A8"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000515771/dsa-2026-448-security-update-for-dell-container-storage-modules-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-76105","sourceIdentifier":"security_alert@emc.com","published":"2026-10-06T16:17:10.000","lastModified":"2026-10-20T19:40:18.127","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Container Storage Modules, versions prior to 1.18.0 contain(s) an Use of Insufficiently Random Values vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information tampering."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Container Storage Modules","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.18.0 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:25:50.986173Z","id":"CVE-2026-76105","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-330"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:container_storage_modules:*:*:*:*:*:*:*:*","versionEndExcluding":"1.18.0","matchCriteriaId":"8928435D-6205-42ED-A551-DCF4AEF943A8"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000515771/dsa-2026-448-security-update-for-dell-container-storage-modules-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2025-71383","sourceIdentifier":"cve@mitre.org","published":"2026-10-06T17:17:10.953","lastModified":"2026-10-14T13:10:00.187","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request (from the local Wi-Fi network) that lacks a /api/login username or password field. This occurs because of an error in a JSON parser."},{"lang":"es","value":"Los dispositivos Dbit WIFI4 N300 1.0.0 permiten que la interfaz de gestión se bloquee a través de una solicitud (desde la red Wi-Fi local) que carece de un campo de nombre de usuario o contraseña en /API/login. Esto ocurre debido a un error en un analizador JSON."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T02:36:36.423898Z","id":"CVE-2025-71383","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://www.klogixsecurity.com/scorpion-labs-blog/anatomy-of-an-iot-exploit-from-hands-on-to-rce-folie-a-deux","source":"cve@mitre.org"},{"url":"https://www.klogixsecurity.com/scorpion-labs-blog/anatomy-of-an-iot-exploit-from-hands-on-to-rce-folie-a-deux","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2025-71384","sourceIdentifier":"cve@mitre.org","published":"2026-10-06T17:17:11.090","lastModified":"2026-10-14T13:10:00.187","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Dbit WIFI4 N300 1.0.0 devices allows administrators (from the local Wi-Fi network) to execute OS commands by leveraging a stack-based buffer overflow via the /api/addStaticDHCP comment field,"},{"lang":"es","value":"Los dispositivos Dbit WIFI4 N300 1.0.0 permiten a los administradores (desde la red Wi-Fi local) ejecutar comandos del sistema operativo aprovechando un desbordamiento de búfer basado en pila a través del campo de comentario /api/addStaticDHCP."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T14:11:25.515792Z","id":"CVE-2025-71384","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://www.klogixsecurity.com/scorpion-labs-blog/anatomy-of-an-iot-exploit-from-hands-on-to-rce-folie-a-deux","source":"cve@mitre.org"},{"url":"https://www.klogixsecurity.com/scorpion-labs-blog/anatomy-of-an-iot-exploit-from-hands-on-to-rce-folie-a-deux","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-104070","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-06T17:17:12.213","lastModified":"2026-10-09T02:16:54.557","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php, causing the authorization dispatcher to resolve an unconditionally-true handler instead of the proper modification check. Attackers can chain this flaw to write a malicious .html skeleton file, disclose sensitive configuration files containing the site secret, and forge a signed ajax context to execute the uploaded skeleton, achieving arbitrary PHP code execution as the web-server user."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"SPIP","product":"SPIP Crayons Plugin","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.5.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:11:07.177365Z","id":"CVE-2026-104070","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://blog.spip.net/Mises-a-jour-de-securite-critique-plugins-Crayons-et-Simplog.html?lang=fr","source":"disclosure@vulncheck.com"},{"url":"https://plugins.spip.net/crayons.html?lang=fr","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/spip-crayons-plugin-authorization-bypass-rce","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-104850","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T17:17:15.827","lastModified":"2026-10-06T20:03:40.690","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authorization server received the client's OAuth credentials. Stored and pre-provisioned credentials were not bound to the authorization server they belong to. A malicious or compromised MCP server could name its own authorization server in its protected resource metadata. Without any user interaction, the client would send that server the `refresh_token` and `client_secret` stored from an earlier sign-in (1.x), or the configured `client_secret` or signed assertion of a bundled non-interactive provider (1.x and 2.x). Only those applications that use the SDK as an MCP client over HTTP with an `authProvider`: your own `OAuthClientProvider`, or the bundled `ClientCredentialsProvider`, `PrivateKeyJwtProvider`, `StaticPrivateKeyJwtProvider` or (2.x) `CrossAppAccessProvider` and that may connect to an MCP server the owners does not fully trust while holding credentials for a legitimate authorization server are affected. `@modelcontextprotocol/sdk` 1.31.0 (1.x) and `@modelcontextprotocol/client` 2.2.0 (2.x) patch the issue. A workaround for those who cannot upgrade is available. 2.0.0 and 2.1.0 already accept `expectedIssuer`. On 1.x, the only workaround is to connect OAuth-enabled clients only to MCP servers you trust."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"modelcontextprotocol","product":"typescript-sdk","versions":[{"version":">= 1.12.0, < 1.31.0","status":"affected"},{"version":">= 2.0.0, < 2.2.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T16:28:43.638595Z","id":"CVE-2026-104850","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-345"},{"lang":"en","value":"CWE-522"}]}],"references":[{"url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/edd12e282620ebf770d67316f19cf91d4112a1bd","source":"security-advisories@github.com"},{"url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2887","source":"security-advisories@github.com"},{"url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0","source":"security-advisories@github.com"},{"url":"https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6qxp-vccf-f47h","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105846","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T17:17:19.967","lastModified":"2026-10-15T00:13:53.530","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can craft a redirect URL parameter that sends a guest user to an untrusted destination after the authentication flow completes. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"payloadcms","product":"payload","versions":[{"version":">= 3.40.0, < 3.88.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.27","status":"affected"}]},{"vendor":"@payloadcms","product":"next","versions":[{"version":">= 3.31.0, < 3.88.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.27","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:34:11.494178Z","id":"CVE-2026-105846","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-601"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*","versionStartIncluding":"3.40.0","versionEndExcluding":"3.88.0","matchCriteriaId":"0CF3E9A4-F7F8-4C97-BB93-13C6190CE34A"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:*","matchCriteriaId":"53DD9574-106C-4C33-A3D6-BFEB23E4917C"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:*","matchCriteriaId":"1196BA40-0A6E-4559-8BD3-05D0976992DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:*","matchCriteriaId":"B3464160-9869-4F32-B5B7-0894A6ECFCD4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:*","matchCriteriaId":"7FB24227-53EC-432D-8B9F-139A5E091C4E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:*","matchCriteriaId":"49D73E89-CED4-4A3F-B3BC-938A901B6C32"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:*","matchCriteriaId":"D33CC082-F221-4153-8B73-3EB81CFD1A69"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:*","matchCriteriaId":"79F19128-0AA4-48D3-9132-C198B9DF15EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:*","matchCriteriaId":"76127766-0FEA-4E80-8809-0D0666BE8478"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:*","matchCriteriaId":"6F08E985-B329-471A-946C-010667A88DD0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:*","matchCriteriaId":"CC5D89D2-4F24-4390-8976-BEE779E96CF8"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:*","matchCriteriaId":"0F203762-BAFC-46AF-B7D6-7A684BCE306E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:*","matchCriteriaId":"FC8C958D-27C4-41E7-9E5B-3610E360DEB9"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:*","matchCriteriaId":"01A15ACF-B11C-461D-A176-334B215880CD"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:*","matchCriteriaId":"8A52AB2E-6F9A-4164-B8AE-3F9B8CBB3BB1"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:*","matchCriteriaId":"3EF70DF2-FDB1-42AB-8F4B-2AFCDF2E6126"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:*","matchCriteriaId":"436796A5-4368-41C5-A5E6-671724A6ED64"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:*","matchCriteriaId":"4F4FDF75-D75B-414A-876E-F88B89FF63EE"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:*","matchCriteriaId":"86312747-04E2-4456-9235-35D5E4824EA0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:*","matchCriteriaId":"DD3EC98B-B7B7-4A8A-AFD6-319B2F09C52D"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:*","matchCriteriaId":"3A1D4F52-83DE-4349-918E-6140C0286739"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:*","matchCriteriaId":"C034C0A6-8309-4416-97B1-055830F47A60"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:*","matchCriteriaId":"1747FC51-16DE-49B3-8EFD-D84F7DC1D3D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:*","matchCriteriaId":"2BAAD17C-E626-4522-9CEA-12EB93B16C37"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:*","matchCriteriaId":"EAE8FBAF-243D-46DB-9F66-18A3BBEC2862"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:*","matchCriteriaId":"961CD0D6-2AFD-4BAD-B677-E5FB1D28E816"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:*","matchCriteriaId":"5387D27F-B59F-4ED6-BAE0-6E8F66A47E28"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:*","matchCriteriaId":"666C06CE-8747-4D58-995C-FE60BFB3A8CC"}]}]}],"references":[{"url":"https://github.com/payloadcms/payload/commit/a742140ab4fca3160f7f83e9e7d996552ffc3b5a","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.88.0","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-w84c-53h3-mc2g","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105847","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T17:17:20.143","lastModified":"2026-10-15T00:13:38.000","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a user who can query a collection with a polymorphic join to sensitive fields can infer hidden or read-restricted values, including password-reset tokens, through polymorphic join filters. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"payloadcms","product":"payload","versions":[{"version":">= 3.0.0, < 3.90.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.34","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:22:09.250635Z","id":"CVE-2026-105847","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-639"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*","versionStartIncluding":"3.0.0","versionEndExcluding":"3.90.0","matchCriteriaId":"92C1C29A-B0FF-4B57-BAD3-EF22BA4E2D67"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:*","matchCriteriaId":"53DD9574-106C-4C33-A3D6-BFEB23E4917C"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:*","matchCriteriaId":"1196BA40-0A6E-4559-8BD3-05D0976992DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:*","matchCriteriaId":"B3464160-9869-4F32-B5B7-0894A6ECFCD4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:*","matchCriteriaId":"7FB24227-53EC-432D-8B9F-139A5E091C4E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:*","matchCriteriaId":"49D73E89-CED4-4A3F-B3BC-938A901B6C32"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:*","matchCriteriaId":"D33CC082-F221-4153-8B73-3EB81CFD1A69"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:*","matchCriteriaId":"79F19128-0AA4-48D3-9132-C198B9DF15EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:*","matchCriteriaId":"76127766-0FEA-4E80-8809-0D0666BE8478"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:*","matchCriteriaId":"6F08E985-B329-471A-946C-010667A88DD0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:*","matchCriteriaId":"CC5D89D2-4F24-4390-8976-BEE779E96CF8"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:*","matchCriteriaId":"0F203762-BAFC-46AF-B7D6-7A684BCE306E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:*","matchCriteriaId":"FC8C958D-27C4-41E7-9E5B-3610E360DEB9"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:*","matchCriteriaId":"01A15ACF-B11C-461D-A176-334B215880CD"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:*","matchCriteriaId":"8A52AB2E-6F9A-4164-B8AE-3F9B8CBB3BB1"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:*","matchCriteriaId":"3EF70DF2-FDB1-42AB-8F4B-2AFCDF2E6126"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:*","matchCriteriaId":"436796A5-4368-41C5-A5E6-671724A6ED64"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:*","matchCriteriaId":"4F4FDF75-D75B-414A-876E-F88B89FF63EE"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:*","matchCriteriaId":"86312747-04E2-4456-9235-35D5E4824EA0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:*","matchCriteriaId":"DD3EC98B-B7B7-4A8A-AFD6-319B2F09C52D"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:*","matchCriteriaId":"3A1D4F52-83DE-4349-918E-6140C0286739"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:*","matchCriteriaId":"D3636DE2-A5C6-4752-9888-0B554401E4D3"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:*","matchCriteriaId":"3E104532-ED7E-4B5E-AB69-ED638F8E6618"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:*","matchCriteriaId":"1D303F5B-6918-405B-96F0-6110F1A1EA45"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:*","matchCriteriaId":"C034C0A6-8309-4416-97B1-055830F47A60"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:*","matchCriteriaId":"F6F054AC-6A14-43AA-B970-70063EA21D79"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:*","matchCriteriaId":"ED4A980F-AFCB-41E1-81D8-C9049E633960"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:*","matchCriteriaId":"013CAF5F-61D4-40E8-8044-2435F801F4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:*","matchCriteriaId":"0E752CED-4DD8-4E67-91F8-3F1D0F770850"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:*","matchCriteriaId":"1747FC51-16DE-49B3-8EFD-D84F7DC1D3D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:*","matchCriteriaId":"2BAAD17C-E626-4522-9CEA-12EB93B16C37"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:*","matchCriteriaId":"EAE8FBAF-243D-46DB-9F66-18A3BBEC2862"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:*","matchCriteriaId":"961CD0D6-2AFD-4BAD-B677-E5FB1D28E816"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:*","matchCriteriaId":"5387D27F-B59F-4ED6-BAE0-6E8F66A47E28"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:*","matchCriteriaId":"666C06CE-8747-4D58-995C-FE60BFB3A8CC"}]}]}],"references":[{"url":"https://github.com/payloadcms/payload/commit/caa3f69b5aecc6e7c2b459ed87972cbca9f33ee5","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-fpww-c55p-cjv6","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105848","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T17:17:20.280","lastModified":"2026-10-15T00:13:23.133","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"payloadcms","product":"payload","versions":[{"version":"< 3.90.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.34","status":"affected"}]},{"vendor":"@payloadcms","product":"plugin-stripe","versions":[{"version":"< 3.90.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.34","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:10:12.482093Z","id":"CVE-2026-105848","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-749"},{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*","versionEndExcluding":"3.90.0","matchCriteriaId":"DFA1E977-89F4-4645-A57F-33A1AE87E4FF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:*","matchCriteriaId":"53DD9574-106C-4C33-A3D6-BFEB23E4917C"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:*","matchCriteriaId":"1196BA40-0A6E-4559-8BD3-05D0976992DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:*","matchCriteriaId":"B3464160-9869-4F32-B5B7-0894A6ECFCD4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:*","matchCriteriaId":"7FB24227-53EC-432D-8B9F-139A5E091C4E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:*","matchCriteriaId":"49D73E89-CED4-4A3F-B3BC-938A901B6C32"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:*","matchCriteriaId":"D33CC082-F221-4153-8B73-3EB81CFD1A69"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:*","matchCriteriaId":"79F19128-0AA4-48D3-9132-C198B9DF15EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:*","matchCriteriaId":"76127766-0FEA-4E80-8809-0D0666BE8478"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:*","matchCriteriaId":"6F08E985-B329-471A-946C-010667A88DD0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:*","matchCriteriaId":"CC5D89D2-4F24-4390-8976-BEE779E96CF8"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:*","matchCriteriaId":"0F203762-BAFC-46AF-B7D6-7A684BCE306E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:*","matchCriteriaId":"FC8C958D-27C4-41E7-9E5B-3610E360DEB9"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:*","matchCriteriaId":"01A15ACF-B11C-461D-A176-334B215880CD"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:*","matchCriteriaId":"8A52AB2E-6F9A-4164-B8AE-3F9B8CBB3BB1"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:*","matchCriteriaId":"3EF70DF2-FDB1-42AB-8F4B-2AFCDF2E6126"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:*","matchCriteriaId":"436796A5-4368-41C5-A5E6-671724A6ED64"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:*","matchCriteriaId":"4F4FDF75-D75B-414A-876E-F88B89FF63EE"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:*","matchCriteriaId":"86312747-04E2-4456-9235-35D5E4824EA0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:*","matchCriteriaId":"DD3EC98B-B7B7-4A8A-AFD6-319B2F09C52D"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:*","matchCriteriaId":"3A1D4F52-83DE-4349-918E-6140C0286739"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:*","matchCriteriaId":"D3636DE2-A5C6-4752-9888-0B554401E4D3"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:*","matchCriteriaId":"3E104532-ED7E-4B5E-AB69-ED638F8E6618"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:*","matchCriteriaId":"1D303F5B-6918-405B-96F0-6110F1A1EA45"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:*","matchCriteriaId":"C034C0A6-8309-4416-97B1-055830F47A60"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:*","matchCriteriaId":"F6F054AC-6A14-43AA-B970-70063EA21D79"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:*","matchCriteriaId":"ED4A980F-AFCB-41E1-81D8-C9049E633960"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:*","matchCriteriaId":"013CAF5F-61D4-40E8-8044-2435F801F4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:*","matchCriteriaId":"0E752CED-4DD8-4E67-91F8-3F1D0F770850"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:*","matchCriteriaId":"1747FC51-16DE-49B3-8EFD-D84F7DC1D3D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:*","matchCriteriaId":"2BAAD17C-E626-4522-9CEA-12EB93B16C37"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:*","matchCriteriaId":"EAE8FBAF-243D-46DB-9F66-18A3BBEC2862"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:*","matchCriteriaId":"961CD0D6-2AFD-4BAD-B677-E5FB1D28E816"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:*","matchCriteriaId":"5387D27F-B59F-4ED6-BAE0-6E8F66A47E28"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:*","matchCriteriaId":"666C06CE-8747-4D58-995C-FE60BFB3A8CC"}]}]}],"references":[{"url":"https://github.com/payloadcms/payload/commit/2f94a4205e5ba3ec0e91c92ed54f24f429826dd0","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-r9v2-gg2j-22q5","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105849","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T17:17:20.470","lastModified":"2026-10-15T00:13:10.917","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise the target accounts' permissions until those keys are rotated or disabled. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"payloadcms","product":"payload","versions":[{"version":">= 3.0.0, < 3.90.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.34","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":5.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:26:14.965583Z","id":"CVE-2026-105849","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-201"},{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*","versionStartIncluding":"3.0.0","versionEndExcluding":"3.90.0","matchCriteriaId":"92C1C29A-B0FF-4B57-BAD3-EF22BA4E2D67"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:*","matchCriteriaId":"53DD9574-106C-4C33-A3D6-BFEB23E4917C"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:*","matchCriteriaId":"1196BA40-0A6E-4559-8BD3-05D0976992DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:*","matchCriteriaId":"B3464160-9869-4F32-B5B7-0894A6ECFCD4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:*","matchCriteriaId":"7FB24227-53EC-432D-8B9F-139A5E091C4E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:*","matchCriteriaId":"49D73E89-CED4-4A3F-B3BC-938A901B6C32"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:*","matchCriteriaId":"D33CC082-F221-4153-8B73-3EB81CFD1A69"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:*","matchCriteriaId":"79F19128-0AA4-48D3-9132-C198B9DF15EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:*","matchCriteriaId":"76127766-0FEA-4E80-8809-0D0666BE8478"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:*","matchCriteriaId":"6F08E985-B329-471A-946C-010667A88DD0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:*","matchCriteriaId":"CC5D89D2-4F24-4390-8976-BEE779E96CF8"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:*","matchCriteriaId":"0F203762-BAFC-46AF-B7D6-7A684BCE306E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:*","matchCriteriaId":"FC8C958D-27C4-41E7-9E5B-3610E360DEB9"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:*","matchCriteriaId":"01A15ACF-B11C-461D-A176-334B215880CD"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:*","matchCriteriaId":"8A52AB2E-6F9A-4164-B8AE-3F9B8CBB3BB1"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:*","matchCriteriaId":"3EF70DF2-FDB1-42AB-8F4B-2AFCDF2E6126"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:*","matchCriteriaId":"436796A5-4368-41C5-A5E6-671724A6ED64"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:*","matchCriteriaId":"4F4FDF75-D75B-414A-876E-F88B89FF63EE"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:*","matchCriteriaId":"86312747-04E2-4456-9235-35D5E4824EA0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:*","matchCriteriaId":"DD3EC98B-B7B7-4A8A-AFD6-319B2F09C52D"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:*","matchCriteriaId":"3A1D4F52-83DE-4349-918E-6140C0286739"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:*","matchCriteriaId":"D3636DE2-A5C6-4752-9888-0B554401E4D3"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:*","matchCriteriaId":"3E104532-ED7E-4B5E-AB69-ED638F8E6618"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:*","matchCriteriaId":"1D303F5B-6918-405B-96F0-6110F1A1EA45"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:*","matchCriteriaId":"C034C0A6-8309-4416-97B1-055830F47A60"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:*","matchCriteriaId":"F6F054AC-6A14-43AA-B970-70063EA21D79"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:*","matchCriteriaId":"ED4A980F-AFCB-41E1-81D8-C9049E633960"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:*","matchCriteriaId":"013CAF5F-61D4-40E8-8044-2435F801F4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:*","matchCriteriaId":"0E752CED-4DD8-4E67-91F8-3F1D0F770850"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:*","matchCriteriaId":"1747FC51-16DE-49B3-8EFD-D84F7DC1D3D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:*","matchCriteriaId":"2BAAD17C-E626-4522-9CEA-12EB93B16C37"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:*","matchCriteriaId":"EAE8FBAF-243D-46DB-9F66-18A3BBEC2862"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:*","matchCriteriaId":"961CD0D6-2AFD-4BAD-B677-E5FB1D28E816"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:*","matchCriteriaId":"5387D27F-B59F-4ED6-BAE0-6E8F66A47E28"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:*","matchCriteriaId":"666C06CE-8747-4D58-995C-FE60BFB3A8CC"}]}]}],"references":[{"url":"https://github.com/payloadcms/payload/commit/880d2e900be22cd66a9e939f2b3e702fa413180f","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-238x-w2j9-gwwr","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105850","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T17:17:20.693","lastModified":"2026-10-15T00:12:52.177","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Stripe order confirmation to be processed more than once under certain conditions. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"payloadcms","product":"payload","versions":[{"version":"< 3.90.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.34","status":"affected"}]},{"vendor":"@payloadcms","product":"plugin-ecommerce","versions":[{"version":"< 3.90.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.34","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T16:28:14.279337Z","id":"CVE-2026-105850","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-837"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*","versionEndExcluding":"3.90.0","matchCriteriaId":"DFA1E977-89F4-4645-A57F-33A1AE87E4FF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:*","matchCriteriaId":"53DD9574-106C-4C33-A3D6-BFEB23E4917C"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:*","matchCriteriaId":"1196BA40-0A6E-4559-8BD3-05D0976992DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:*","matchCriteriaId":"B3464160-9869-4F32-B5B7-0894A6ECFCD4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:*","matchCriteriaId":"7FB24227-53EC-432D-8B9F-139A5E091C4E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:*","matchCriteriaId":"49D73E89-CED4-4A3F-B3BC-938A901B6C32"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:*","matchCriteriaId":"D33CC082-F221-4153-8B73-3EB81CFD1A69"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:*","matchCriteriaId":"79F19128-0AA4-48D3-9132-C198B9DF15EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:*","matchCriteriaId":"76127766-0FEA-4E80-8809-0D0666BE8478"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:*","matchCriteriaId":"6F08E985-B329-471A-946C-010667A88DD0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:*","matchCriteriaId":"CC5D89D2-4F24-4390-8976-BEE779E96CF8"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:*","matchCriteriaId":"0F203762-BAFC-46AF-B7D6-7A684BCE306E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:*","matchCriteriaId":"FC8C958D-27C4-41E7-9E5B-3610E360DEB9"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:*","matchCriteriaId":"01A15ACF-B11C-461D-A176-334B215880CD"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:*","matchCriteriaId":"8A52AB2E-6F9A-4164-B8AE-3F9B8CBB3BB1"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:*","matchCriteriaId":"3EF70DF2-FDB1-42AB-8F4B-2AFCDF2E6126"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:*","matchCriteriaId":"436796A5-4368-41C5-A5E6-671724A6ED64"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:*","matchCriteriaId":"4F4FDF75-D75B-414A-876E-F88B89FF63EE"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:*","matchCriteriaId":"86312747-04E2-4456-9235-35D5E4824EA0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:*","matchCriteriaId":"DD3EC98B-B7B7-4A8A-AFD6-319B2F09C52D"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:*","matchCriteriaId":"3A1D4F52-83DE-4349-918E-6140C0286739"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:*","matchCriteriaId":"D3636DE2-A5C6-4752-9888-0B554401E4D3"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:*","matchCriteriaId":"3E104532-ED7E-4B5E-AB69-ED638F8E6618"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:*","matchCriteriaId":"1D303F5B-6918-405B-96F0-6110F1A1EA45"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:*","matchCriteriaId":"C034C0A6-8309-4416-97B1-055830F47A60"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:*","matchCriteriaId":"F6F054AC-6A14-43AA-B970-70063EA21D79"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:*","matchCriteriaId":"ED4A980F-AFCB-41E1-81D8-C9049E633960"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:*","matchCriteriaId":"013CAF5F-61D4-40E8-8044-2435F801F4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:*","matchCriteriaId":"0E752CED-4DD8-4E67-91F8-3F1D0F770850"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:*","matchCriteriaId":"1747FC51-16DE-49B3-8EFD-D84F7DC1D3D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:*","matchCriteriaId":"2BAAD17C-E626-4522-9CEA-12EB93B16C37"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:*","matchCriteriaId":"EAE8FBAF-243D-46DB-9F66-18A3BBEC2862"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:*","matchCriteriaId":"961CD0D6-2AFD-4BAD-B677-E5FB1D28E816"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:*","matchCriteriaId":"5387D27F-B59F-4ED6-BAE0-6E8F66A47E28"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:*","matchCriteriaId":"666C06CE-8747-4D58-995C-FE60BFB3A8CC"}]}]}],"references":[{"url":"https://github.com/payloadcms/payload/commit/6c0c4dc9b4ce1ac87b03fbb5dd7356b8559cbc4e","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-8r29-2mp2-pmrw","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105851","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T17:17:20.843","lastModified":"2026-10-15T00:12:41.997","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the duplicate operation copies values from a source document even when a field is hidden or its access.read or access.create rule rejects that value for the caller. The disableDuplicate setting does not prevent this access-control bypass. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"payloadcms","product":"payload","versions":[{"version":"> 3.0.0, < 3.90.0","status":"affected"},{"version":"> 4.0.0-canary.0, < 4.0.0-canary.34","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:34:36.004571Z","id":"CVE-2026-105851","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*","versionStartIncluding":"3.0.0","versionEndExcluding":"3.90.0","matchCriteriaId":"92C1C29A-B0FF-4B57-BAD3-EF22BA4E2D67"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:*","matchCriteriaId":"53DD9574-106C-4C33-A3D6-BFEB23E4917C"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:*","matchCriteriaId":"1196BA40-0A6E-4559-8BD3-05D0976992DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:*","matchCriteriaId":"B3464160-9869-4F32-B5B7-0894A6ECFCD4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:*","matchCriteriaId":"7FB24227-53EC-432D-8B9F-139A5E091C4E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:*","matchCriteriaId":"49D73E89-CED4-4A3F-B3BC-938A901B6C32"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:*","matchCriteriaId":"D33CC082-F221-4153-8B73-3EB81CFD1A69"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:*","matchCriteriaId":"79F19128-0AA4-48D3-9132-C198B9DF15EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:*","matchCriteriaId":"76127766-0FEA-4E80-8809-0D0666BE8478"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:*","matchCriteriaId":"6F08E985-B329-471A-946C-010667A88DD0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:*","matchCriteriaId":"CC5D89D2-4F24-4390-8976-BEE779E96CF8"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:*","matchCriteriaId":"0F203762-BAFC-46AF-B7D6-7A684BCE306E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:*","matchCriteriaId":"FC8C958D-27C4-41E7-9E5B-3610E360DEB9"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:*","matchCriteriaId":"01A15ACF-B11C-461D-A176-334B215880CD"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:*","matchCriteriaId":"8A52AB2E-6F9A-4164-B8AE-3F9B8CBB3BB1"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:*","matchCriteriaId":"3EF70DF2-FDB1-42AB-8F4B-2AFCDF2E6126"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:*","matchCriteriaId":"436796A5-4368-41C5-A5E6-671724A6ED64"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:*","matchCriteriaId":"4F4FDF75-D75B-414A-876E-F88B89FF63EE"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:*","matchCriteriaId":"86312747-04E2-4456-9235-35D5E4824EA0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:*","matchCriteriaId":"DD3EC98B-B7B7-4A8A-AFD6-319B2F09C52D"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:*","matchCriteriaId":"3A1D4F52-83DE-4349-918E-6140C0286739"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:*","matchCriteriaId":"D3636DE2-A5C6-4752-9888-0B554401E4D3"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:*","matchCriteriaId":"3E104532-ED7E-4B5E-AB69-ED638F8E6618"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:*","matchCriteriaId":"1D303F5B-6918-405B-96F0-6110F1A1EA45"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:*","matchCriteriaId":"C034C0A6-8309-4416-97B1-055830F47A60"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:*","matchCriteriaId":"F6F054AC-6A14-43AA-B970-70063EA21D79"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:*","matchCriteriaId":"ED4A980F-AFCB-41E1-81D8-C9049E633960"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:*","matchCriteriaId":"013CAF5F-61D4-40E8-8044-2435F801F4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:*","matchCriteriaId":"0E752CED-4DD8-4E67-91F8-3F1D0F770850"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:*","matchCriteriaId":"1747FC51-16DE-49B3-8EFD-D84F7DC1D3D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:*","matchCriteriaId":"2BAAD17C-E626-4522-9CEA-12EB93B16C37"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:*","matchCriteriaId":"EAE8FBAF-243D-46DB-9F66-18A3BBEC2862"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:*","matchCriteriaId":"961CD0D6-2AFD-4BAD-B677-E5FB1D28E816"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:*","matchCriteriaId":"5387D27F-B59F-4ED6-BAE0-6E8F66A47E28"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:*","matchCriteriaId":"666C06CE-8747-4D58-995C-FE60BFB3A8CC"}]}]}],"references":[{"url":"https://github.com/payloadcms/payload/commit/099ef12e2682f076aa8e8d0ccb790536b4e1027f","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-vc4h-q48j-5hcx","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105852","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T17:17:20.990","lastModified":"2026-10-15T00:12:33.800","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information about related documents protected by access.read where constraints. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"payloadcms","product":"payload","versions":[{"version":"< 3.90.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.34","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:22:37.286471Z","id":"CVE-2026-105852","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*","versionEndExcluding":"3.90.0","matchCriteriaId":"DFA1E977-89F4-4645-A57F-33A1AE87E4FF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:*","matchCriteriaId":"53DD9574-106C-4C33-A3D6-BFEB23E4917C"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:*","matchCriteriaId":"1196BA40-0A6E-4559-8BD3-05D0976992DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:*","matchCriteriaId":"B3464160-9869-4F32-B5B7-0894A6ECFCD4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:*","matchCriteriaId":"7FB24227-53EC-432D-8B9F-139A5E091C4E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:*","matchCriteriaId":"49D73E89-CED4-4A3F-B3BC-938A901B6C32"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:*","matchCriteriaId":"D33CC082-F221-4153-8B73-3EB81CFD1A69"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:*","matchCriteriaId":"79F19128-0AA4-48D3-9132-C198B9DF15EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:*","matchCriteriaId":"76127766-0FEA-4E80-8809-0D0666BE8478"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:*","matchCriteriaId":"6F08E985-B329-471A-946C-010667A88DD0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:*","matchCriteriaId":"CC5D89D2-4F24-4390-8976-BEE779E96CF8"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:*","matchCriteriaId":"0F203762-BAFC-46AF-B7D6-7A684BCE306E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:*","matchCriteriaId":"FC8C958D-27C4-41E7-9E5B-3610E360DEB9"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:*","matchCriteriaId":"01A15ACF-B11C-461D-A176-334B215880CD"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:*","matchCriteriaId":"8A52AB2E-6F9A-4164-B8AE-3F9B8CBB3BB1"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:*","matchCriteriaId":"3EF70DF2-FDB1-42AB-8F4B-2AFCDF2E6126"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:*","matchCriteriaId":"436796A5-4368-41C5-A5E6-671724A6ED64"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:*","matchCriteriaId":"4F4FDF75-D75B-414A-876E-F88B89FF63EE"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:*","matchCriteriaId":"86312747-04E2-4456-9235-35D5E4824EA0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:*","matchCriteriaId":"DD3EC98B-B7B7-4A8A-AFD6-319B2F09C52D"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:*","matchCriteriaId":"3A1D4F52-83DE-4349-918E-6140C0286739"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:*","matchCriteriaId":"D3636DE2-A5C6-4752-9888-0B554401E4D3"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:*","matchCriteriaId":"3E104532-ED7E-4B5E-AB69-ED638F8E6618"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:*","matchCriteriaId":"1D303F5B-6918-405B-96F0-6110F1A1EA45"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:*","matchCriteriaId":"C034C0A6-8309-4416-97B1-055830F47A60"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:*","matchCriteriaId":"F6F054AC-6A14-43AA-B970-70063EA21D79"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:*","matchCriteriaId":"ED4A980F-AFCB-41E1-81D8-C9049E633960"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:*","matchCriteriaId":"013CAF5F-61D4-40E8-8044-2435F801F4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:*","matchCriteriaId":"0E752CED-4DD8-4E67-91F8-3F1D0F770850"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:*","matchCriteriaId":"1747FC51-16DE-49B3-8EFD-D84F7DC1D3D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:*","matchCriteriaId":"2BAAD17C-E626-4522-9CEA-12EB93B16C37"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:*","matchCriteriaId":"EAE8FBAF-243D-46DB-9F66-18A3BBEC2862"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:*","matchCriteriaId":"961CD0D6-2AFD-4BAD-B677-E5FB1D28E816"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:*","matchCriteriaId":"5387D27F-B59F-4ED6-BAE0-6E8F66A47E28"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:*","matchCriteriaId":"666C06CE-8747-4D58-995C-FE60BFB3A8CC"}]}]}],"references":[{"url":"https://github.com/payloadcms/payload/commit/94059cf4bc6170ce88453015c0c6551329ae3982","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-7c34-32v3-j575","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105853","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T17:17:21.140","lastModified":"2026-10-15T00:12:21.953","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, token refresh responses and password reset responses can independently return hidden or read-restricted fields that the requesting user cannot access. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"payloadcms","product":"payload","versions":[{"version":">= 3.0.0, < 3.90.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.34","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:12:33.886805Z","id":"CVE-2026-105853","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*","versionStartIncluding":"3.0.0","versionEndExcluding":"3.90.0","matchCriteriaId":"92C1C29A-B0FF-4B57-BAD3-EF22BA4E2D67"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:*","matchCriteriaId":"53DD9574-106C-4C33-A3D6-BFEB23E4917C"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:*","matchCriteriaId":"1196BA40-0A6E-4559-8BD3-05D0976992DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:*","matchCriteriaId":"B3464160-9869-4F32-B5B7-0894A6ECFCD4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:*","matchCriteriaId":"7FB24227-53EC-432D-8B9F-139A5E091C4E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:*","matchCriteriaId":"49D73E89-CED4-4A3F-B3BC-938A901B6C32"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:*","matchCriteriaId":"D33CC082-F221-4153-8B73-3EB81CFD1A69"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:*","matchCriteriaId":"79F19128-0AA4-48D3-9132-C198B9DF15EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:*","matchCriteriaId":"76127766-0FEA-4E80-8809-0D0666BE8478"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:*","matchCriteriaId":"6F08E985-B329-471A-946C-010667A88DD0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:*","matchCriteriaId":"CC5D89D2-4F24-4390-8976-BEE779E96CF8"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:*","matchCriteriaId":"0F203762-BAFC-46AF-B7D6-7A684BCE306E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:*","matchCriteriaId":"FC8C958D-27C4-41E7-9E5B-3610E360DEB9"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:*","matchCriteriaId":"01A15ACF-B11C-461D-A176-334B215880CD"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:*","matchCriteriaId":"8A52AB2E-6F9A-4164-B8AE-3F9B8CBB3BB1"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:*","matchCriteriaId":"3EF70DF2-FDB1-42AB-8F4B-2AFCDF2E6126"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:*","matchCriteriaId":"436796A5-4368-41C5-A5E6-671724A6ED64"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:*","matchCriteriaId":"4F4FDF75-D75B-414A-876E-F88B89FF63EE"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:*","matchCriteriaId":"86312747-04E2-4456-9235-35D5E4824EA0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:*","matchCriteriaId":"DD3EC98B-B7B7-4A8A-AFD6-319B2F09C52D"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:*","matchCriteriaId":"3A1D4F52-83DE-4349-918E-6140C0286739"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:*","matchCriteriaId":"D3636DE2-A5C6-4752-9888-0B554401E4D3"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:*","matchCriteriaId":"3E104532-ED7E-4B5E-AB69-ED638F8E6618"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:*","matchCriteriaId":"1D303F5B-6918-405B-96F0-6110F1A1EA45"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:*","matchCriteriaId":"C034C0A6-8309-4416-97B1-055830F47A60"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:*","matchCriteriaId":"F6F054AC-6A14-43AA-B970-70063EA21D79"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:*","matchCriteriaId":"ED4A980F-AFCB-41E1-81D8-C9049E633960"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:*","matchCriteriaId":"013CAF5F-61D4-40E8-8044-2435F801F4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:*","matchCriteriaId":"0E752CED-4DD8-4E67-91F8-3F1D0F770850"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:*","matchCriteriaId":"1747FC51-16DE-49B3-8EFD-D84F7DC1D3D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:*","matchCriteriaId":"2BAAD17C-E626-4522-9CEA-12EB93B16C37"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:*","matchCriteriaId":"EAE8FBAF-243D-46DB-9F66-18A3BBEC2862"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:*","matchCriteriaId":"961CD0D6-2AFD-4BAD-B677-E5FB1D28E816"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:*","matchCriteriaId":"5387D27F-B59F-4ED6-BAE0-6E8F66A47E28"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:*","matchCriteriaId":"666C06CE-8747-4D58-995C-FE60BFB3A8CC"}]}]}],"references":[{"url":"https://github.com/payloadcms/payload/commit/f5f1283d275c58b30e2faa6be7cdc4d49451ea91","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-xgv3-crq2-6f69","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105854","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T17:17:21.290","lastModified":"2026-10-15T00:12:03.407","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a malformed multipart request body can cause multipart Content-Type processing to take an extremely long time, resulting in uncontrolled resource consumption. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"payloadcms","product":"payload","versions":[{"version":">= 3.0.0, < 3.90.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.34","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:29:52.942510Z","id":"CVE-2026-105854","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-1333"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*","versionStartIncluding":"3.0.0","versionEndExcluding":"3.90.0","matchCriteriaId":"92C1C29A-B0FF-4B57-BAD3-EF22BA4E2D67"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:*","matchCriteriaId":"53DD9574-106C-4C33-A3D6-BFEB23E4917C"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:*","matchCriteriaId":"1196BA40-0A6E-4559-8BD3-05D0976992DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:*","matchCriteriaId":"B3464160-9869-4F32-B5B7-0894A6ECFCD4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:*","matchCriteriaId":"7FB24227-53EC-432D-8B9F-139A5E091C4E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:*","matchCriteriaId":"49D73E89-CED4-4A3F-B3BC-938A901B6C32"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:*","matchCriteriaId":"D33CC082-F221-4153-8B73-3EB81CFD1A69"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:*","matchCriteriaId":"79F19128-0AA4-48D3-9132-C198B9DF15EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:*","matchCriteriaId":"76127766-0FEA-4E80-8809-0D0666BE8478"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:*","matchCriteriaId":"6F08E985-B329-471A-946C-010667A88DD0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:*","matchCriteriaId":"CC5D89D2-4F24-4390-8976-BEE779E96CF8"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:*","matchCriteriaId":"0F203762-BAFC-46AF-B7D6-7A684BCE306E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:*","matchCriteriaId":"FC8C958D-27C4-41E7-9E5B-3610E360DEB9"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:*","matchCriteriaId":"01A15ACF-B11C-461D-A176-334B215880CD"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:*","matchCriteriaId":"8A52AB2E-6F9A-4164-B8AE-3F9B8CBB3BB1"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:*","matchCriteriaId":"3EF70DF2-FDB1-42AB-8F4B-2AFCDF2E6126"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:*","matchCriteriaId":"436796A5-4368-41C5-A5E6-671724A6ED64"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:*","matchCriteriaId":"4F4FDF75-D75B-414A-876E-F88B89FF63EE"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:*","matchCriteriaId":"86312747-04E2-4456-9235-35D5E4824EA0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:*","matchCriteriaId":"DD3EC98B-B7B7-4A8A-AFD6-319B2F09C52D"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:*","matchCriteriaId":"3A1D4F52-83DE-4349-918E-6140C0286739"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:*","matchCriteriaId":"D3636DE2-A5C6-4752-9888-0B554401E4D3"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:*","matchCriteriaId":"3E104532-ED7E-4B5E-AB69-ED638F8E6618"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:*","matchCriteriaId":"1D303F5B-6918-405B-96F0-6110F1A1EA45"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:*","matchCriteriaId":"C034C0A6-8309-4416-97B1-055830F47A60"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:*","matchCriteriaId":"F6F054AC-6A14-43AA-B970-70063EA21D79"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:*","matchCriteriaId":"ED4A980F-AFCB-41E1-81D8-C9049E633960"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:*","matchCriteriaId":"013CAF5F-61D4-40E8-8044-2435F801F4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:*","matchCriteriaId":"0E752CED-4DD8-4E67-91F8-3F1D0F770850"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:*","matchCriteriaId":"1747FC51-16DE-49B3-8EFD-D84F7DC1D3D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:*","matchCriteriaId":"2BAAD17C-E626-4522-9CEA-12EB93B16C37"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:*","matchCriteriaId":"EAE8FBAF-243D-46DB-9F66-18A3BBEC2862"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:*","matchCriteriaId":"961CD0D6-2AFD-4BAD-B677-E5FB1D28E816"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:*","matchCriteriaId":"5387D27F-B59F-4ED6-BAE0-6E8F66A47E28"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:*","matchCriteriaId":"666C06CE-8747-4D58-995C-FE60BFB3A8CC"}]}]}],"references":[{"url":"https://github.com/payloadcms/payload/commit/0084bd51fb7742b26a88431bb84cb1696857e6dc","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-2g7p-5934-q4w7","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105855","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T17:17:21.430","lastModified":"2026-10-15T00:11:56.080","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, the server fails to enforce a field-level access.update restriction on the password field of an authentication collection. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"payloadcms","product":"payload","versions":[{"version":"< 3.90.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.34","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:18:36.218370Z","id":"CVE-2026-105855","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*","versionEndExcluding":"3.90.0","matchCriteriaId":"DFA1E977-89F4-4645-A57F-33A1AE87E4FF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:*","matchCriteriaId":"53DD9574-106C-4C33-A3D6-BFEB23E4917C"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:*","matchCriteriaId":"1196BA40-0A6E-4559-8BD3-05D0976992DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:*","matchCriteriaId":"B3464160-9869-4F32-B5B7-0894A6ECFCD4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:*","matchCriteriaId":"7FB24227-53EC-432D-8B9F-139A5E091C4E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:*","matchCriteriaId":"49D73E89-CED4-4A3F-B3BC-938A901B6C32"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:*","matchCriteriaId":"D33CC082-F221-4153-8B73-3EB81CFD1A69"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:*","matchCriteriaId":"79F19128-0AA4-48D3-9132-C198B9DF15EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:*","matchCriteriaId":"76127766-0FEA-4E80-8809-0D0666BE8478"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:*","matchCriteriaId":"6F08E985-B329-471A-946C-010667A88DD0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:*","matchCriteriaId":"CC5D89D2-4F24-4390-8976-BEE779E96CF8"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:*","matchCriteriaId":"0F203762-BAFC-46AF-B7D6-7A684BCE306E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:*","matchCriteriaId":"FC8C958D-27C4-41E7-9E5B-3610E360DEB9"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:*","matchCriteriaId":"01A15ACF-B11C-461D-A176-334B215880CD"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:*","matchCriteriaId":"8A52AB2E-6F9A-4164-B8AE-3F9B8CBB3BB1"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:*","matchCriteriaId":"3EF70DF2-FDB1-42AB-8F4B-2AFCDF2E6126"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:*","matchCriteriaId":"436796A5-4368-41C5-A5E6-671724A6ED64"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:*","matchCriteriaId":"4F4FDF75-D75B-414A-876E-F88B89FF63EE"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:*","matchCriteriaId":"86312747-04E2-4456-9235-35D5E4824EA0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:*","matchCriteriaId":"DD3EC98B-B7B7-4A8A-AFD6-319B2F09C52D"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:*","matchCriteriaId":"3A1D4F52-83DE-4349-918E-6140C0286739"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:*","matchCriteriaId":"D3636DE2-A5C6-4752-9888-0B554401E4D3"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:*","matchCriteriaId":"3E104532-ED7E-4B5E-AB69-ED638F8E6618"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:*","matchCriteriaId":"1D303F5B-6918-405B-96F0-6110F1A1EA45"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:*","matchCriteriaId":"C034C0A6-8309-4416-97B1-055830F47A60"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:*","matchCriteriaId":"F6F054AC-6A14-43AA-B970-70063EA21D79"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:*","matchCriteriaId":"ED4A980F-AFCB-41E1-81D8-C9049E633960"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:*","matchCriteriaId":"013CAF5F-61D4-40E8-8044-2435F801F4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:*","matchCriteriaId":"0E752CED-4DD8-4E67-91F8-3F1D0F770850"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:*","matchCriteriaId":"1747FC51-16DE-49B3-8EFD-D84F7DC1D3D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:*","matchCriteriaId":"2BAAD17C-E626-4522-9CEA-12EB93B16C37"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:*","matchCriteriaId":"EAE8FBAF-243D-46DB-9F66-18A3BBEC2862"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:*","matchCriteriaId":"961CD0D6-2AFD-4BAD-B677-E5FB1D28E816"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:*","matchCriteriaId":"5387D27F-B59F-4ED6-BAE0-6E8F66A47E28"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:*","matchCriteriaId":"666C06CE-8747-4D58-995C-FE60BFB3A8CC"}]}]}],"references":[{"url":"https://github.com/payloadcms/payload/commit/9de9e7911e29d60870a1d5480412524c63d6411e","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-fx49-4h83-wjv9","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105856","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T17:17:21.570","lastModified":"2026-10-15T00:11:47.513","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access to a collection containing a json field or a blocks field with blocksAsJSON enabled can inject SQL through a crafted field path and operators. Collections without those fields are not affected, and richText fields are not affected. The SQLite packages are fixed in versions 3.90.0 and 4.0.0-canary.34, and the Postgres packages are fixed in version 3.73.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"payloadcms","product":"payload","versions":[{"version":">= 3.0.0, < 3.90.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.34","status":"affected"}]},{"vendor":"@payloadcms","product":"db-d1-sqlite","versions":[{"version":">= 3.0.0, < 3.90.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.34","status":"affected"}]},{"vendor":"@payloadcms","product":"db-postgres","versions":[{"version":">= 3.0.0 < 3.73.0","status":"affected"}]},{"vendor":"@payloadcms","product":"db-sqlite","versions":[{"version":">= 3.0.0, < 3.90.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.34","status":"affected"}]},{"vendor":"@payloadcms","product":"db-vercel-postgres","versions":[{"version":">= 3.0.0 < 3.73.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":5.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:34:12.712056Z","id":"CVE-2026-105856","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*","versionEndExcluding":"3.90.0","matchCriteriaId":"DFA1E977-89F4-4645-A57F-33A1AE87E4FF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:*","matchCriteriaId":"53DD9574-106C-4C33-A3D6-BFEB23E4917C"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:*","matchCriteriaId":"1196BA40-0A6E-4559-8BD3-05D0976992DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:*","matchCriteriaId":"B3464160-9869-4F32-B5B7-0894A6ECFCD4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:*","matchCriteriaId":"7FB24227-53EC-432D-8B9F-139A5E091C4E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:*","matchCriteriaId":"49D73E89-CED4-4A3F-B3BC-938A901B6C32"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:*","matchCriteriaId":"D33CC082-F221-4153-8B73-3EB81CFD1A69"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:*","matchCriteriaId":"79F19128-0AA4-48D3-9132-C198B9DF15EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:*","matchCriteriaId":"76127766-0FEA-4E80-8809-0D0666BE8478"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:*","matchCriteriaId":"6F08E985-B329-471A-946C-010667A88DD0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:*","matchCriteriaId":"CC5D89D2-4F24-4390-8976-BEE779E96CF8"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:*","matchCriteriaId":"0F203762-BAFC-46AF-B7D6-7A684BCE306E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:*","matchCriteriaId":"FC8C958D-27C4-41E7-9E5B-3610E360DEB9"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:*","matchCriteriaId":"01A15ACF-B11C-461D-A176-334B215880CD"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:*","matchCriteriaId":"8A52AB2E-6F9A-4164-B8AE-3F9B8CBB3BB1"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:*","matchCriteriaId":"3EF70DF2-FDB1-42AB-8F4B-2AFCDF2E6126"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:*","matchCriteriaId":"436796A5-4368-41C5-A5E6-671724A6ED64"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:*","matchCriteriaId":"4F4FDF75-D75B-414A-876E-F88B89FF63EE"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:*","matchCriteriaId":"86312747-04E2-4456-9235-35D5E4824EA0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:*","matchCriteriaId":"DD3EC98B-B7B7-4A8A-AFD6-319B2F09C52D"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:*","matchCriteriaId":"3A1D4F52-83DE-4349-918E-6140C0286739"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:*","matchCriteriaId":"D3636DE2-A5C6-4752-9888-0B554401E4D3"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:*","matchCriteriaId":"3E104532-ED7E-4B5E-AB69-ED638F8E6618"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:*","matchCriteriaId":"1D303F5B-6918-405B-96F0-6110F1A1EA45"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:*","matchCriteriaId":"C034C0A6-8309-4416-97B1-055830F47A60"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:*","matchCriteriaId":"F6F054AC-6A14-43AA-B970-70063EA21D79"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:*","matchCriteriaId":"ED4A980F-AFCB-41E1-81D8-C9049E633960"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:*","matchCriteriaId":"013CAF5F-61D4-40E8-8044-2435F801F4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:*","matchCriteriaId":"0E752CED-4DD8-4E67-91F8-3F1D0F770850"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:*","matchCriteriaId":"1747FC51-16DE-49B3-8EFD-D84F7DC1D3D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:*","matchCriteriaId":"2BAAD17C-E626-4522-9CEA-12EB93B16C37"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:*","matchCriteriaId":"EAE8FBAF-243D-46DB-9F66-18A3BBEC2862"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:*","matchCriteriaId":"961CD0D6-2AFD-4BAD-B677-E5FB1D28E816"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:*","matchCriteriaId":"5387D27F-B59F-4ED6-BAE0-6E8F66A47E28"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:*","matchCriteriaId":"666C06CE-8747-4D58-995C-FE60BFB3A8CC"}]}]}],"references":[{"url":"https://github.com/payloadcms/payload/commit/03b78c7e0901d19c67f07bdf6396a276010adbcc","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-pj7x-6wpf-pgvp","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105857","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T17:17:21.710","lastModified":"2026-10-15T00:11:25.630","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"payloadcms","product":"payload","versions":[{"version":"< 3.90.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.34","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:23:21.462360Z","id":"CVE-2026-105857","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-1321"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*","versionEndExcluding":"3.90.0","matchCriteriaId":"DFA1E977-89F4-4645-A57F-33A1AE87E4FF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:*","matchCriteriaId":"53DD9574-106C-4C33-A3D6-BFEB23E4917C"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:*","matchCriteriaId":"1196BA40-0A6E-4559-8BD3-05D0976992DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:*","matchCriteriaId":"B3464160-9869-4F32-B5B7-0894A6ECFCD4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:*","matchCriteriaId":"7FB24227-53EC-432D-8B9F-139A5E091C4E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:*","matchCriteriaId":"49D73E89-CED4-4A3F-B3BC-938A901B6C32"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:*","matchCriteriaId":"D33CC082-F221-4153-8B73-3EB81CFD1A69"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:*","matchCriteriaId":"79F19128-0AA4-48D3-9132-C198B9DF15EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:*","matchCriteriaId":"76127766-0FEA-4E80-8809-0D0666BE8478"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:*","matchCriteriaId":"6F08E985-B329-471A-946C-010667A88DD0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:*","matchCriteriaId":"CC5D89D2-4F24-4390-8976-BEE779E96CF8"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:*","matchCriteriaId":"0F203762-BAFC-46AF-B7D6-7A684BCE306E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:*","matchCriteriaId":"FC8C958D-27C4-41E7-9E5B-3610E360DEB9"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:*","matchCriteriaId":"01A15ACF-B11C-461D-A176-334B215880CD"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:*","matchCriteriaId":"8A52AB2E-6F9A-4164-B8AE-3F9B8CBB3BB1"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:*","matchCriteriaId":"3EF70DF2-FDB1-42AB-8F4B-2AFCDF2E6126"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:*","matchCriteriaId":"436796A5-4368-41C5-A5E6-671724A6ED64"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:*","matchCriteriaId":"4F4FDF75-D75B-414A-876E-F88B89FF63EE"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:*","matchCriteriaId":"86312747-04E2-4456-9235-35D5E4824EA0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:*","matchCriteriaId":"DD3EC98B-B7B7-4A8A-AFD6-319B2F09C52D"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:*","matchCriteriaId":"3A1D4F52-83DE-4349-918E-6140C0286739"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:*","matchCriteriaId":"D3636DE2-A5C6-4752-9888-0B554401E4D3"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:*","matchCriteriaId":"3E104532-ED7E-4B5E-AB69-ED638F8E6618"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:*","matchCriteriaId":"1D303F5B-6918-405B-96F0-6110F1A1EA45"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:*","matchCriteriaId":"C034C0A6-8309-4416-97B1-055830F47A60"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:*","matchCriteriaId":"F6F054AC-6A14-43AA-B970-70063EA21D79"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:*","matchCriteriaId":"ED4A980F-AFCB-41E1-81D8-C9049E633960"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:*","matchCriteriaId":"013CAF5F-61D4-40E8-8044-2435F801F4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:*","matchCriteriaId":"0E752CED-4DD8-4E67-91F8-3F1D0F770850"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:*","matchCriteriaId":"1747FC51-16DE-49B3-8EFD-D84F7DC1D3D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:*","matchCriteriaId":"2BAAD17C-E626-4522-9CEA-12EB93B16C37"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:*","matchCriteriaId":"EAE8FBAF-243D-46DB-9F66-18A3BBEC2862"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:*","matchCriteriaId":"961CD0D6-2AFD-4BAD-B677-E5FB1D28E816"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:*","matchCriteriaId":"5387D27F-B59F-4ED6-BAE0-6E8F66A47E28"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:*","matchCriteriaId":"666C06CE-8747-4D58-995C-FE60BFB3A8CC"}]}]}],"references":[{"url":"https://github.com/payloadcms/payload/commit/333b82b9f3e685fed6826c2e3270da79df8336c6","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-r488-j9vj-wx3q","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105858","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T17:17:21.847","lastModified":"2026-10-15T00:11:17.267","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a crafted request to the public first-register operation can execute code remotely when local authentication is enabled and no initial user has been created. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"payloadcms","product":"payload","versions":[{"version":"< 3.90.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.34","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:13:53.118550Z","id":"CVE-2026-105858","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-1321"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*","versionEndExcluding":"3.90.0","matchCriteriaId":"DFA1E977-89F4-4645-A57F-33A1AE87E4FF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:*","matchCriteriaId":"53DD9574-106C-4C33-A3D6-BFEB23E4917C"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:*","matchCriteriaId":"1196BA40-0A6E-4559-8BD3-05D0976992DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:*","matchCriteriaId":"B3464160-9869-4F32-B5B7-0894A6ECFCD4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:*","matchCriteriaId":"7FB24227-53EC-432D-8B9F-139A5E091C4E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:*","matchCriteriaId":"49D73E89-CED4-4A3F-B3BC-938A901B6C32"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:*","matchCriteriaId":"D33CC082-F221-4153-8B73-3EB81CFD1A69"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:*","matchCriteriaId":"79F19128-0AA4-48D3-9132-C198B9DF15EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:*","matchCriteriaId":"76127766-0FEA-4E80-8809-0D0666BE8478"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:*","matchCriteriaId":"6F08E985-B329-471A-946C-010667A88DD0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:*","matchCriteriaId":"CC5D89D2-4F24-4390-8976-BEE779E96CF8"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:*","matchCriteriaId":"0F203762-BAFC-46AF-B7D6-7A684BCE306E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:*","matchCriteriaId":"FC8C958D-27C4-41E7-9E5B-3610E360DEB9"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:*","matchCriteriaId":"01A15ACF-B11C-461D-A176-334B215880CD"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:*","matchCriteriaId":"8A52AB2E-6F9A-4164-B8AE-3F9B8CBB3BB1"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:*","matchCriteriaId":"3EF70DF2-FDB1-42AB-8F4B-2AFCDF2E6126"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:*","matchCriteriaId":"436796A5-4368-41C5-A5E6-671724A6ED64"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:*","matchCriteriaId":"4F4FDF75-D75B-414A-876E-F88B89FF63EE"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:*","matchCriteriaId":"86312747-04E2-4456-9235-35D5E4824EA0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:*","matchCriteriaId":"DD3EC98B-B7B7-4A8A-AFD6-319B2F09C52D"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:*","matchCriteriaId":"3A1D4F52-83DE-4349-918E-6140C0286739"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:*","matchCriteriaId":"D3636DE2-A5C6-4752-9888-0B554401E4D3"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:*","matchCriteriaId":"3E104532-ED7E-4B5E-AB69-ED638F8E6618"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:*","matchCriteriaId":"1D303F5B-6918-405B-96F0-6110F1A1EA45"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:*","matchCriteriaId":"C034C0A6-8309-4416-97B1-055830F47A60"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:*","matchCriteriaId":"F6F054AC-6A14-43AA-B970-70063EA21D79"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:*","matchCriteriaId":"ED4A980F-AFCB-41E1-81D8-C9049E633960"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:*","matchCriteriaId":"013CAF5F-61D4-40E8-8044-2435F801F4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:*","matchCriteriaId":"0E752CED-4DD8-4E67-91F8-3F1D0F770850"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:*","matchCriteriaId":"1747FC51-16DE-49B3-8EFD-D84F7DC1D3D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:*","matchCriteriaId":"2BAAD17C-E626-4522-9CEA-12EB93B16C37"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:*","matchCriteriaId":"EAE8FBAF-243D-46DB-9F66-18A3BBEC2862"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:*","matchCriteriaId":"961CD0D6-2AFD-4BAD-B677-E5FB1D28E816"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:*","matchCriteriaId":"5387D27F-B59F-4ED6-BAE0-6E8F66A47E28"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:*","matchCriteriaId":"666C06CE-8747-4D58-995C-FE60BFB3A8CC"}]}]}],"references":[{"url":"https://github.com/payloadcms/payload/commit/e947fc4ba4a434f276d043386e501b1d14eda679","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-97rh-rhh2-7vjv","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105859","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T17:17:21.987","lastModified":"2026-10-15T00:10:48.717","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can submit a request to a specific update endpoint that modifies collection documents without enforcing collection or field-level access control when orderable is enabled on a collection or join field. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"payloadcms","product":"payload","versions":[{"version":"< 3.90.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.34","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:37:15.906390Z","id":"CVE-2026-105859","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*","versionEndExcluding":"3.90.0","matchCriteriaId":"DFA1E977-89F4-4645-A57F-33A1AE87E4FF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:*","matchCriteriaId":"53DD9574-106C-4C33-A3D6-BFEB23E4917C"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:*","matchCriteriaId":"1196BA40-0A6E-4559-8BD3-05D0976992DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:*","matchCriteriaId":"B3464160-9869-4F32-B5B7-0894A6ECFCD4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:*","matchCriteriaId":"7FB24227-53EC-432D-8B9F-139A5E091C4E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:*","matchCriteriaId":"49D73E89-CED4-4A3F-B3BC-938A901B6C32"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:*","matchCriteriaId":"D33CC082-F221-4153-8B73-3EB81CFD1A69"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:*","matchCriteriaId":"79F19128-0AA4-48D3-9132-C198B9DF15EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:*","matchCriteriaId":"76127766-0FEA-4E80-8809-0D0666BE8478"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:*","matchCriteriaId":"6F08E985-B329-471A-946C-010667A88DD0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:*","matchCriteriaId":"CC5D89D2-4F24-4390-8976-BEE779E96CF8"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:*","matchCriteriaId":"0F203762-BAFC-46AF-B7D6-7A684BCE306E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:*","matchCriteriaId":"FC8C958D-27C4-41E7-9E5B-3610E360DEB9"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:*","matchCriteriaId":"01A15ACF-B11C-461D-A176-334B215880CD"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:*","matchCriteriaId":"8A52AB2E-6F9A-4164-B8AE-3F9B8CBB3BB1"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:*","matchCriteriaId":"3EF70DF2-FDB1-42AB-8F4B-2AFCDF2E6126"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:*","matchCriteriaId":"436796A5-4368-41C5-A5E6-671724A6ED64"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:*","matchCriteriaId":"4F4FDF75-D75B-414A-876E-F88B89FF63EE"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:*","matchCriteriaId":"86312747-04E2-4456-9235-35D5E4824EA0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:*","matchCriteriaId":"DD3EC98B-B7B7-4A8A-AFD6-319B2F09C52D"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:*","matchCriteriaId":"3A1D4F52-83DE-4349-918E-6140C0286739"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:*","matchCriteriaId":"D3636DE2-A5C6-4752-9888-0B554401E4D3"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:*","matchCriteriaId":"3E104532-ED7E-4B5E-AB69-ED638F8E6618"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:*","matchCriteriaId":"1D303F5B-6918-405B-96F0-6110F1A1EA45"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:*","matchCriteriaId":"C034C0A6-8309-4416-97B1-055830F47A60"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:*","matchCriteriaId":"F6F054AC-6A14-43AA-B970-70063EA21D79"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:*","matchCriteriaId":"ED4A980F-AFCB-41E1-81D8-C9049E633960"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:*","matchCriteriaId":"013CAF5F-61D4-40E8-8044-2435F801F4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:*","matchCriteriaId":"0E752CED-4DD8-4E67-91F8-3F1D0F770850"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:*","matchCriteriaId":"1747FC51-16DE-49B3-8EFD-D84F7DC1D3D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:*","matchCriteriaId":"2BAAD17C-E626-4522-9CEA-12EB93B16C37"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:*","matchCriteriaId":"EAE8FBAF-243D-46DB-9F66-18A3BBEC2862"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:*","matchCriteriaId":"961CD0D6-2AFD-4BAD-B677-E5FB1D28E816"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:*","matchCriteriaId":"5387D27F-B59F-4ED6-BAE0-6E8F66A47E28"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:*","matchCriteriaId":"666C06CE-8747-4D58-995C-FE60BFB3A8CC"}]}]}],"references":[{"url":"https://github.com/payloadcms/payload/commit/36fa9af73dd04fa59f4b4a06d11454538c4c1409","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-f7hx-52q9-hcrf","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105860","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T17:17:22.133","lastModified":"2026-10-15T00:10:21.827","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, the default tenant array field access allows an authenticated user to assign the user's own account to other tenants. Deployments that replace the default behavior with secured tenants arrayFieldAccess.create and tenants arrayFieldAccess.update functions are not affected by this behavior. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"payloadcms","product":"payload","versions":[{"version":"< 3.90.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.34","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:14:06.093190Z","id":"CVE-2026-105860","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*","versionEndExcluding":"3.90.0","matchCriteriaId":"DFA1E977-89F4-4645-A57F-33A1AE87E4FF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:*","matchCriteriaId":"53DD9574-106C-4C33-A3D6-BFEB23E4917C"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:*","matchCriteriaId":"1196BA40-0A6E-4559-8BD3-05D0976992DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:*","matchCriteriaId":"B3464160-9869-4F32-B5B7-0894A6ECFCD4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:*","matchCriteriaId":"7FB24227-53EC-432D-8B9F-139A5E091C4E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:*","matchCriteriaId":"49D73E89-CED4-4A3F-B3BC-938A901B6C32"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:*","matchCriteriaId":"D33CC082-F221-4153-8B73-3EB81CFD1A69"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:*","matchCriteriaId":"79F19128-0AA4-48D3-9132-C198B9DF15EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:*","matchCriteriaId":"76127766-0FEA-4E80-8809-0D0666BE8478"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:*","matchCriteriaId":"6F08E985-B329-471A-946C-010667A88DD0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:*","matchCriteriaId":"CC5D89D2-4F24-4390-8976-BEE779E96CF8"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:*","matchCriteriaId":"0F203762-BAFC-46AF-B7D6-7A684BCE306E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:*","matchCriteriaId":"FC8C958D-27C4-41E7-9E5B-3610E360DEB9"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:*","matchCriteriaId":"01A15ACF-B11C-461D-A176-334B215880CD"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:*","matchCriteriaId":"8A52AB2E-6F9A-4164-B8AE-3F9B8CBB3BB1"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:*","matchCriteriaId":"3EF70DF2-FDB1-42AB-8F4B-2AFCDF2E6126"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:*","matchCriteriaId":"436796A5-4368-41C5-A5E6-671724A6ED64"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:*","matchCriteriaId":"4F4FDF75-D75B-414A-876E-F88B89FF63EE"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:*","matchCriteriaId":"86312747-04E2-4456-9235-35D5E4824EA0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:*","matchCriteriaId":"DD3EC98B-B7B7-4A8A-AFD6-319B2F09C52D"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:*","matchCriteriaId":"3A1D4F52-83DE-4349-918E-6140C0286739"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:*","matchCriteriaId":"D3636DE2-A5C6-4752-9888-0B554401E4D3"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:*","matchCriteriaId":"3E104532-ED7E-4B5E-AB69-ED638F8E6618"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:*","matchCriteriaId":"1D303F5B-6918-405B-96F0-6110F1A1EA45"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:*","matchCriteriaId":"C034C0A6-8309-4416-97B1-055830F47A60"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:*","matchCriteriaId":"F6F054AC-6A14-43AA-B970-70063EA21D79"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:*","matchCriteriaId":"ED4A980F-AFCB-41E1-81D8-C9049E633960"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:*","matchCriteriaId":"013CAF5F-61D4-40E8-8044-2435F801F4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:*","matchCriteriaId":"0E752CED-4DD8-4E67-91F8-3F1D0F770850"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:*","matchCriteriaId":"1747FC51-16DE-49B3-8EFD-D84F7DC1D3D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:*","matchCriteriaId":"2BAAD17C-E626-4522-9CEA-12EB93B16C37"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:*","matchCriteriaId":"EAE8FBAF-243D-46DB-9F66-18A3BBEC2862"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:*","matchCriteriaId":"961CD0D6-2AFD-4BAD-B677-E5FB1D28E816"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:*","matchCriteriaId":"5387D27F-B59F-4ED6-BAE0-6E8F66A47E28"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:*","matchCriteriaId":"666C06CE-8747-4D58-995C-FE60BFB3A8CC"}]}]}],"references":[{"url":"https://github.com/payloadcms/payload/commit/19b58692d20d3947f31124bf7a88ac14a5ebf02e","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-p96c-xwx8-3cqj","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105861","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T17:17:22.277","lastModified":"2026-10-15T00:09:43.197","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to an unintended recipient. This issue is fixed in version 3.90.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"payloadcms","product":"payload","versions":[{"version":"> 3.0.0, < 3.90.0","status":"affected"},{"version":"> 4.0.0-canary.0, < 4.0.0-canary-34","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:34:13.957850Z","id":"CVE-2026-105861","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-346"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*","versionStartIncluding":"3.0.0","versionEndExcluding":"3.90.0","matchCriteriaId":"92C1C29A-B0FF-4B57-BAD3-EF22BA4E2D67"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:*","matchCriteriaId":"53DD9574-106C-4C33-A3D6-BFEB23E4917C"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:*","matchCriteriaId":"1196BA40-0A6E-4559-8BD3-05D0976992DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:*","matchCriteriaId":"B3464160-9869-4F32-B5B7-0894A6ECFCD4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:*","matchCriteriaId":"7FB24227-53EC-432D-8B9F-139A5E091C4E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:*","matchCriteriaId":"49D73E89-CED4-4A3F-B3BC-938A901B6C32"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:*","matchCriteriaId":"D33CC082-F221-4153-8B73-3EB81CFD1A69"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:*","matchCriteriaId":"79F19128-0AA4-48D3-9132-C198B9DF15EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:*","matchCriteriaId":"76127766-0FEA-4E80-8809-0D0666BE8478"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:*","matchCriteriaId":"6F08E985-B329-471A-946C-010667A88DD0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:*","matchCriteriaId":"CC5D89D2-4F24-4390-8976-BEE779E96CF8"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:*","matchCriteriaId":"0F203762-BAFC-46AF-B7D6-7A684BCE306E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:*","matchCriteriaId":"FC8C958D-27C4-41E7-9E5B-3610E360DEB9"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:*","matchCriteriaId":"01A15ACF-B11C-461D-A176-334B215880CD"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:*","matchCriteriaId":"8A52AB2E-6F9A-4164-B8AE-3F9B8CBB3BB1"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:*","matchCriteriaId":"3EF70DF2-FDB1-42AB-8F4B-2AFCDF2E6126"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:*","matchCriteriaId":"436796A5-4368-41C5-A5E6-671724A6ED64"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:*","matchCriteriaId":"4F4FDF75-D75B-414A-876E-F88B89FF63EE"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:*","matchCriteriaId":"86312747-04E2-4456-9235-35D5E4824EA0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:*","matchCriteriaId":"DD3EC98B-B7B7-4A8A-AFD6-319B2F09C52D"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:*","matchCriteriaId":"3A1D4F52-83DE-4349-918E-6140C0286739"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:*","matchCriteriaId":"D3636DE2-A5C6-4752-9888-0B554401E4D3"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:*","matchCriteriaId":"3E104532-ED7E-4B5E-AB69-ED638F8E6618"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:*","matchCriteriaId":"1D303F5B-6918-405B-96F0-6110F1A1EA45"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:*","matchCriteriaId":"C034C0A6-8309-4416-97B1-055830F47A60"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:*","matchCriteriaId":"F6F054AC-6A14-43AA-B970-70063EA21D79"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:*","matchCriteriaId":"ED4A980F-AFCB-41E1-81D8-C9049E633960"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:*","matchCriteriaId":"013CAF5F-61D4-40E8-8044-2435F801F4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:*","matchCriteriaId":"0E752CED-4DD8-4E67-91F8-3F1D0F770850"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:*","matchCriteriaId":"1747FC51-16DE-49B3-8EFD-D84F7DC1D3D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:*","matchCriteriaId":"2BAAD17C-E626-4522-9CEA-12EB93B16C37"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:*","matchCriteriaId":"EAE8FBAF-243D-46DB-9F66-18A3BBEC2862"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:*","matchCriteriaId":"961CD0D6-2AFD-4BAD-B677-E5FB1D28E816"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:*","matchCriteriaId":"5387D27F-B59F-4ED6-BAE0-6E8F66A47E28"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:*","matchCriteriaId":"666C06CE-8747-4D58-995C-FE60BFB3A8CC"}]}]}],"references":[{"url":"https://github.com/payloadcms/payload/commit/ba5cf6ae20d27a2c15106cb37466419031f86e6d","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-pj5h-5q6c-3pfx","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105862","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T17:17:22.423","lastModified":"2026-10-15T00:09:17.103","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a collection that allows downloadable SVG uploads can store a malicious SVG that bypasses sanitization and executes attacker-controlled JavaScript when a user downloads and opens the SVG. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"payloadcms","product":"payload","versions":[{"version":"< 3.90.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.34","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:23:55.762440Z","id":"CVE-2026-105862","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-434"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*","versionEndExcluding":"3.90.0","matchCriteriaId":"DFA1E977-89F4-4645-A57F-33A1AE87E4FF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:*","matchCriteriaId":"53DD9574-106C-4C33-A3D6-BFEB23E4917C"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:*","matchCriteriaId":"1196BA40-0A6E-4559-8BD3-05D0976992DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:*","matchCriteriaId":"B3464160-9869-4F32-B5B7-0894A6ECFCD4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:*","matchCriteriaId":"7FB24227-53EC-432D-8B9F-139A5E091C4E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:*","matchCriteriaId":"49D73E89-CED4-4A3F-B3BC-938A901B6C32"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:*","matchCriteriaId":"D33CC082-F221-4153-8B73-3EB81CFD1A69"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:*","matchCriteriaId":"79F19128-0AA4-48D3-9132-C198B9DF15EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:*","matchCriteriaId":"76127766-0FEA-4E80-8809-0D0666BE8478"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:*","matchCriteriaId":"6F08E985-B329-471A-946C-010667A88DD0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:*","matchCriteriaId":"CC5D89D2-4F24-4390-8976-BEE779E96CF8"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:*","matchCriteriaId":"0F203762-BAFC-46AF-B7D6-7A684BCE306E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:*","matchCriteriaId":"FC8C958D-27C4-41E7-9E5B-3610E360DEB9"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:*","matchCriteriaId":"01A15ACF-B11C-461D-A176-334B215880CD"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:*","matchCriteriaId":"8A52AB2E-6F9A-4164-B8AE-3F9B8CBB3BB1"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:*","matchCriteriaId":"3EF70DF2-FDB1-42AB-8F4B-2AFCDF2E6126"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:*","matchCriteriaId":"436796A5-4368-41C5-A5E6-671724A6ED64"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:*","matchCriteriaId":"4F4FDF75-D75B-414A-876E-F88B89FF63EE"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:*","matchCriteriaId":"86312747-04E2-4456-9235-35D5E4824EA0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:*","matchCriteriaId":"DD3EC98B-B7B7-4A8A-AFD6-319B2F09C52D"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:*","matchCriteriaId":"3A1D4F52-83DE-4349-918E-6140C0286739"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:*","matchCriteriaId":"D3636DE2-A5C6-4752-9888-0B554401E4D3"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:*","matchCriteriaId":"3E104532-ED7E-4B5E-AB69-ED638F8E6618"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:*","matchCriteriaId":"1D303F5B-6918-405B-96F0-6110F1A1EA45"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:*","matchCriteriaId":"C034C0A6-8309-4416-97B1-055830F47A60"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:*","matchCriteriaId":"F6F054AC-6A14-43AA-B970-70063EA21D79"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:*","matchCriteriaId":"ED4A980F-AFCB-41E1-81D8-C9049E633960"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:*","matchCriteriaId":"013CAF5F-61D4-40E8-8044-2435F801F4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:*","matchCriteriaId":"0E752CED-4DD8-4E67-91F8-3F1D0F770850"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:*","matchCriteriaId":"1747FC51-16DE-49B3-8EFD-D84F7DC1D3D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:*","matchCriteriaId":"2BAAD17C-E626-4522-9CEA-12EB93B16C37"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:*","matchCriteriaId":"EAE8FBAF-243D-46DB-9F66-18A3BBEC2862"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:*","matchCriteriaId":"961CD0D6-2AFD-4BAD-B677-E5FB1D28E816"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:*","matchCriteriaId":"5387D27F-B59F-4ED6-BAE0-6E8F66A47E28"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:*","matchCriteriaId":"666C06CE-8747-4D58-995C-FE60BFB3A8CC"}]}]}],"references":[{"url":"https://github.com/payloadcms/payload/commit/a8c3a8e8e2680c96ec4f66f5b3854c5df6c35adf","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-2pwp-2369-8fg3","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105863","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T17:17:22.570","lastModified":"2026-10-15T00:09:08.310","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at login. This issue is fixed in version 3.90.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"payloadcms","product":"payload","versions":[{"version":">= 3.0.0, < 3.90.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.34","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":5.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:15:22.805238Z","id":"CVE-2026-105863","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-290"},{"lang":"en","value":"CWE-915"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*","versionStartIncluding":"3.0.0","versionEndExcluding":"3.90.0","matchCriteriaId":"92C1C29A-B0FF-4B57-BAD3-EF22BA4E2D67"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:*","matchCriteriaId":"53DD9574-106C-4C33-A3D6-BFEB23E4917C"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:*","matchCriteriaId":"1196BA40-0A6E-4559-8BD3-05D0976992DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:*","matchCriteriaId":"B3464160-9869-4F32-B5B7-0894A6ECFCD4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:*","matchCriteriaId":"7FB24227-53EC-432D-8B9F-139A5E091C4E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:*","matchCriteriaId":"49D73E89-CED4-4A3F-B3BC-938A901B6C32"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:*","matchCriteriaId":"D33CC082-F221-4153-8B73-3EB81CFD1A69"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:*","matchCriteriaId":"79F19128-0AA4-48D3-9132-C198B9DF15EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:*","matchCriteriaId":"76127766-0FEA-4E80-8809-0D0666BE8478"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:*","matchCriteriaId":"6F08E985-B329-471A-946C-010667A88DD0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:*","matchCriteriaId":"CC5D89D2-4F24-4390-8976-BEE779E96CF8"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:*","matchCriteriaId":"0F203762-BAFC-46AF-B7D6-7A684BCE306E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:*","matchCriteriaId":"FC8C958D-27C4-41E7-9E5B-3610E360DEB9"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:*","matchCriteriaId":"01A15ACF-B11C-461D-A176-334B215880CD"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:*","matchCriteriaId":"8A52AB2E-6F9A-4164-B8AE-3F9B8CBB3BB1"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:*","matchCriteriaId":"3EF70DF2-FDB1-42AB-8F4B-2AFCDF2E6126"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:*","matchCriteriaId":"436796A5-4368-41C5-A5E6-671724A6ED64"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:*","matchCriteriaId":"4F4FDF75-D75B-414A-876E-F88B89FF63EE"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:*","matchCriteriaId":"86312747-04E2-4456-9235-35D5E4824EA0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:*","matchCriteriaId":"DD3EC98B-B7B7-4A8A-AFD6-319B2F09C52D"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:*","matchCriteriaId":"3A1D4F52-83DE-4349-918E-6140C0286739"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:*","matchCriteriaId":"D3636DE2-A5C6-4752-9888-0B554401E4D3"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:*","matchCriteriaId":"3E104532-ED7E-4B5E-AB69-ED638F8E6618"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:*","matchCriteriaId":"1D303F5B-6918-405B-96F0-6110F1A1EA45"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:*","matchCriteriaId":"C034C0A6-8309-4416-97B1-055830F47A60"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:*","matchCriteriaId":"F6F054AC-6A14-43AA-B970-70063EA21D79"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:*","matchCriteriaId":"ED4A980F-AFCB-41E1-81D8-C9049E633960"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:*","matchCriteriaId":"013CAF5F-61D4-40E8-8044-2435F801F4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:*","matchCriteriaId":"0E752CED-4DD8-4E67-91F8-3F1D0F770850"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:*","matchCriteriaId":"1747FC51-16DE-49B3-8EFD-D84F7DC1D3D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:*","matchCriteriaId":"2BAAD17C-E626-4522-9CEA-12EB93B16C37"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:*","matchCriteriaId":"EAE8FBAF-243D-46DB-9F66-18A3BBEC2862"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:*","matchCriteriaId":"961CD0D6-2AFD-4BAD-B677-E5FB1D28E816"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:*","matchCriteriaId":"5387D27F-B59F-4ED6-BAE0-6E8F66A47E28"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:*","matchCriteriaId":"666C06CE-8747-4D58-995C-FE60BFB3A8CC"}]}]}],"references":[{"url":"https://github.com/payloadcms/payload/commit/56cd5cd050a57daebf33159e41e5ff9d4a45239c","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-66wr-7vmr-p5jq","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105864","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T17:17:22.703","lastModified":"2026-10-15T00:08:54.160","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user limited to one tenant can create a record in another tenant when at least one tenant-enabled collection exists. Reads and direct edits of existing documents in the target tenant are not bypassed. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"payloadcms","product":"payload","versions":[{"version":"< 3.90.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.34","status":"affected"}]},{"vendor":"@payloadcms","product":"plugin-multi-tenant","versions":[{"version":"< 3.90.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.34","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:25:08.590502Z","id":"CVE-2026-105864","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*","versionEndExcluding":"3.90.0","matchCriteriaId":"DFA1E977-89F4-4645-A57F-33A1AE87E4FF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:*","matchCriteriaId":"53DD9574-106C-4C33-A3D6-BFEB23E4917C"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:*","matchCriteriaId":"1196BA40-0A6E-4559-8BD3-05D0976992DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:*","matchCriteriaId":"B3464160-9869-4F32-B5B7-0894A6ECFCD4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:*","matchCriteriaId":"7FB24227-53EC-432D-8B9F-139A5E091C4E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:*","matchCriteriaId":"49D73E89-CED4-4A3F-B3BC-938A901B6C32"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:*","matchCriteriaId":"D33CC082-F221-4153-8B73-3EB81CFD1A69"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:*","matchCriteriaId":"79F19128-0AA4-48D3-9132-C198B9DF15EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:*","matchCriteriaId":"76127766-0FEA-4E80-8809-0D0666BE8478"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:*","matchCriteriaId":"6F08E985-B329-471A-946C-010667A88DD0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:*","matchCriteriaId":"CC5D89D2-4F24-4390-8976-BEE779E96CF8"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:*","matchCriteriaId":"0F203762-BAFC-46AF-B7D6-7A684BCE306E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:*","matchCriteriaId":"FC8C958D-27C4-41E7-9E5B-3610E360DEB9"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:*","matchCriteriaId":"01A15ACF-B11C-461D-A176-334B215880CD"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:*","matchCriteriaId":"8A52AB2E-6F9A-4164-B8AE-3F9B8CBB3BB1"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:*","matchCriteriaId":"3EF70DF2-FDB1-42AB-8F4B-2AFCDF2E6126"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:*","matchCriteriaId":"436796A5-4368-41C5-A5E6-671724A6ED64"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:*","matchCriteriaId":"4F4FDF75-D75B-414A-876E-F88B89FF63EE"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:*","matchCriteriaId":"86312747-04E2-4456-9235-35D5E4824EA0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:*","matchCriteriaId":"DD3EC98B-B7B7-4A8A-AFD6-319B2F09C52D"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:*","matchCriteriaId":"3A1D4F52-83DE-4349-918E-6140C0286739"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:*","matchCriteriaId":"D3636DE2-A5C6-4752-9888-0B554401E4D3"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:*","matchCriteriaId":"3E104532-ED7E-4B5E-AB69-ED638F8E6618"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:*","matchCriteriaId":"1D303F5B-6918-405B-96F0-6110F1A1EA45"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:*","matchCriteriaId":"C034C0A6-8309-4416-97B1-055830F47A60"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:*","matchCriteriaId":"F6F054AC-6A14-43AA-B970-70063EA21D79"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:*","matchCriteriaId":"ED4A980F-AFCB-41E1-81D8-C9049E633960"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:*","matchCriteriaId":"013CAF5F-61D4-40E8-8044-2435F801F4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:*","matchCriteriaId":"0E752CED-4DD8-4E67-91F8-3F1D0F770850"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:*","matchCriteriaId":"1747FC51-16DE-49B3-8EFD-D84F7DC1D3D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:*","matchCriteriaId":"2BAAD17C-E626-4522-9CEA-12EB93B16C37"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:*","matchCriteriaId":"EAE8FBAF-243D-46DB-9F66-18A3BBEC2862"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:*","matchCriteriaId":"961CD0D6-2AFD-4BAD-B677-E5FB1D28E816"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:*","matchCriteriaId":"5387D27F-B59F-4ED6-BAE0-6E8F66A47E28"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:*","matchCriteriaId":"666C06CE-8747-4D58-995C-FE60BFB3A8CC"}]}]}],"references":[{"url":"https://github.com/payloadcms/payload/commit/b8fc06a18afb6974dc07f95ac1e541c716e5926b","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-xhm9-gwgw-3q2q","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105865","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T17:17:22.843","lastModified":"2026-10-15T00:08:48.063","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload directory, resulting in data loss or service disruption. Deployments that restrict upload management to trusted users are less exposed. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"payloadcms","product":"payload","versions":[{"version":"< 3.90.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.34","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:10:04.066384Z","id":"CVE-2026-105865","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-73"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*","versionEndExcluding":"3.90.0","matchCriteriaId":"DFA1E977-89F4-4645-A57F-33A1AE87E4FF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:*","matchCriteriaId":"53DD9574-106C-4C33-A3D6-BFEB23E4917C"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:*","matchCriteriaId":"1196BA40-0A6E-4559-8BD3-05D0976992DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:*","matchCriteriaId":"B3464160-9869-4F32-B5B7-0894A6ECFCD4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:*","matchCriteriaId":"7FB24227-53EC-432D-8B9F-139A5E091C4E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:*","matchCriteriaId":"49D73E89-CED4-4A3F-B3BC-938A901B6C32"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:*","matchCriteriaId":"D33CC082-F221-4153-8B73-3EB81CFD1A69"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:*","matchCriteriaId":"79F19128-0AA4-48D3-9132-C198B9DF15EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:*","matchCriteriaId":"76127766-0FEA-4E80-8809-0D0666BE8478"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:*","matchCriteriaId":"6F08E985-B329-471A-946C-010667A88DD0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:*","matchCriteriaId":"CC5D89D2-4F24-4390-8976-BEE779E96CF8"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:*","matchCriteriaId":"0F203762-BAFC-46AF-B7D6-7A684BCE306E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:*","matchCriteriaId":"FC8C958D-27C4-41E7-9E5B-3610E360DEB9"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:*","matchCriteriaId":"01A15ACF-B11C-461D-A176-334B215880CD"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:*","matchCriteriaId":"8A52AB2E-6F9A-4164-B8AE-3F9B8CBB3BB1"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:*","matchCriteriaId":"3EF70DF2-FDB1-42AB-8F4B-2AFCDF2E6126"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:*","matchCriteriaId":"436796A5-4368-41C5-A5E6-671724A6ED64"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:*","matchCriteriaId":"4F4FDF75-D75B-414A-876E-F88B89FF63EE"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:*","matchCriteriaId":"86312747-04E2-4456-9235-35D5E4824EA0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:*","matchCriteriaId":"DD3EC98B-B7B7-4A8A-AFD6-319B2F09C52D"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:*","matchCriteriaId":"3A1D4F52-83DE-4349-918E-6140C0286739"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:*","matchCriteriaId":"D3636DE2-A5C6-4752-9888-0B554401E4D3"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:*","matchCriteriaId":"3E104532-ED7E-4B5E-AB69-ED638F8E6618"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:*","matchCriteriaId":"1D303F5B-6918-405B-96F0-6110F1A1EA45"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:*","matchCriteriaId":"C034C0A6-8309-4416-97B1-055830F47A60"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:*","matchCriteriaId":"F6F054AC-6A14-43AA-B970-70063EA21D79"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:*","matchCriteriaId":"ED4A980F-AFCB-41E1-81D8-C9049E633960"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:*","matchCriteriaId":"013CAF5F-61D4-40E8-8044-2435F801F4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:*","matchCriteriaId":"0E752CED-4DD8-4E67-91F8-3F1D0F770850"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:*","matchCriteriaId":"1747FC51-16DE-49B3-8EFD-D84F7DC1D3D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:*","matchCriteriaId":"2BAAD17C-E626-4522-9CEA-12EB93B16C37"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:*","matchCriteriaId":"EAE8FBAF-243D-46DB-9F66-18A3BBEC2862"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:*","matchCriteriaId":"961CD0D6-2AFD-4BAD-B677-E5FB1D28E816"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:*","matchCriteriaId":"5387D27F-B59F-4ED6-BAE0-6E8F66A47E28"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:*","matchCriteriaId":"666C06CE-8747-4D58-995C-FE60BFB3A8CC"}]}]}],"references":[{"url":"https://github.com/payloadcms/payload/commit/6b74418f628fa633c2f297e5919a9f91b383dc11","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-p223-2wr2-j562","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105866","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T17:17:22.990","lastModified":"2026-10-15T00:08:37.490","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows an account email address or username can abuse the account lockout mechanism of a local-authentication collection to prevent that account from signing in. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"payloadcms","product":"payload","versions":[{"version":"< 3.90.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.34","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:34:37.543263Z","id":"CVE-2026-105866","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-307"},{"lang":"en","value":"CWE-645"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*","versionEndExcluding":"3.90.0","matchCriteriaId":"DFA1E977-89F4-4645-A57F-33A1AE87E4FF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:*","matchCriteriaId":"53DD9574-106C-4C33-A3D6-BFEB23E4917C"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:*","matchCriteriaId":"1196BA40-0A6E-4559-8BD3-05D0976992DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:*","matchCriteriaId":"B3464160-9869-4F32-B5B7-0894A6ECFCD4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:*","matchCriteriaId":"7FB24227-53EC-432D-8B9F-139A5E091C4E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:*","matchCriteriaId":"49D73E89-CED4-4A3F-B3BC-938A901B6C32"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:*","matchCriteriaId":"D33CC082-F221-4153-8B73-3EB81CFD1A69"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:*","matchCriteriaId":"79F19128-0AA4-48D3-9132-C198B9DF15EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:*","matchCriteriaId":"76127766-0FEA-4E80-8809-0D0666BE8478"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:*","matchCriteriaId":"6F08E985-B329-471A-946C-010667A88DD0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:*","matchCriteriaId":"CC5D89D2-4F24-4390-8976-BEE779E96CF8"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:*","matchCriteriaId":"0F203762-BAFC-46AF-B7D6-7A684BCE306E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:*","matchCriteriaId":"FC8C958D-27C4-41E7-9E5B-3610E360DEB9"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:*","matchCriteriaId":"01A15ACF-B11C-461D-A176-334B215880CD"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:*","matchCriteriaId":"8A52AB2E-6F9A-4164-B8AE-3F9B8CBB3BB1"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:*","matchCriteriaId":"3EF70DF2-FDB1-42AB-8F4B-2AFCDF2E6126"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:*","matchCriteriaId":"436796A5-4368-41C5-A5E6-671724A6ED64"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:*","matchCriteriaId":"4F4FDF75-D75B-414A-876E-F88B89FF63EE"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:*","matchCriteriaId":"86312747-04E2-4456-9235-35D5E4824EA0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:*","matchCriteriaId":"DD3EC98B-B7B7-4A8A-AFD6-319B2F09C52D"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:*","matchCriteriaId":"3A1D4F52-83DE-4349-918E-6140C0286739"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:*","matchCriteriaId":"D3636DE2-A5C6-4752-9888-0B554401E4D3"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:*","matchCriteriaId":"3E104532-ED7E-4B5E-AB69-ED638F8E6618"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:*","matchCriteriaId":"1D303F5B-6918-405B-96F0-6110F1A1EA45"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:*","matchCriteriaId":"C034C0A6-8309-4416-97B1-055830F47A60"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:*","matchCriteriaId":"F6F054AC-6A14-43AA-B970-70063EA21D79"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:*","matchCriteriaId":"ED4A980F-AFCB-41E1-81D8-C9049E633960"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:*","matchCriteriaId":"013CAF5F-61D4-40E8-8044-2435F801F4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:*","matchCriteriaId":"0E752CED-4DD8-4E67-91F8-3F1D0F770850"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:*","matchCriteriaId":"1747FC51-16DE-49B3-8EFD-D84F7DC1D3D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:*","matchCriteriaId":"2BAAD17C-E626-4522-9CEA-12EB93B16C37"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:*","matchCriteriaId":"EAE8FBAF-243D-46DB-9F66-18A3BBEC2862"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:*","matchCriteriaId":"961CD0D6-2AFD-4BAD-B677-E5FB1D28E816"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:*","matchCriteriaId":"5387D27F-B59F-4ED6-BAE0-6E8F66A47E28"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:*","matchCriteriaId":"666C06CE-8747-4D58-995C-FE60BFB3A8CC"}]}]}],"references":[{"url":"https://github.com/payloadcms/payload/commit/1c46204a73a0a9f988a80c52690eee5a4ada3cf1","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-v5gf-vpjc-pc7w","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105867","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T17:17:23.137","lastModified":"2026-10-15T00:07:52.077","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user can overwrite an existing S3 object belonging to another upload collection when client uploads are enabled for multiple collections sharing a bucket and useCompositePrefixes is false or unset. This bypasses the target collection's access controls and prior file validation. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"payloadcms","product":"payload","versions":[{"version":"< 3.90.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.34","status":"affected"}]},{"vendor":"@payloadcms","product":"storage-s3","versions":[{"version":"< 3.90.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.34","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:24:30.442506Z","id":"CVE-2026-105867","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*","versionEndExcluding":"3.90.0","matchCriteriaId":"DFA1E977-89F4-4645-A57F-33A1AE87E4FF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:*","matchCriteriaId":"53DD9574-106C-4C33-A3D6-BFEB23E4917C"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:*","matchCriteriaId":"1196BA40-0A6E-4559-8BD3-05D0976992DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:*","matchCriteriaId":"B3464160-9869-4F32-B5B7-0894A6ECFCD4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:*","matchCriteriaId":"7FB24227-53EC-432D-8B9F-139A5E091C4E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:*","matchCriteriaId":"49D73E89-CED4-4A3F-B3BC-938A901B6C32"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:*","matchCriteriaId":"D33CC082-F221-4153-8B73-3EB81CFD1A69"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:*","matchCriteriaId":"79F19128-0AA4-48D3-9132-C198B9DF15EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:*","matchCriteriaId":"76127766-0FEA-4E80-8809-0D0666BE8478"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:*","matchCriteriaId":"6F08E985-B329-471A-946C-010667A88DD0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:*","matchCriteriaId":"CC5D89D2-4F24-4390-8976-BEE779E96CF8"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:*","matchCriteriaId":"0F203762-BAFC-46AF-B7D6-7A684BCE306E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:*","matchCriteriaId":"FC8C958D-27C4-41E7-9E5B-3610E360DEB9"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:*","matchCriteriaId":"01A15ACF-B11C-461D-A176-334B215880CD"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:*","matchCriteriaId":"8A52AB2E-6F9A-4164-B8AE-3F9B8CBB3BB1"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:*","matchCriteriaId":"3EF70DF2-FDB1-42AB-8F4B-2AFCDF2E6126"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:*","matchCriteriaId":"436796A5-4368-41C5-A5E6-671724A6ED64"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:*","matchCriteriaId":"4F4FDF75-D75B-414A-876E-F88B89FF63EE"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:*","matchCriteriaId":"86312747-04E2-4456-9235-35D5E4824EA0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:*","matchCriteriaId":"DD3EC98B-B7B7-4A8A-AFD6-319B2F09C52D"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:*","matchCriteriaId":"3A1D4F52-83DE-4349-918E-6140C0286739"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:*","matchCriteriaId":"D3636DE2-A5C6-4752-9888-0B554401E4D3"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:*","matchCriteriaId":"3E104532-ED7E-4B5E-AB69-ED638F8E6618"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:*","matchCriteriaId":"1D303F5B-6918-405B-96F0-6110F1A1EA45"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:*","matchCriteriaId":"C034C0A6-8309-4416-97B1-055830F47A60"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:*","matchCriteriaId":"F6F054AC-6A14-43AA-B970-70063EA21D79"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:*","matchCriteriaId":"ED4A980F-AFCB-41E1-81D8-C9049E633960"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:*","matchCriteriaId":"013CAF5F-61D4-40E8-8044-2435F801F4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:*","matchCriteriaId":"0E752CED-4DD8-4E67-91F8-3F1D0F770850"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:*","matchCriteriaId":"1747FC51-16DE-49B3-8EFD-D84F7DC1D3D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:*","matchCriteriaId":"2BAAD17C-E626-4522-9CEA-12EB93B16C37"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:*","matchCriteriaId":"EAE8FBAF-243D-46DB-9F66-18A3BBEC2862"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:*","matchCriteriaId":"961CD0D6-2AFD-4BAD-B677-E5FB1D28E816"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:*","matchCriteriaId":"5387D27F-B59F-4ED6-BAE0-6E8F66A47E28"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:*","matchCriteriaId":"666C06CE-8747-4D58-995C-FE60BFB3A8CC"}]}]}],"references":[{"url":"https://github.com/payloadcms/payload/commit/2df8238fbf17edfce335c399b90bf524ba9906a2","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-7vg8-29qx-jgj8","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105868","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T17:17:23.283","lastModified":"2026-10-15T00:13:30.413","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, local upload configurations that accept XML files can store an XML file and stylesheet that execute JavaScript in the Payload origin when a logged-in user opens the file. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"payloadcms","product":"payload","versions":[{"version":"< 3.90.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.34","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:17:27.846201Z","id":"CVE-2026-105868","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*","versionEndExcluding":"3.90.0","matchCriteriaId":"DFA1E977-89F4-4645-A57F-33A1AE87E4FF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:*","matchCriteriaId":"53DD9574-106C-4C33-A3D6-BFEB23E4917C"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:*","matchCriteriaId":"1196BA40-0A6E-4559-8BD3-05D0976992DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:*","matchCriteriaId":"B3464160-9869-4F32-B5B7-0894A6ECFCD4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:*","matchCriteriaId":"7FB24227-53EC-432D-8B9F-139A5E091C4E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:*","matchCriteriaId":"49D73E89-CED4-4A3F-B3BC-938A901B6C32"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:*","matchCriteriaId":"D33CC082-F221-4153-8B73-3EB81CFD1A69"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:*","matchCriteriaId":"79F19128-0AA4-48D3-9132-C198B9DF15EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:*","matchCriteriaId":"76127766-0FEA-4E80-8809-0D0666BE8478"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:*","matchCriteriaId":"6F08E985-B329-471A-946C-010667A88DD0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:*","matchCriteriaId":"CC5D89D2-4F24-4390-8976-BEE779E96CF8"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:*","matchCriteriaId":"0F203762-BAFC-46AF-B7D6-7A684BCE306E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:*","matchCriteriaId":"FC8C958D-27C4-41E7-9E5B-3610E360DEB9"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:*","matchCriteriaId":"01A15ACF-B11C-461D-A176-334B215880CD"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:*","matchCriteriaId":"8A52AB2E-6F9A-4164-B8AE-3F9B8CBB3BB1"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:*","matchCriteriaId":"3EF70DF2-FDB1-42AB-8F4B-2AFCDF2E6126"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:*","matchCriteriaId":"436796A5-4368-41C5-A5E6-671724A6ED64"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:*","matchCriteriaId":"4F4FDF75-D75B-414A-876E-F88B89FF63EE"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:*","matchCriteriaId":"86312747-04E2-4456-9235-35D5E4824EA0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:*","matchCriteriaId":"DD3EC98B-B7B7-4A8A-AFD6-319B2F09C52D"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:*","matchCriteriaId":"3A1D4F52-83DE-4349-918E-6140C0286739"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:*","matchCriteriaId":"D3636DE2-A5C6-4752-9888-0B554401E4D3"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:*","matchCriteriaId":"3E104532-ED7E-4B5E-AB69-ED638F8E6618"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:*","matchCriteriaId":"1D303F5B-6918-405B-96F0-6110F1A1EA45"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:*","matchCriteriaId":"C034C0A6-8309-4416-97B1-055830F47A60"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:*","matchCriteriaId":"F6F054AC-6A14-43AA-B970-70063EA21D79"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:*","matchCriteriaId":"ED4A980F-AFCB-41E1-81D8-C9049E633960"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:*","matchCriteriaId":"013CAF5F-61D4-40E8-8044-2435F801F4A5"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:*","matchCriteriaId":"0E752CED-4DD8-4E67-91F8-3F1D0F770850"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:*","matchCriteriaId":"1747FC51-16DE-49B3-8EFD-D84F7DC1D3D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:*","matchCriteriaId":"2BAAD17C-E626-4522-9CEA-12EB93B16C37"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:*","matchCriteriaId":"EAE8FBAF-243D-46DB-9F66-18A3BBEC2862"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:*","matchCriteriaId":"961CD0D6-2AFD-4BAD-B677-E5FB1D28E816"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:*","matchCriteriaId":"5387D27F-B59F-4ED6-BAE0-6E8F66A47E28"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:*","matchCriteriaId":"666C06CE-8747-4D58-995C-FE60BFB3A8CC"}]}]}],"references":[{"url":"https://github.com/payloadcms/payload/commit/a8c3a8e8e2680c96ec4f66f5b3854c5df6c35adf","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-9qpg-3cf8-w33x","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105957","sourceIdentifier":"cna@vuldb.com","published":"2026-10-06T17:17:23.500","lastModified":"2026-10-09T02:16:56.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/admin/view_product.php. Performing a manipulation of the argument Category results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Performance Indicator System","cpes":["cpe:2.3:a:sourcecodester:performance_indicator_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:09:05.304118Z","id":"CVE-2026-105957","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/OnlyCMJB/cve/issues/4","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105957","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/993168","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413926","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413926/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-106100","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T17:17:23.957","lastModified":"2026-10-15T00:07:39.960","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to change. The Postgres and SQLite adapters are not affected. This issue is fixed in versions 3.87.0 and 4.0.0-canary.20."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"payloadcms","product":"payload","versions":[{"version":"< 3.87.0","status":"affected"},{"version":">= 4.0.0-canary.0, < 4.0.0-canary.20","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:28:47.529744Z","id":"CVE-2026-106100","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-915"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*","versionEndExcluding":"3.87.0","matchCriteriaId":"9AEDD040-7C2D-4E07-A567-BDD0F8DB10A0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:*","matchCriteriaId":"53DD9574-106C-4C33-A3D6-BFEB23E4917C"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:*","matchCriteriaId":"1196BA40-0A6E-4559-8BD3-05D0976992DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:*","matchCriteriaId":"B3464160-9869-4F32-B5B7-0894A6ECFCD4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:*","matchCriteriaId":"7FB24227-53EC-432D-8B9F-139A5E091C4E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:*","matchCriteriaId":"49D73E89-CED4-4A3F-B3BC-938A901B6C32"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:*","matchCriteriaId":"D33CC082-F221-4153-8B73-3EB81CFD1A69"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:*","matchCriteriaId":"79F19128-0AA4-48D3-9132-C198B9DF15EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:*","matchCriteriaId":"76127766-0FEA-4E80-8809-0D0666BE8478"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:*","matchCriteriaId":"6F08E985-B329-471A-946C-010667A88DD0"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:*","matchCriteriaId":"CC5D89D2-4F24-4390-8976-BEE779E96CF8"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:*","matchCriteriaId":"0F203762-BAFC-46AF-B7D6-7A684BCE306E"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:*","matchCriteriaId":"FC8C958D-27C4-41E7-9E5B-3610E360DEB9"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:*","matchCriteriaId":"01A15ACF-B11C-461D-A176-334B215880CD"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:*","matchCriteriaId":"C034C0A6-8309-4416-97B1-055830F47A60"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:*","matchCriteriaId":"1747FC51-16DE-49B3-8EFD-D84F7DC1D3D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:*","matchCriteriaId":"2BAAD17C-E626-4522-9CEA-12EB93B16C37"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:*","matchCriteriaId":"EAE8FBAF-243D-46DB-9F66-18A3BBEC2862"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:*","matchCriteriaId":"961CD0D6-2AFD-4BAD-B677-E5FB1D28E816"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:*","matchCriteriaId":"5387D27F-B59F-4ED6-BAE0-6E8F66A47E28"},{"vulnerable":true,"criteria":"cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:*","matchCriteriaId":"666C06CE-8747-4D58-995C-FE60BFB3A8CC"}]}]}],"references":[{"url":"https://github.com/payloadcms/payload/commit/2a69863deb0e3c87e36c1b3b17ab2d5b02fcb941","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/payloadcms/payload/commit/8f77dffa9552885ec2710768cfee15b57e389935","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.87.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-4ww4-68q3-h7g5","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106101","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T17:17:24.110","lastModified":"2026-10-06T20:03:40.690","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL() utility in ui/src/utils/open-url/open-url.js trusted window.SafariViewController whenever that global existed in an iOS environment. Attacker-controlled HTML rendered by components such as QEditor can create a named SafariViewController element, causing browser named-property resolution to replace the expected native bridge object. A later openURL() call then invokes isAvailable() on the element, throws a TypeError, and disrupts external navigation, login redirects, payment redirects, and other URL-opening workflows. QSelect and QChatMessage HTML-rendering configurations can expose the same trigger when they render attacker-controlled HTML. This issue is fixed in version 2.32.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"quasarframework","product":"quasar","versions":[{"version":"< 2.32.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:24:41.442349Z","id":"CVE-2026-106101","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-843"}]}],"references":[{"url":"https://github.com/quasarframework/quasar/commit/52d874bf55309dd3656fb02aed033ab025d477ec","source":"security-advisories@github.com"},{"url":"https://github.com/quasarframework/quasar/releases/tag/quasar-v2.32.2","source":"security-advisories@github.com"},{"url":"https://github.com/quasarframework/quasar/security/advisories/GHSA-89vp-x45c-52cq","source":"security-advisories@github.com"},{"url":"https://github.com/quasarframework/quasar/security/advisories/GHSA-89vp-x45c-52cq","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-106102","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T17:17:24.270","lastModified":"2026-10-06T20:03:40.690","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in ui/src/plugins/meta/Meta.js used getAttr() to interpolate values supplied through useMeta() into title, meta, link, and script markup without HTML text or quoted-attribute encoding. injectServerMeta() appended that output to the raw server-rendered response. An attacker who can influence dynamic page metadata, such as a post title, product name, excerpt, or display name, can terminate the intended HTML context and inject executable markup before hydration. The client-side apply() path is not affected because it uses DOM APIs that encode attributes. This issue is fixed in version 2.22.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"quasarframework","product":"quasar","versions":[{"version":"< 2.22.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:38:06.088426Z","id":"CVE-2026-106102","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-116"}]}],"references":[{"url":"https://github.com/quasarframework/quasar/commit/11505afe5b5218f2c468f130181815b898fd1e40","source":"security-advisories@github.com"},{"url":"https://github.com/quasarframework/quasar/releases/tag/quasar-v2.22.0","source":"security-advisories@github.com"},{"url":"https://github.com/quasarframework/quasar/security/advisories/GHSA-pq96-jpmf-w254","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-106218","sourceIdentifier":"cve@jetbrains.com","published":"2026-10-06T17:17:24.433","lastModified":"2026-10-08T14:53:05.853","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains TeamCity before 2026.1.3\n2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible"}],"affected":[{"source":"cve@jetbrains.com","affectedData":[{"vendor":"JetBrains","product":"TeamCity","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.1.3\n2025.11.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@jetbrains.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106218","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@jetbrains.com","type":"Secondary","description":[{"lang":"en","value":"CWE-184"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*","versionEndExcluding":"2025.11.7","matchCriteriaId":"4F865D53-6163-4A62-B8C1-06F45DA28E3C"},{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.1","versionEndExcluding":"2026.1.3","matchCriteriaId":"7182AB10-C869-447B-A128-5B667C2A3940"}]}]}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","source":"cve@jetbrains.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106219","sourceIdentifier":"cve@jetbrains.com","published":"2026-10-06T17:17:24.580","lastModified":"2026-10-08T14:52:30.303","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server"}],"affected":[{"source":"cve@jetbrains.com","affectedData":[{"vendor":"JetBrains","product":"TeamCity","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.2.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@jetbrains.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:16:22.646385Z","id":"CVE-2026-106219","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@jetbrains.com","type":"Secondary","description":[{"lang":"en","value":"CWE-73"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.2.1","matchCriteriaId":"B51C7B5C-8323-4E00-AEB3-1D31AFC1A7EE"}]}]}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","source":"cve@jetbrains.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-95140","sourceIdentifier":"cve@mitre.org","published":"2026-10-06T17:17:28.087","lastModified":"2026-10-06T20:17:35.070","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileController.java. The fileUpload, createFolder and existsFile endpoints accept a \"path\" parameter that is concatenated into the upload base path without validation, allowing unauthenticated attackers to create arbitrary directories and write arbitrary files outside the intended fileDir root via a crafted multipart request"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:41:15.293766Z","id":"CVE-2026-95140","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/sg-summer/cve/issues/4","source":"cve@mitre.org"},{"url":"https://github.com/sg-summer/cve/issues/4","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-95153","sourceIdentifier":"cve@mitre.org","published":"2026-10-06T17:17:28.207","lastModified":"2026-10-06T20:06:12.743","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:01:19.741146Z","id":"CVE-2026-95153","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/lushibin000/CVE/issues/1","source":"cve@mitre.org"},{"url":"https://github.com/lushibin000/CVE/issues/1","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2025-45871","sourceIdentifier":"cve@mitre.org","published":"2026-10-06T18:16:41.890","lastModified":"2026-10-14T13:10:00.187","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing authenticated user to manipulate SQL queries via crafted workflow template name."},{"lang":"es","value":"LogicalDOC Enterprise hasta e incluyendo la versión 9.1.1 es vulnerable a inyección SQL ciega en el componente WorkflowsDataServlet, permitiendo a un usuario autenticado manipular consultas SQL mediante un nombre de plantilla de flujo de trabajo especialmente diseñado."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T14:01:47.239871Z","id":"CVE-2025-45871","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/netero1010/Vulnerability-Disclosure/tree/main/CVE-2025-45871","source":"cve@mitre.org"},{"url":"https://www.logicaldoc.com/","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-101207","sourceIdentifier":"security_alert@emc.com","published":"2026-10-06T18:16:42.173","lastModified":"2026-10-07T04:17:38.120","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"OpenManage Integration","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.7.0 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-101207","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000515026/dsa-2026-442-security-update-for-dell-openmanage-integration-with-microsoft-windows-admin-center","source":"security_alert@emc.com"}]}},{"cve":{"id":"CVE-2026-106103","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T18:16:51.523","lastModified":"2026-10-06T20:17:17.230","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraining the resolved destination to the Quasar project directory. icongenie/lib/utils/get-assets-files.js joined those values with appDir, while icongenie/lib/utils/validate-profile-object.js required only non-empty strings, allowing parent-directory traversal. A developer who runs a crafted profile can cause generated image content to be written or overwritten at any path writable by that user, potentially modifying shell startup files, build scripts, or other executable configuration. This issue is fixed in version 6.1.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"quasarframework","product":"quasar","versions":[{"version":"< 2.22.0","status":"affected"}]},{"vendor":"@quasar","product":"icongenie","versions":[{"version":"< 6.1.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:42:43.611562Z","id":"CVE-2026-106103","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-73"}]}],"references":[{"url":"https://github.com/quasarframework/quasar/commit/87c89a80ec84f1eb7dbe258e5367161b0598ceb3","source":"security-advisories@github.com"},{"url":"https://github.com/quasarframework/quasar/releases/tag/@quasar/icongenie-v6.1.1","source":"security-advisories@github.com"},{"url":"https://github.com/quasarframework/quasar/security/advisories/GHSA-wmpw-j6qv-mw88","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-106104","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T18:16:51.687","lastModified":"2026-10-09T02:16:57.307","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded User-Agent request header to getMatch() in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated unbounded scans. Platform belongs to autoInstalledPlugins, so this parsing occurs before routing for every SSR request. A crafted unauthenticated request containing repeated version tokens without a terminating Safari token causes super-linear backtracking and blocks the Node.js event loop, delaying every other SSR request. SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation targets are not affected because they do not parse an attacker-controlled request header through this path. This issue is fixed in version 2.23.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"quasarframework","product":"quasar","versions":[{"version":"< 2.23.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:18:25.846526Z","id":"CVE-2026-106104","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1333"}]}],"references":[{"url":"https://github.com/quasarframework/quasar/commit/7a954ddafa756afe95c8f633f48ed68a07209d3d","source":"security-advisories@github.com"},{"url":"https://github.com/quasarframework/quasar/releases/tag/quasar-v2.23.3","source":"security-advisories@github.com"},{"url":"https://github.com/quasarframework/quasar/security/advisories/GHSA-68jq-fhch-4xq4","source":"security-advisories@github.com"},{"url":"https://github.com/quasarframework/quasar/security/advisories/GHSA-68jq-fhch-4xq4","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-106105","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T18:16:51.833","lastModified":"2026-10-06T20:03:40.690","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0, the @quasar/ssl-certificate utility cached a combined private key and certificate PEM without explicitly applying owner-only filesystem permissions. Another local user able to read the cache can copy the key and impersonate a development TLS endpoint in an environment that trusts the certificate. The generated certificate was also CA-capable, carried unnecessarily broad key usages, and encoded the IPv6 loopback address as a DNS subject alternative name. This issue is fixed in @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"quasarframework","product":"quasar","versions":[{"version":"< 2.23.3","status":"affected"}]},{"vendor":"@quasar","product":"app-vite","versions":[{"version":"< 3.3.0","status":"affected"}]},{"vendor":"@quasar","product":"cli","versions":[{"version":"< 5.0.4","status":"affected"}]},{"vendor":"@quasar","product":"ssl-certificate","versions":[{"version":"< 2.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:53:50.770402Z","id":"CVE-2026-106105","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-732"}]}],"references":[{"url":"https://github.com/quasarframework/quasar/commit/b719460aa78e88714b8a1b7ca68267234d217575","source":"security-advisories@github.com"},{"url":"https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0","source":"security-advisories@github.com"},{"url":"https://github.com/quasarframework/quasar/releases/tag/@quasar/cli-v5.0.4","source":"security-advisories@github.com"},{"url":"https://github.com/quasarframework/quasar/security/advisories/GHSA-fh39-c73x-5pjv","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-106106","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T18:16:52.030","lastModified":"2026-10-06T20:03:40.690","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError() in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env, request headers, and cookies into the HTTP page returned by serve.devError(), while the development server listened on all interfaces by default. Any network-adjacent client that reaches an SSR or SSG render failure through this development-only error path can obtain shell environment secrets. The renderer escaped only one exact lowercase script closing-tag spelling, so case variants and valid closing-tag delimiter variants in reflected diagnostic data could terminate the script element and inject markup; executing the injected code in a developer browser additionally requires the payload to accompany that developer's request. This issue is fixed in @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"quasarframework","product":"quasar","versions":[{"version":"< 2.23.3","status":"affected"}]},{"vendor":"@quasar","product":"render-ssr-error","versions":[{"version":"< 2.2.4","status":"affected"}]},{"vendor":"@quasar","product":"app-vite","versions":[{"version":"< 3.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T18:22:31.217011Z","id":"CVE-2026-106106","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-497"}]}],"references":[{"url":"https://github.com/quasarframework/quasar/commit/61c2bd8a607785fdade72cce20e8faf1de7eee15","source":"security-advisories@github.com"},{"url":"https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0","source":"security-advisories@github.com"},{"url":"https://github.com/quasarframework/quasar/security/advisories/GHSA-r5mf-4r5x-q78f","source":"security-advisories@github.com"},{"url":"https://github.com/quasarframework/quasar/security/advisories/GHSA-r5mf-4r5x-q78f","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-106107","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T18:16:52.190","lastModified":"2026-10-06T20:17:17.347","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/app-vite SSR and SSG rendering paths interpolated ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides this value with attacker-controlled data can allow a quote to terminate the nonce attribute and inject additional attributes or markup into generated HTML across development and production SSR or SSG output. Cryptographically generated base64 or base64url nonces are not affected because they lack HTML attribute delimiters. This issue is fixed in version 3.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"quasarframework","product":"quasar","versions":[{"version":"< 2.23.4","status":"affected"}]},{"vendor":"@quasar","product":"app-vite","versions":[{"version":"< 3.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:25:52.348218Z","id":"CVE-2026-106107","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-116"}]}],"references":[{"url":"https://github.com/quasarframework/quasar/commit/91271c38859bec51e154b60c24497a637ce903d7","source":"security-advisories@github.com"},{"url":"https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0","source":"security-advisories@github.com"},{"url":"https://github.com/quasarframework/quasar/security/advisories/GHSA-5m6h-8g35-p3m7","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-106109","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T18:16:52.340","lastModified":"2026-10-06T20:17:17.473","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external directories. An unsafe trusted configuration can delete data writable by the build user before compilation begins. No attacker-controlled input reaches build.distDir by default, so exploitation requires compromised or less-trusted automation to influence build configuration, or a developer to run a mistaken configuration. This issue is fixed in version 3.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"quasarframework","product":"quasar","versions":[{"version":">= 2.7.0, < 2.23.3","status":"affected"}]},{"vendor":"@quasar","product":"app-vite","versions":[{"version":">= 1.0.0, < 3.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:43:25.036654Z","id":"CVE-2026-106109","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-73"}]}],"references":[{"url":"https://github.com/quasarframework/quasar/commit/6c009734b406e246a0855ed060e3a822de8aecc1","source":"security-advisories@github.com"},{"url":"https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0","source":"security-advisories@github.com"},{"url":"https://github.com/quasarframework/quasar/security/advisories/GHSA-q9mq-245r-4g93","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-106110","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T18:16:52.490","lastModified":"2026-10-24T01:42:13.327","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCcittCompressor.Initialize does not reserve enough space for the row data and T4 end-of-line codes, and T4BitCompressor.CompressStrip reaches unchecked writes when TiffCompression.CcittGroup3Fax is selected directly or inherited from decoded TIFF metadata. An attacker-controlled encode or decode-and-re-encode flow can write beyond the logical output span, corrupt process memory, and terminate the process. This issue is fixed in version 4.1.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"SixLabors","product":"ImageSharp","versions":[{"version":">= 2.0.0, < 4.1.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:19:23.701254Z","id":"CVE-2026-106110","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:sixlabors:imagesharp:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"3.2.0","matchCriteriaId":"FA378490-EF2F-4A3F-B62B-188E95240AC8"},{"vulnerable":true,"criteria":"cpe:2.3:a:sixlabors:imagesharp:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.1.2","matchCriteriaId":"F920B012-BBFB-40DB-B201-165EBA6645D7"}]}]}],"references":[{"url":"https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/SixLabors/ImageSharp/pull/3187","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106111","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T18:16:52.650","lastModified":"2026-10-24T01:40:37.313","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty ZIP or ZIPS inflate result that is shorter than the EXR block's required size. ZipExrCompression.Decompress reconstructs the returned prefix while ExrDecoderCore processes the full expected block from a buffer obtained through Configuration.Default, allowing bytes retained from a completed prior ImageSharp operation to appear in decoded pixels. Applications that expose pixels or output from the later attacker-controlled EXR decode can disclose process-local image data. This issue is fixed in version 4.1.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"SixLabors","product":"ImageSharp","versions":[{"version":">= 4.0.0, < 4.1.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T18:18:45.477260Z","id":"CVE-2026-106111","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-226"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:sixlabors:imagesharp:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.1.2","matchCriteriaId":"F920B012-BBFB-40DB-B201-165EBA6645D7"}]}]}],"references":[{"url":"https://github.com/SixLabors/ImageSharp/commit/3c43cf583fdd98eff0f451397affaa31c6a2e6b1","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/SixLabors/ImageSharp/commit/6ed2a275217d39301e76df42acec2a9533b39d2b","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/SixLabors/ImageSharp/pull/3187","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-4q3p-rj5x-xv7p","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-4q3p-rj5x-xv7p","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106112","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T18:16:52.810","lastModified":"2026-10-24T01:36:19.840","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ICC LUT16 conversion accepts more than four output channels even though ClutCalculator.Calculate and LutEntryCalculator.CalculateLut store intermediate and output values in Vector4. When DecoderOptions.ColorProfileHandling is set to Convert, a malformed embedded profile can direct interpolation and output-LUT operations to write one float per declared channel beyond the four-float destination. This can corrupt memory and terminate the process; the default Preserve mode does not run ICC conversion. This issue is fixed in version 4.1.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"SixLabors","product":"ImageSharp","versions":[{"version":">= 4.0.0, < 4.1.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T18:21:59.947801Z","id":"CVE-2026-106112","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:sixlabors:imagesharp:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.1.2","matchCriteriaId":"F920B012-BBFB-40DB-B201-165EBA6645D7"}]}]}],"references":[{"url":"https://github.com/SixLabors/ImageSharp/commit/b03f0ed7e5be760eecc740fa53dd166b18ae9b23","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/SixLabors/ImageSharp/pull/3187","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-ffp7-56pq-64mr","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-ffp7-56pq-64mr","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106113","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T18:16:52.953","lastModified":"2026-10-24T01:34:56.670","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image<HalfVector4> and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the resulting value as an unchecked histogram offset, causing an unsafe out-of-range access and process termination. Adaptive Histogram Equalization and AutoLevel are not affected by this report. This issue is fixed in version 4.1.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"SixLabors","product":"ImageSharp","versions":[{"version":">= 2.0.0, < 4.1.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:39:17.492179Z","id":"CVE-2026-106113","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:sixlabors:imagesharp:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"3.2.0","matchCriteriaId":"FA378490-EF2F-4A3F-B62B-188E95240AC8"},{"vulnerable":true,"criteria":"cpe:2.3:a:sixlabors:imagesharp:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.1.2","matchCriteriaId":"F920B012-BBFB-40DB-B201-165EBA6645D7"}]}]}],"references":[{"url":"https://github.com/SixLabors/ImageSharp/commit/c4c4bf292298c026df470db1a17ff826515fd95d","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/SixLabors/ImageSharp/pull/3187","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j3p4-wp97-rph4","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106114","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T18:16:53.100","lastModified":"2026-10-24T01:29:21.463","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dimensions before confirming that the profile contains the declared values. IccDataReader.ReadClutF32 can request a large float array, and earlier public IccProfile.Entries parsing paths can allocate a large jagged representation, from a short truncated profile. In version 4, automatic image conversion reaches the parser when DecoderOptions.ColorProfileHandling is Convert; the default Preserve mode avoids that conversion path. The demonstrated impact is memory pressure and input-validation failure, not unhandled process termination. This issue is fixed in version 4.1.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"SixLabors","product":"ImageSharp","versions":[{"version":">= 1.0.0-beta0001, < 4.1.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:44:02.412151Z","id":"CVE-2026-106114","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-789"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:sixlabors:imagesharp:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"3.2.0","matchCriteriaId":"7DD4E946-B3D3-48B0-A39C-12F48D2D9FBB"},{"vulnerable":true,"criteria":"cpe:2.3:a:sixlabors:imagesharp:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.1.2","matchCriteriaId":"F920B012-BBFB-40DB-B201-165EBA6645D7"}]}]}],"references":[{"url":"https://github.com/SixLabors/ImageSharp/commit/8de892a7623aa8a09ba2333b624c8d2eb98325df","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/SixLabors/ImageSharp/pull/3187","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-gwg2-r3hj-4w44","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-gwg2-r3hj-4w44","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106115","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T18:16:53.250","lastModified":"2026-10-24T01:27:41.513","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block codes beyond that capacity. TiffCcittCompressor.WriteCode performs unchecked writes, and a decode-and-re-encode flow can inherit TiffCompression.CcittGroup4Fax and one-bit metadata from attacker-supplied input. The resulting out-of-bounds writes can corrupt memory and terminate the process. This issue is fixed in version 4.1.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"SixLabors","product":"ImageSharp","versions":[{"version":">= 2.1.0, < 4.1.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:20:30.658521Z","id":"CVE-2026-106115","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:sixlabors:imagesharp:*:*:*:*:*:*:*:*","versionStartIncluding":"2.1.0","versionEndExcluding":"3.2.0","matchCriteriaId":"314C452A-FC62-4DC9-A1AC-E54A76061919"},{"vulnerable":true,"criteria":"cpe:2.3:a:sixlabors:imagesharp:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.1.2","matchCriteriaId":"F920B012-BBFB-40DB-B201-165EBA6645D7"}]}]}],"references":[{"url":"https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/SixLabors/ImageSharp/pull/3187","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106116","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T18:16:53.400","lastModified":"2026-10-24T01:24:27.543","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. When fewer than 20 bytes remain, ExifReader.ReadValue64 returns without advancing the stream or terminating the outer loop, so a small malformed BigTIFF can keep one decoder thread executing for an attacker-controlled duration. This report does not claim worker-pool exhaustion. This issue is fixed in version 4.1.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"SixLabors","product":"ImageSharp","versions":[{"version":">= 2.0.0, < 4.1.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T18:21:43.778832Z","id":"CVE-2026-106116","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-835"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:sixlabors:imagesharp:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"3.2.0","matchCriteriaId":"FA378490-EF2F-4A3F-B62B-188E95240AC8"},{"vulnerable":true,"criteria":"cpe:2.3:a:sixlabors:imagesharp:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.1.2","matchCriteriaId":"F920B012-BBFB-40DB-B201-165EBA6645D7"}]}]}],"references":[{"url":"https://github.com/SixLabors/ImageSharp/commit/92b12d72550ebb6be5b1e22e559c361fd863a6ec","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/SixLabors/ImageSharp/pull/3187","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106117","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T18:16:53.550","lastModified":"2026-10-06T20:03:40.690","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, decoding a strip TIFF using CCITT Group 3 or Modified Huffman compression can pass attacker-expanded runs to BitWriterUtils.WriteBits without first checking the current row width. T4TiffCompression.WritePixelRun can accumulate oversized makeup-code runs, and ModifiedHuffmanTiffCompression.Decompress validates the width only after writing. The unchecked writes can overflow the strip buffer, corrupt heap memory, and terminate the process. This strip-path vulnerability is distinct from the tiled decompressor-width mismatch. This issue is fixed in version 4.1.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"SixLabors","product":"ImageSharp","versions":[{"version":">= 3.0.0, < 4.1.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T18:19:48.989417Z","id":"CVE-2026-106117","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/SixLabors/ImageSharp/commit/e8892ecd8a95dee95c4480fda51cfe0b32f3b846","source":"security-advisories@github.com"},{"url":"https://github.com/SixLabors/ImageSharp/pull/3176","source":"security-advisories@github.com"},{"url":"https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.1","source":"security-advisories@github.com"},{"url":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jj3q-cwqj-842r","source":"security-advisories@github.com"},{"url":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jj3q-cwqj-842r","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-66666","sourceIdentifier":"audit@patchstack.com","published":"2026-10-06T18:16:55.810","lastModified":"2026-10-06T21:17:20.977","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data.\n\nThis issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6 through 6.6.9."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Automattic","product":"WordPress","defaultStatus":"unaffected","versions":[{"version":"7.1","lessThanOrEqual":"7.1.2","versionType":"custom","status":"affected","changes":[{"at":"7.1.3","status":"unaffected"}]},{"version":"7.0","lessThanOrEqual":"7.0.6","versionType":"custom","status":"affected","changes":[{"at":"7.0.7","status":"unaffected"}]},{"version":"6.9","lessThanOrEqual":"6.9.9","versionType":"custom","status":"affected","changes":[{"at":"6.9.10","status":"unaffected"}]},{"version":"6.8","lessThanOrEqual":"6.8.10","versionType":"custom","status":"affected","changes":[{"at":"6.8.11","status":"unaffected"}]},{"version":"6.7","lessThanOrEqual":"6.7.9","versionType":"custom","status":"affected","changes":[{"at":"6.7.10","status":"unaffected"}]},{"version":"6.6","lessThanOrEqual":"6.6.9","versionType":"custom","status":"affected","changes":[{"at":"6.6.10","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T18:21:14.868038Z","id":"CVE-2026-66666","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-201"}]}],"references":[{"url":"https://patchstack.com/articles/wordpress-7-1-3-security-release?_s_id=cve","source":"audit@patchstack.com"},{"url":"https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-7-1-2-sensitive-data-exposure-vulnerability?_s_id=cve","source":"audit@patchstack.com"},{"url":"https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-88252","sourceIdentifier":"secalert@redhat.com","published":"2026-10-06T18:16:56.867","lastModified":"2026-10-20T19:39:08.060","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors (system handles used for open connections). By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connection attempts, an attacker can trigger an unthrottled retry loop. This condition leads to high CPU utilization and stalls the service, preventing legitimate identity and authentication requests from being processed."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T18:20:33.867525Z","id":"CVE-2026-88252","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-835"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:fedoraproject:sssd:2.12.0:*:*:*:*:*:*:*","matchCriteriaId":"3DC51156-297F-4FE9-B867-D51191E0C9CB"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*","matchCriteriaId":"932D137F-528B-4526-9A89-CD59FA1AB0FE"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*","matchCriteriaId":"142AD0DD-4CF3-4D74-9442-459CE3347E3A"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"F4CFF558-3C47-480D-A2F0-BABF26042943"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"7F6FB57C-2BC7-487C-96DD-132683AEB35D"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*","matchCriteriaId":"D65C2163-CFC2-4ABB-8F4E-CB09CEBD006C"}]}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-88252","source":"secalert@redhat.com","tags":["Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479240","source":"secalert@redhat.com","tags":["Exploit","Issue Tracking","Mitigation","Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479240","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-0198","sourceIdentifier":"dsap-vuln-management@google.com","published":"2026-10-06T19:17:38.007","lastModified":"2026-10-06T20:03:40.690","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In is_pd_allowed of gem_msg.c, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"dsap-vuln-management@google.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"Android kernel","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":0.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T18:58:11.052928Z","id":"CVE-2026-0198","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-10-01","source":"dsap-vuln-management@google.com"}]}},{"cve":{"id":"CVE-2026-102322","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:39.420","lastModified":"2026-10-08T13:42:02.410","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-102322","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/527023137","source":"chrome-cve-admin@google.com","tags":["Issue Tracking"]}]}},{"cve":{"id":"CVE-2026-103620","sourceIdentifier":"product-cna@github.com","published":"2026-10-06T19:17:39.700","lastModified":"2026-10-20T19:33:53.047","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required pull-request review but did not restrict branch deletion, this bypassed the review requirement and caused fresh clones and default-branch API requests to use attacker-controlled content. This vulnerability affected supported GitHub Enterprise Server releases in the 3.18, 3.19, 3.20, 3.21, and 3.22 series and was fixed in versions 3.18.16, 3.19.13, 3.20.9, 3.21.7, and 3.22.2. This vulnerability was reported via the GitHub Bug Bounty program."}],"affected":[{"source":"product-cna@github.com","affectedData":[{"vendor":"GitHub","product":"Enterprise Server","defaultStatus":"unknown","versions":[{"version":"3.18.0","lessThan":"3.18.*","versionType":"semver","status":"affected","changes":[{"at":"3.18.16","status":"unaffected"}]},{"version":"3.19.0","lessThan":"3.19.*","versionType":"semver","status":"affected","changes":[{"at":"3.19.13","status":"unaffected"}]},{"version":"3.20.0","lessThan":"3.20.*","versionType":"semver","status":"affected","changes":[{"at":"3.20.9","status":"unaffected"}]},{"version":"3.21.0","lessThan":"3.21.*","versionType":"semver","status":"affected","changes":[{"at":"3.21.7","status":"unaffected"}]},{"version":"3.22.0","lessThan":"3.22.*","versionType":"semver","status":"affected","changes":[{"at":"3.22.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"product-cna@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T16:31:48.617666Z","id":"CVE-2026-103620","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"product-cna@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.18.0","versionEndExcluding":"3.18.16","matchCriteriaId":"7330EE31-D9D4-4A1A-A309-0BBA6B1A1F61"},{"vulnerable":true,"criteria":"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.19.0","versionEndExcluding":"3.19.13","matchCriteriaId":"CB01630F-1BE9-4C86-8D39-882BBD809022"},{"vulnerable":true,"criteria":"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.20.0","versionEndExcluding":"3.20.9","matchCriteriaId":"DA3ED2EC-AE56-49B8-8D85-FC1067BB77AE"},{"vulnerable":true,"criteria":"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.21.0","versionEndExcluding":"3.21.7","matchCriteriaId":"FA92CD39-64B0-4772-B9F5-7D41919297E9"},{"vulnerable":true,"criteria":"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.22.0","versionEndExcluding":"3.22.2","matchCriteriaId":"54896567-4006-4260-93EA-1799EEA0C496"}]}]}],"references":[{"url":"https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.16","source":"product-cna@github.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.13","source":"product-cna@github.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.9","source":"product-cna@github.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.7","source":"product-cna@github.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.2","source":"product-cna@github.com","tags":["Release Notes","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-103778","sourceIdentifier":"security_alert@emc.com","published":"2026-10-06T19:17:39.867","lastModified":"2026-10-20T19:32:00.443","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Command | Configure (DCC), versions prior to 5.2.3.35 contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information disclosure."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Command | Configure (DCC)","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.2.3.35","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.5,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:40:25.287373Z","id":"CVE-2026-103778","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-321"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-798"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:command\\|configure:*:*:*:*:*:*:*:*","versionEndExcluding":"5.2.3.35","matchCriteriaId":"969F4B0E-360C-4074-8477-617434CB29C1"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000502471/dsa-2026-378-security-update-for-dell-command-configure-for-multiple-vulnerabilities","source":"security_alert@emc.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-104073","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-06T19:17:40.143","lastModified":"2026-10-07T15:16:58.313","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the \"Can add custom links\" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template context. Attackers can craft a custom link template embedding request.COOKIES['sessionid'] or a user's API token into an img src URL, which bypasses the clean_html sanitizer and auto-exfiltrates the victim's credentials to an attacker-controlled host when a privileged user views the object, enabling full account takeover."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"netbox-community","product":"netbox","defaultStatus":"unaffected","repo":"https://github.com/netbox-community/netbox","packageURL":"pkg:github/netbox-community/netbox","versions":[{"version":"2.9.5","lessThan":"4.7.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T14:10:41.964266Z","id":"CVE-2026-104073","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-668"}]}],"references":[{"url":"https://github.com/netbox-community/netbox/issues/22607","source":"disclosure@vulncheck.com"},{"url":"https://github.com/netbox-community/netbox/pull/22616","source":"disclosure@vulncheck.com"},{"url":"https://github.com/netbox-community/netbox/releases#release-v4.7.0","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/netbox-session-hijacking-via-custom-links","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-104944","sourceIdentifier":"f23511db-6c3e-4e32-a477-6aa17d310630","published":"2026-10-06T19:17:40.640","lastModified":"2026-10-07T14:17:08.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"TP-Link Tapo\nC500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP\n(TP-Link Device Protocol) daemon. A single unauthenticated UDP datagram can\ncause an invalid indirect call, crashing the main service and resulting in a\ndenial-of-service condition.\n\n\n\n\n\nSuccessful\nexploitation may allow an unauthenticated attacker with network access to the\naffected UDP service to repeatedly crash the TDP daemon, disrupting normal\ndevice operation and availability. No authentication, session establishment, or\npairing is required to trigger the condition."}],"affected":[{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","affectedData":[{"vendor":"TP-Link Systems Inc.","product":"Tapo C500 v2.0","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.3.5 Build 260810","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T14:02:17.137504Z","id":"CVE-2026-104944","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","type":"Secondary","description":[{"lang":"en","value":"CWE-823"}]}],"references":[{"url":"https://www.tp-link.com/en/support/download/tapo-c500/#Firmware-Release-Notes","source":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/download/tapo-c500/#Firmware-Release-Notes","source":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/faq/5327/","source":"f23511db-6c3e-4e32-a477-6aa17d310630"}]}},{"cve":{"id":"CVE-2026-104945","sourceIdentifier":"f23511db-6c3e-4e32-a477-6aa17d310630","published":"2026-10-06T19:17:40.840","lastModified":"2026-10-07T15:17:05.753","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"TP-Link Tapo\nC500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ\nSOAP handlers. An authenticated ONVIF client can submit an excessive number of\npreset-related elements, causing writes beyond the bounds of fixed-size stack\narrays and resulting in a crash of the affected service.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow an authenticated attacker to cause the affected service\nto crash, resulting in a denial-of-service condition. Repeated exploitation may\nrepeatedly disrupt camera management and PTZ-related functionality until the\nservice recovers or restarts."}],"affected":[{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","affectedData":[{"vendor":"TP-Link Systems Inc.","product":"Tapo C500 v2.0","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.3.5 Build 260810","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T14:03:36.570769Z","id":"CVE-2026-104945","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","type":"Secondary","description":[{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://www.tp-link.com/en/support/download/tapo-c500/#Firmware-Release-Notes","source":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/download/tapo-c500/#Firmware-Release-Notes","source":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/faq/5327/","source":"f23511db-6c3e-4e32-a477-6aa17d310630"}]}},{"cve":{"id":"CVE-2026-105485","sourceIdentifier":"security@devolutions.net","published":"2026-10-06T19:17:40.960","lastModified":"2026-10-06T20:17:16.430","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured device verification link by an authenticated victim."}],"affected":[{"source":"security@devolutions.net","affectedData":[{"vendor":"Devolutions","product":"Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.3.8","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:00:13.942836Z","id":"CVE-2026-105485","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@devolutions.net","type":"Secondary","description":[{"lang":"en","value":"CWE-294"}]}],"references":[{"url":"https://devolutions.net/security/advisories/DEVO-2026-0035/","source":"security@devolutions.net"}]}},{"cve":{"id":"CVE-2026-105488","sourceIdentifier":"security@devolutions.net","published":"2026-10-06T19:17:41.087","lastModified":"2026-10-07T16:17:33.933","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vault view permission to modify and delete global contact and folder entries."}],"affected":[{"source":"security@devolutions.net","affectedData":[{"vendor":"Devolutions","product":"Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.3.8","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:17:35.328570Z","id":"CVE-2026-105488","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@devolutions.net","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://devolutions.net/security/advisories/DEVO-2026-0035/","source":"security@devolutions.net"}]}},{"cve":{"id":"CVE-2026-106033","sourceIdentifier":"secalert@redhat.com","published":"2026-10-06T19:17:41.843","lastModified":"2026-10-07T12:17:08.270","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect route. Specifically, the application extracts a target destination from the next query parameter and directly assigns it to the browser's location.href without verifying its format or scheme. The platform includes built-in URL validation functions designed to block malicious URI schemes (such as javascript: and data:) as well as off-site or protocol-relative redirects, this specific route bypasses those controls. Consequently, an attacker can craft a malicious link that, when accessed by an authenticated user, causes arbitrary JavaScript to execute within the context of the user's session."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-24/lightspeed-rhel8","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-25/lightspeed-rhel8","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-26/gateway-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-27/gateway-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-eda-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-gateway","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-platform-ui","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Hardened Images","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-packaging","cpes":["cpe:/a:redhat:hummingbird:1"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:25:55.226022Z","id":"CVE-2026-106033","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-106033","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2546603","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-106118","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T19:17:42.640","lastModified":"2026-10-06T20:17:17.703","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, tiled TIFF decoding allocates a destination buffer using TileWidth but TiffDecompressorsFactory.Create constructs T4, T6, and Modified Huffman decompressors using the full frame width. TiffDecoderCore.DecodeTilesChunky can therefore direct frame-width fax scanlines into a tile-width buffer when TileWidth is smaller than ImageWidth. The mismatch causes attacker-controlled out-of-bounds writes, heap corruption, and process termination even with legal per-row run codes. This tiled-path vulnerability is distinct from oversized CCITT runs in strip decoding. This issue is fixed in version 4.1.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"SixLabors","product":"ImageSharp","versions":[{"version":">= 3.0.0, < 4.1.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:27:52.241408Z","id":"CVE-2026-106118","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/SixLabors/ImageSharp/commit/9ee7d1dd5b62d8c9f16cc755e76828386bc2191f","source":"security-advisories@github.com"},{"url":"https://github.com/SixLabors/ImageSharp/pull/3176","source":"security-advisories@github.com"},{"url":"https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.1","source":"security-advisories@github.com"},{"url":"https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-v76p-62qx-wwq2","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-106119","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T19:17:42.800","lastModified":"2026-10-06T20:17:17.820","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a literal value when multiple users' histories are stored in a shared MongoDB collection. An attacker able to invoke chat-history operations can read, modify, or delete another user's stored conversation. Applications using authenticated, server-controlled string identifiers are not affected. This issue is fixed in version 1.3.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"langchain-ai","product":"langchainjs","versions":[{"version":"< 1.5.14","status":"affected"}]},{"vendor":"@langchain","product":"mongodb","versions":[{"version":"< 1.3.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:45:00.727020Z","id":"CVE-2026-106119","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-943"}]}],"references":[{"url":"https://github.com/langchain-ai/langchainjs/commit/946e3d856ff1f8ce7f7b9374c83f680a6ada79af","source":"security-advisories@github.com"},{"url":"https://github.com/langchain-ai/langchainjs/pull/11672","source":"security-advisories@github.com"},{"url":"https://github.com/langchain-ai/langchainjs/releases/tag/@langchain/mongodb@1.3.1","source":"security-advisories@github.com"},{"url":"https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-m6rx-h84q-8r95","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-106120","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T19:17:42.960","lastModified":"2026-10-09T02:16:57.747","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, enabling ownPropertyOnly does not consistently restrict inherited array indices because negative indexing, .first, .last, the first filter, the last filter, join, reverse, slice, compact, and for-loop iteration can read prototype-provided elements outside readJSProperty(). An attacker who can influence prototype state or inherited array-index data and cause templates to render affected operations can disclose values that ownPropertyOnly is expected to hide. Direct positive indexing and ordinary object prototype reads are blocked, but the alternate array paths remain affected. This issue is fixed in 10.27.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"harttle","product":"liquidjs","versions":[{"version":"< 10.27.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:21:40.881711Z","id":"CVE-2026-106120","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/harttle/liquidjs/commit/552819a84b80c62306fe61072628a756272dc749","source":"security-advisories@github.com"},{"url":"https://github.com/harttle/liquidjs/pull/924","source":"security-advisories@github.com"},{"url":"https://github.com/harttle/liquidjs/releases/tag/v10.27.2","source":"security-advisories@github.com"},{"url":"https://github.com/harttle/liquidjs/security/advisories/GHSA-fwxr-j5w2-587m","source":"security-advisories@github.com"},{"url":"https://github.com/harttle/liquidjs/security/advisories/GHSA-fwxr-j5w2-587m","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-106121","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T19:17:43.193","lastModified":"2026-10-09T18:26:02.737","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read() fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners do not stop at CharacterIterator.DONE. The default DefaultJsonRpcMapper passes JSON-RPC message bodies to this parser for JsonRpcServer and client replies. A truncated string causes the parser to append replacement end markers until heap exhaustion, while a line comment without a terminating newline can keep a thread consuming CPU indefinitely, resulting in denial of service. This issue is fixed in version 5.37.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-java-client","versions":[{"version":"< 5.36.1","status":"affected"}]},{"vendor":"com.rabbitmq","product":"amqp-client","versions":[{"version":"< 5.36.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T18:32:40.985871Z","id":"CVE-2026-106121","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-835"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vmware:rabbitmq_java_client:*:*:*:*:*:*:*:*","versionEndExcluding":"5.37.0","matchCriteriaId":"DA24C4A3-F79F-400D-9CC8-9886341BA95C"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/25fad817291feff3195c32620117d295598f8b41","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/2100","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.37.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-cqgh-8p3p-mx4m","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-cqgh-8p3p-mx4m","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106122","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T19:17:43.467","lastModified":"2026-10-09T18:21:32.203","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.36.0, ValueReader.readShortstr decodes malformed UTF-8 bytes into replacement characters that can re-encode beyond the AMQP shortstr limit enforced by ValueWriter.writeShortstr. An attacker who can submit an RPC message with a malformed echoed property can cause reply publication in RpcServer.mainloop() or tutorial-style consumers to throw an unchecked exception before acknowledgement. The broker requeues the message, allowing the same message to disable replacement consumers until the queue is purged. This issue is fixed in version 5.36.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-java-client","versions":[{"version":"< 5.36.0","status":"affected"}]},{"vendor":"com.rabbitmq","product":"amqp-client","versions":[{"version":"< 5.36.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T18:23:11.530141Z","id":"CVE-2026-106122","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-172"},{"lang":"en","value":"CWE-248"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vmware:rabbitmq_java_client:*:*:*:*:*:*:*:*","versionEndExcluding":"5.36.0","matchCriteriaId":"630BF484-1C1C-4C8B-97A4-92946910A9B9"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/b8bd750fa8c90690e859b18d6343b34421309020","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/2065","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.36.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-7822-rcf6-97fx","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-7822-rcf6-97fx","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106123","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T19:17:43.647","lastModified":"2026-10-19T20:17:46.907","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load() includes the raw uri value in wrapped exceptions when AMQP URI parsing fails. Because the URI may contain a plaintext username and password, startup logs, application performance monitoring systems, CI logs, and copied stack traces can disclose broker credentials to users who should not have access to them. This issue is fixed in version 5.35.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-java-client","versions":[{"version":"< 5.35.0","status":"affected"}]},{"vendor":"com.rabbitmq","product":"amqp-client","versions":[{"version":"< 5.35.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:25:53.529176Z","id":"CVE-2026-106123","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-209"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vmware:rabbitmq_java_client:*:*:*:*:*:*:*:*","versionEndExcluding":"5.35.0","matchCriteriaId":"8737775D-74C2-45DB-ABE2-3F6AC8913678"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/daca1875cdb8b8c0acce78f71103b21a05478446","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/2052","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.35.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-h6w7-qmcm-q6xr","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106179","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:43.807","lastModified":"2026-10-08T13:05:59.020","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"UI misrepresentation in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:43:15.898813Z","id":"CVE-2026-106179","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-451"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553250818","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106180","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:43.927","lastModified":"2026-10-08T13:05:53.960","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Observable discrepancy in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:07:49.112406Z","id":"CVE-2026-106180","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-203"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/517429254","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106181","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:44.043","lastModified":"2026-10-08T13:05:49.020","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect reference resolution in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:35:18.898782Z","id":"CVE-2026-106181","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-706"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/497350668","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106182","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:44.170","lastModified":"2026-10-08T13:05:39.237","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"UI misrepresentation in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:43:35.323094Z","id":"CVE-2026-106182","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-451"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/514078734","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106183","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:44.277","lastModified":"2026-10-08T13:05:24.800","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:39:00.752502Z","id":"CVE-2026-106183","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553154579","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106184","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:44.393","lastModified":"2026-10-08T13:05:16.167","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:08:26.369955Z","id":"CVE-2026-106184","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-908"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/567379988","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106185","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:44.510","lastModified":"2026-10-08T13:04:45.400","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in Viz in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T11:34:53.392199Z","id":"CVE-2026-106185","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/502462485","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106186","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:44.627","lastModified":"2026-10-08T13:04:34.603","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106186","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-427"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/522557469","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106187","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:44.743","lastModified":"2026-10-08T13:07:02.880","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":4.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.6,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:18:59.236991Z","id":"CVE-2026-106187","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/511776800","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106188","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:44.860","lastModified":"2026-10-08T16:17:01.917","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Confused deputy in SignIn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T15:36:59.249878Z","id":"CVE-2026-106188","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-441"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/515477538","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106189","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:44.977","lastModified":"2026-10-08T13:06:50.763","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Code injection in ReaderMode in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T11:20:09.006436Z","id":"CVE-2026-106189","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*","matchCriteriaId":"B5415705-33E5-46D5-8E4D-9EBADC8C5705"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/502034469","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106190","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:45.097","lastModified":"2026-10-08T13:06:43.923","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106190","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Permissions Required","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/566824998","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106191","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:45.207","lastModified":"2026-10-08T13:06:36.927","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106191","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/502282293","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106192","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:45.323","lastModified":"2026-10-08T13:02:53.317","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Information leak in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via physical access. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":4.6,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":0.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:39:41.625211Z","id":"CVE-2026-106192","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*","matchCriteriaId":"B5415705-33E5-46D5-8E4D-9EBADC8C5705"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/524681280","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106193","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:45.443","lastModified":"2026-10-08T13:04:01.513","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106193","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/557729858","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106194","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:45.557","lastModified":"2026-10-08T13:03:54.067","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106194","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/498739277","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106195","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:45.673","lastModified":"2026-10-09T22:16:56.557","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T17:13:03.184167Z","id":"CVE-2026-106195","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553930843","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106196","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:45.787","lastModified":"2026-10-08T17:17:13.400","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in Navigation in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.7},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T16:56:43.063600Z","id":"CVE-2026-106196","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*","matchCriteriaId":"B5415705-33E5-46D5-8E4D-9EBADC8C5705"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/504215649","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106197","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:45.897","lastModified":"2026-10-08T13:03:34.193","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106197","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/560238696","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106198","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:46.020","lastModified":"2026-10-08T16:17:02.097","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.7},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T15:56:46.616306Z","id":"CVE-2026-106198","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/510773353","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106199","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:46.133","lastModified":"2026-10-09T02:16:57.967","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Actor in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.7},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:34:18.199845Z","id":"CVE-2026-106199","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/517703787","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106200","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:46.257","lastModified":"2026-10-08T13:03:15.097","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106200","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/568422505","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106201","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:46.370","lastModified":"2026-10-08T12:13:59.450","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106201","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-362"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/517546096","source":"chrome-cve-admin@google.com","tags":["Exploit","Issue Tracking","Mitigation"]}]}},{"cve":{"id":"CVE-2026-106202","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:46.493","lastModified":"2026-10-08T12:13:13.250","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:23:27.713250Z","id":"CVE-2026-106202","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-908"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553117809","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106203","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:46.603","lastModified":"2026-10-08T12:12:55.903","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incomplete cleanup in Autofill in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:17:09.614120Z","id":"CVE-2026-106203","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-459"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*","matchCriteriaId":"B5415705-33E5-46D5-8E4D-9EBADC8C5705"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553394296","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106204","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:46.723","lastModified":"2026-10-08T12:12:39.303","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106204","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/567910530","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106205","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:46.840","lastModified":"2026-10-08T12:12:27.517","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T19:47:07.014277Z","id":"CVE-2026-106205","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/519499907","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106206","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:46.960","lastModified":"2026-10-08T12:12:12.573","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:23:10.954933Z","id":"CVE-2026-106206","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*","matchCriteriaId":"B5415705-33E5-46D5-8E4D-9EBADC8C5705"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/517374100","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106207","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:47.077","lastModified":"2026-10-08T12:11:54.770","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106207","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-367"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/554619028","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106208","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:47.190","lastModified":"2026-10-11T17:17:01.910","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted Chrome extension. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":4.2},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-11T16:56:13.908387Z","id":"CVE-2026-106208","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/497062057","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106209","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:47.300","lastModified":"2026-10-08T13:03:00.060","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"UI misrepresentation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:43:31.256212Z","id":"CVE-2026-106209","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-451"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*","matchCriteriaId":"B5415705-33E5-46D5-8E4D-9EBADC8C5705"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/518039724","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106210","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:47.413","lastModified":"2026-10-08T14:07:39.717","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Observable discrepancy in Scroll in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:11:38.126227Z","id":"CVE-2026-106210","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-203"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/556304559","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106211","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:47.520","lastModified":"2026-10-08T14:07:24.683","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in TabStrip in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106211","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/562002095","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106212","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:47.640","lastModified":"2026-10-08T14:07:08.240","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:16:56.403857Z","id":"CVE-2026-106212","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/540072162","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106213","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:47.777","lastModified":"2026-10-08T14:06:51.017","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Race condition in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T21:11:18.795171Z","id":"CVE-2026-106213","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-362"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/520153320","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106214","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:47.983","lastModified":"2026-10-07T20:20:44.677","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Information leak in Proxy in Google Chrome on on Windows prior to 155.0.8059.39 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:22:28.338453Z","id":"CVE-2026-106214","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/533493992","source":"chrome-cve-admin@google.com","tags":["Exploit","Issue Tracking","Mitigation"]}]}},{"cve":{"id":"CVE-2026-106215","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:48.103","lastModified":"2026-10-07T20:47:09.767","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:23:33.047469Z","id":"CVE-2026-106215","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-908"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/561066220","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106216","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:48.210","lastModified":"2026-10-09T17:55:56.580","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Cross-site request forgery in ReadingList in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T13:44:45.538575Z","id":"CVE-2026-106216","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/518076654","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106217","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:48.347","lastModified":"2026-10-07T20:49:17.250","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T21:11:22.792030Z","id":"CVE-2026-106217","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/501770489","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106220","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:48.673","lastModified":"2026-10-08T01:26:49.637","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Information leak in Passwords in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:16:50.068434Z","id":"CVE-2026-106220","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/534843648","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106221","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:48.783","lastModified":"2026-10-09T02:16:58.310","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":5.5},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":5.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:36:28.066451Z","id":"CVE-2026-106221","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-441"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/540049672","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106222","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:48.897","lastModified":"2026-10-08T01:26:06.893","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Sync in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:21:59.469290Z","id":"CVE-2026-106222","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/496623893","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106223","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:49.007","lastModified":"2026-10-08T01:24:01.570","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:23:19.778601Z","id":"CVE-2026-106223","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-908"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/501633302","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106224","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:49.117","lastModified":"2026-10-08T01:23:51.640","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:08:52.456466Z","id":"CVE-2026-106224","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/502278429","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106225","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:49.230","lastModified":"2026-10-08T01:23:36.680","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:17:03.630154Z","id":"CVE-2026-106225","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/501805355","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106226","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:49.337","lastModified":"2026-10-07T19:00:21.467","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in Compositing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":4.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.6,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:19:10.345658Z","id":"CVE-2026-106226","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/520573237","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106227","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:49.450","lastModified":"2026-10-07T19:00:31.653","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106227","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/561891645","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106228","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:49.563","lastModified":"2026-10-07T18:04:58.780","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Confused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106228","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-441"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/517689673","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106229","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:49.680","lastModified":"2026-10-07T18:05:04.200","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"UI misrepresentation in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:43:29.365599Z","id":"CVE-2026-106229","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-451"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/521949525","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106230","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:49.800","lastModified":"2026-10-07T18:05:11.613","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect reference resolution in Offline in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:35:14.908380Z","id":"CVE-2026-106230","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-706"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/520507737","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106231","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:49.913","lastModified":"2026-10-07T18:04:34.810","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Dawn in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:23:30.497109Z","id":"CVE-2026-106231","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-908"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553115993","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106232","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:50.023","lastModified":"2026-10-07T15:24:54.783","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"UI misrepresentation in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:43:27.518273Z","id":"CVE-2026-106232","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-451"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/522299740","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106233","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:50.140","lastModified":"2026-10-07T15:25:02.090","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Metrics in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106233","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/565797213","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106234","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:50.250","lastModified":"2026-10-07T15:12:34.970","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106234","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/564085088","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106235","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:50.360","lastModified":"2026-10-07T15:12:20.973","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106235","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/565612897","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106236","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:50.470","lastModified":"2026-10-07T15:12:05.217","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"UI misrepresentation in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:43:08.541662Z","id":"CVE-2026-106236","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-451"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/556233068","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106237","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:50.577","lastModified":"2026-10-09T22:16:56.753","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Information leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":6.0},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T17:16:31.604534Z","id":"CVE-2026-106237","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553255283","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106238","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:50.690","lastModified":"2026-10-07T13:53:39.657","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106238","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-362"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/492374387","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106239","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:50.800","lastModified":"2026-10-07T13:53:26.303","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow in WebGL in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106239","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/546630009","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106240","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:50.913","lastModified":"2026-10-07T13:53:15.467","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106240","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-843"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/567177599","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106241","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:51.030","lastModified":"2026-10-07T13:53:07.810","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Search in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106241","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/501729675","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106242","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:51.143","lastModified":"2026-10-08T12:17:14.147","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Information leak in Omnibox in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via crafted network traffic. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T11:26:31.200455Z","id":"CVE-2026-106242","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/501647772","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106243","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:51.253","lastModified":"2026-10-07T13:52:32.837","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incomplete cleanup in Proxy Auth in Google Chrome prior to 155.0.8059.39 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:40:08.442444Z","id":"CVE-2026-106243","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-459"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/533426590","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106244","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:51.367","lastModified":"2026-10-08T12:17:14.363","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T11:48:44.423209Z","id":"CVE-2026-106244","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/502475175","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106245","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:51.487","lastModified":"2026-10-07T13:40:45.623","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:10:35.993784Z","id":"CVE-2026-106245","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-908"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/550302121","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106246","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:51.600","lastModified":"2026-10-07T13:39:59.720","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:22:16.288693Z","id":"CVE-2026-106246","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/514070956","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106247","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:51.713","lastModified":"2026-10-07T13:39:53.100","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Buffer overflow in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106247","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-122"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/524435922","source":"chrome-cve-admin@google.com","tags":["Patch"]}]}},{"cve":{"id":"CVE-2026-106248","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:51.827","lastModified":"2026-10-07T13:39:48.917","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Bindings in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106248","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/563673584","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106249","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:51.940","lastModified":"2026-10-07T13:39:36.067","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:16:48.228784Z","id":"CVE-2026-106249","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/552440317","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106250","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:52.053","lastModified":"2026-10-07T21:17:12.227","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:24:26.903899Z","id":"CVE-2026-106250","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/502497790","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106251","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:52.173","lastModified":"2026-10-07T13:11:37.410","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"UI misrepresentation in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:43:06.632102Z","id":"CVE-2026-106251","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-451"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/556237314","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106252","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:52.297","lastModified":"2026-10-07T13:12:11.863","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect comparison in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:40:42.719601Z","id":"CVE-2026-106252","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-697"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/513446410","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106253","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:52.413","lastModified":"2026-10-07T13:12:33.450","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:11:13.917220Z","id":"CVE-2026-106253","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/513741326","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106254","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:52.530","lastModified":"2026-10-07T13:16:38.140","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Information leak in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.4,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:21:17.984313Z","id":"CVE-2026-106254","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/557036053","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106255","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:52.640","lastModified":"2026-10-07T13:12:51.230","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106255","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-362"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/559780376","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106256","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:52.760","lastModified":"2026-10-07T13:12:38.510","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Information leak in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:16:41.553063Z","id":"CVE-2026-106256","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553335319","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106257","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:52.873","lastModified":"2026-10-07T13:11:06.250","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in HTML in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106257","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/565674529","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106258","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:53.010","lastModified":"2026-10-08T18:00:52.807","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:19:15.369795Z","id":"CVE-2026-106258","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-908"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553857574","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106259","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:53.153","lastModified":"2026-10-08T18:06:55.297","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:24:13.576597Z","id":"CVE-2026-106259","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/540076586","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106260","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:53.270","lastModified":"2026-10-07T13:54:02.057","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T21:11:09.343604Z","id":"CVE-2026-106260","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/513821237","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106261","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:53.383","lastModified":"2026-10-09T18:15:03.583","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Video in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:23:54.348533Z","id":"CVE-2026-106261","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-908"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/504638005","source":"chrome-cve-admin@google.com","tags":["Issue Tracking"]}]}},{"cve":{"id":"CVE-2026-106262","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:53.593","lastModified":"2026-10-07T13:53:48.437","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incomplete cleanup in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":4.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.6,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:19:06.236794Z","id":"CVE-2026-106262","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-459"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/533066295","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106263","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:53.763","lastModified":"2026-10-08T18:03:43.140","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T19:56:47.126078Z","id":"CVE-2026-106263","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553149001","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106264","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:53.880","lastModified":"2026-10-07T13:53:36.140","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in Web Authentication (Passkeys & Security Keys) in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:22:03.986497Z","id":"CVE-2026-106264","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/533084756","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106265","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:53.990","lastModified":"2026-10-07T13:53:16.650","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"UI misrepresentation in File in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:43:39.085194Z","id":"CVE-2026-106265","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-451"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/380789337","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106266","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:54.110","lastModified":"2026-10-13T18:30:01.820","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T18:37:23.725880Z","id":"CVE-2026-106266","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-441"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/501914204","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106267","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:54.223","lastModified":"2026-10-13T18:29:43.887","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T18:38:50.860729Z","id":"CVE-2026-106267","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/498737756","source":"chrome-cve-admin@google.com","tags":["Exploit","Issue Tracking","Mitigation"]}]}},{"cve":{"id":"CVE-2026-106268","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:54.330","lastModified":"2026-10-07T13:53:03.753","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106268","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/565742177","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106269","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:54.443","lastModified":"2026-10-07T13:52:47.520","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in CSS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106269","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/565742178","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106270","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:54.560","lastModified":"2026-10-07T13:48:25.760","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:22:00.663050Z","id":"CVE-2026-106270","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553269860","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106271","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:54.677","lastModified":"2026-10-08T18:03:58.367","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in Workers in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T19:55:53.806821Z","id":"CVE-2026-106271","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553118313","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106272","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:54.790","lastModified":"2026-10-08T18:00:29.757","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"UI misrepresentation in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially spoof UI elements via crafted network traffic. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:41:13.032837Z","id":"CVE-2026-106272","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-451"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/556259957","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106273","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:54.907","lastModified":"2026-10-08T18:02:55.607","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Video in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:23:25.310425Z","id":"CVE-2026-106273","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-908"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553118338","source":"chrome-cve-admin@google.com","tags":["Exploit","Issue Tracking","Patch"]}]}},{"cve":{"id":"CVE-2026-106274","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:55.023","lastModified":"2026-10-08T18:01:16.190","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:17:07.761451Z","id":"CVE-2026-106274","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-706"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/497842821","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106275","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:55.140","lastModified":"2026-10-08T18:01:31.403","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:23:04.646659Z","id":"CVE-2026-106275","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-908"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/514460295","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106276","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:55.257","lastModified":"2026-10-07T13:48:19.587","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"UI misrepresentation in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:43:23.597030Z","id":"CVE-2026-106276","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-451"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/417555081","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106277","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:55.370","lastModified":"2026-10-07T13:48:11.393","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Information leak in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:29:16.465320Z","id":"CVE-2026-106277","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/517708426","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106278","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:55.487","lastModified":"2026-10-07T13:44:28.620","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Select in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106278","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/565774991","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106279","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:55.603","lastModified":"2026-10-07T13:44:22.817","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect reference resolution in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a local attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.4,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:38:36.236548Z","id":"CVE-2026-106279","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-706"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*","matchCriteriaId":"B5415705-33E5-46D5-8E4D-9EBADC8C5705"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/513757840","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106280","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:55.717","lastModified":"2026-10-09T18:12:46.817","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T15:37:17.812317Z","id":"CVE-2026-106280","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/517366426","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106281","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:55.827","lastModified":"2026-10-07T13:44:17.820","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Tint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106281","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/554992296","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106282","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:55.933","lastModified":"2026-10-07T13:44:02.470","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"UI misrepresentation in WebOTP in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:43:33.422703Z","id":"CVE-2026-106282","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-451"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/514204338","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106283","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:56.047","lastModified":"2026-10-07T13:43:53.113","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Streaming in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106283","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/499468981","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106284","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:56.163","lastModified":"2026-10-08T18:03:20.247","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Printing in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:23:12.670535Z","id":"CVE-2026-106284","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/517804731","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106285","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:56.280","lastModified":"2026-10-07T13:43:43.640","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"UI misrepresentation in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:43:19.798330Z","id":"CVE-2026-106285","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-451"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/533119681","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106286","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:56.387","lastModified":"2026-10-13T18:29:00.757","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Confused deputy in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T19:38:45.669080Z","id":"CVE-2026-106286","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-441"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/497148613","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106287","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:56.497","lastModified":"2026-10-13T19:28:48.607","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Information loss in CORS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T18:36:20.550399Z","id":"CVE-2026-106287","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-221"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/513518289","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106288","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:56.610","lastModified":"2026-10-08T18:11:11.093","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:24:15.298416Z","id":"CVE-2026-106288","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553274076","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106289","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:56.720","lastModified":"2026-10-09T18:11:35.310","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in FedCM in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:25:01.663271Z","id":"CVE-2026-106289","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/517700327","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106290","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:56.830","lastModified":"2026-10-08T17:18:47.107","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:23:17.415418Z","id":"CVE-2026-106290","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-908"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/507351786","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106291","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:56.940","lastModified":"2026-10-07T13:43:38.223","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in GarbageCollection in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106291","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/499571442","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106292","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:57.110","lastModified":"2026-10-07T13:43:30.623","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Buffer overflow in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106292","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-122"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/524587778","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106293","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:57.230","lastModified":"2026-10-07T13:43:24.487","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106293","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-843"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/547343108","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106294","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:57.347","lastModified":"2026-10-13T19:27:00.530","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incomplete cleanup in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T17:11:07.463317Z","id":"CVE-2026-106294","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-459"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/556215048","source":"chrome-cve-admin@google.com","tags":["Issue Tracking"]}]}},{"cve":{"id":"CVE-2026-106295","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:57.463","lastModified":"2026-10-07T13:43:17.460","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Unbounded Element in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":4.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.6,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:19:04.100227Z","id":"CVE-2026-106295","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553138969","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106296","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:57.573","lastModified":"2026-10-08T17:17:47.470","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper privilege management in UI in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:24:11.567926Z","id":"CVE-2026-106296","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/540078886","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106297","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:57.690","lastModified":"2026-10-13T15:06:19.720","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Scheduling in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T18:24:19.800934Z","id":"CVE-2026-106297","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/513735469","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106298","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:57.807","lastModified":"2026-10-07T13:43:11.887","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Chrome Tabs in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106298","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/555932520","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106299","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:57.917","lastModified":"2026-10-08T13:02:21.137","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:24:16.141832Z","id":"CVE-2026-106299","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/519211890","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106300","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:58.030","lastModified":"2026-10-07T18:04:42.327","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Race condition in CacheStorage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:23:22.418633Z","id":"CVE-2026-106300","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-367"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/500106110","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106301","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:58.153","lastModified":"2026-10-08T13:02:13.510","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T19:52:42.698855Z","id":"CVE-2026-106301","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-441"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/523750306","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106302","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:58.297","lastModified":"2026-10-07T13:43:06.523","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"UI misrepresentation in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:43:37.242440Z","id":"CVE-2026-106302","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-451"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/514071472","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106303","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:58.420","lastModified":"2026-10-07T13:42:57.303","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Observable discrepancy in Autofill AI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:35:16.858209Z","id":"CVE-2026-106303","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-203"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/517475258","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106304","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:58.540","lastModified":"2026-10-07T18:04:50.370","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:23:07.531181Z","id":"CVE-2026-106304","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553124799","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106305","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:58.657","lastModified":"2026-10-07T13:42:46.620","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"UI misrepresentation in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:43:12.133553Z","id":"CVE-2026-106305","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-451"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553276352","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106306","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:58.770","lastModified":"2026-10-08T13:02:08.300","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a local attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:24:22.594328Z","id":"CVE-2026-106306","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/513383360","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106307","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:58.887","lastModified":"2026-10-08T13:01:48.647","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T19:54:39.414594Z","id":"CVE-2026-106307","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/537832408","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106308","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:59.007","lastModified":"2026-10-07T13:42:42.003","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect reference resolution in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:17:11.633116Z","id":"CVE-2026-106308","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-706"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/560055258","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106309","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:59.120","lastModified":"2026-10-07T13:42:37.237","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Selection in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:16:52.233945Z","id":"CVE-2026-106309","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*","matchCriteriaId":"B5415705-33E5-46D5-8E4D-9EBADC8C5705"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/503708636","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106310","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:59.230","lastModified":"2026-10-07T18:04:17.790","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use of released resource in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T14:08:19.570401Z","id":"CVE-2026-106310","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-672"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/556250086","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106311","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:59.340","lastModified":"2026-10-07T13:42:32.710","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Clickjacking in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:22:18.236684Z","id":"CVE-2026-106311","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1021"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/514061289","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106312","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:59.460","lastModified":"2026-10-07T13:42:28.280","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:39:23.050044Z","id":"CVE-2026-106312","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/502111211","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106313","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:59.570","lastModified":"2026-10-07T13:42:23.890","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Browser in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.4,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:22:50.309500Z","id":"CVE-2026-106313","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/498770931","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106314","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:59.673","lastModified":"2026-10-07T13:42:19.363","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Bluetooth in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:17:05.872389Z","id":"CVE-2026-106314","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/501533684","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106315","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:59.783","lastModified":"2026-10-07T13:42:15.057","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Modularization in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106315","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/497652727","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106316","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:17:59.890","lastModified":"2026-10-07T13:42:10.327","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"UI misrepresentation in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:43:10.310807Z","id":"CVE-2026-106316","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-451"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/554556423","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106317","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:00.007","lastModified":"2026-10-07T13:42:05.343","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"UI misrepresentation in FullScreen in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:43:21.733666Z","id":"CVE-2026-106317","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-451"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/450323465","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106318","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:00.120","lastModified":"2026-10-07T13:42:00.857","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106318","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/566111249","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106320","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:00.227","lastModified":"2026-10-07T13:38:34.363","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use of released resource in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":4.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.6,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:18:55.500739Z","id":"CVE-2026-106320","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-672"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553929758","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106321","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:00.337","lastModified":"2026-10-07T13:38:40.100","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Information leak in Editing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:16:02.937857Z","id":"CVE-2026-106321","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/556235808","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106322","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:00.450","lastModified":"2026-10-08T18:11:46.010","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Open redirect in AppManifest in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T15:38:45.559799Z","id":"CVE-2026-106322","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-601"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/517213220","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106323","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:00.567","lastModified":"2026-10-07T13:41:49.420","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in Chrome for iOS in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106323","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*","matchCriteriaId":"B5415705-33E5-46D5-8E4D-9EBADC8C5705"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553114676","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106324","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:00.677","lastModified":"2026-10-08T16:17:02.677","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in WebAppInstalls in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T15:38:00.498718Z","id":"CVE-2026-106324","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/501171258","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106325","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:00.783","lastModified":"2026-10-07T13:38:19.733","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect reference resolution in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T21:09:16.710497Z","id":"CVE-2026-106325","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-706"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/556211265","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106326","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:00.900","lastModified":"2026-10-08T16:17:02.897","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Confused deputy in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installed app. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":2.5},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T15:53:55.806366Z","id":"CVE-2026-106326","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-441"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/511745101","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106327","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:01.013","lastModified":"2026-10-14T16:17:31.510","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T15:35:52.474720Z","id":"CVE-2026-106327","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/551529559","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106328","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:01.127","lastModified":"2026-10-07T13:39:02.560","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in PDF in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:23:36.654886Z","id":"CVE-2026-106328","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/518091868","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106329","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:01.243","lastModified":"2026-10-07T13:38:27.537","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106329","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/562043997","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106330","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:01.357","lastModified":"2026-10-07T13:48:06.133","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Information leak in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:16:05.331062Z","id":"CVE-2026-106330","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553135213","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106331","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:01.470","lastModified":"2026-10-13T15:07:09.153","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted Chrome extension. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T17:16:04.982702Z","id":"CVE-2026-106331","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553256068","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106332","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:01.583","lastModified":"2026-10-07T13:48:00.330","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow in Compositing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:10:06.072527Z","id":"CVE-2026-106332","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553454734","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106333","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:01.690","lastModified":"2026-10-09T16:42:05.767","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Input in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:22:10.173117Z","id":"CVE-2026-106333","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/517649552","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106334","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:01.797","lastModified":"2026-10-09T16:41:31.360","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:15:48.174928Z","id":"CVE-2026-106334","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/556229780","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106335","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:01.910","lastModified":"2026-10-07T13:47:53.990","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106335","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/502105238","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106336","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:02.020","lastModified":"2026-10-07T13:47:43.963","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Observable discrepancy in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T21:11:16.952896Z","id":"CVE-2026-106336","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-203"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/522722456","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106337","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:02.123","lastModified":"2026-10-07T13:38:53.227","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"UI misrepresentation in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:43:25.574525Z","id":"CVE-2026-106337","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-451"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553145497","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106338","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:02.237","lastModified":"2026-10-07T13:38:46.120","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"UI misrepresentation in PictureInPicture in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:22:06.004306Z","id":"CVE-2026-106338","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-451"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/448789663","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106339","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:02.347","lastModified":"2026-10-07T13:47:37.547","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use of released resource in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:07:21.704675Z","id":"CVE-2026-106339","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-672"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553913506","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106340","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:02.460","lastModified":"2026-10-14T18:56:02.003","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via physical access. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":4.6,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":0.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:17:51.663714Z","id":"CVE-2026-106340","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/503794852","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106341","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:02.570","lastModified":"2026-10-14T18:55:32.957","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:40:44.769309Z","id":"CVE-2026-106341","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-843"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/558539954","source":"chrome-cve-admin@google.com","tags":["Exploit","Issue Tracking","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106342","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:02.680","lastModified":"2026-10-14T18:53:31.073","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Information leak in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:17:00.478134Z","id":"CVE-2026-106342","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/512998592","source":"chrome-cve-admin@google.com","tags":["Exploit","Issue Tracking","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106343","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:02.790","lastModified":"2026-10-14T18:53:00.117","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper state validation in Autofill AI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:20:18.984170Z","id":"CVE-2026-106343","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-754"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553317583","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106344","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:02.907","lastModified":"2026-10-14T18:52:39.700","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:24:31.242367Z","id":"CVE-2026-106344","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/498375898","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106345","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:03.023","lastModified":"2026-10-14T18:52:26.237","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use of released resource in Session in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":4.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.6,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:17:39.151410Z","id":"CVE-2026-106345","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-672"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/556258544","source":"chrome-cve-admin@google.com","tags":["Exploit","Issue Tracking","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106346","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:03.140","lastModified":"2026-10-14T18:51:41.223","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper state validation in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106346","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-754"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/566404364","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106347","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:03.253","lastModified":"2026-10-14T18:51:21.790","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106347","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/567936270","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106348","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:03.383","lastModified":"2026-10-14T18:51:09.443","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Information leak in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T19:53:37.981381Z","id":"CVE-2026-106348","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/537107728","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106349","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:03.523","lastModified":"2026-10-14T18:50:48.757","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106349","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/567538973","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106350","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:03.640","lastModified":"2026-10-14T18:50:35.310","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:16:46.337575Z","id":"CVE-2026-106350","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553270559","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106351","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:03.803","lastModified":"2026-10-14T18:49:25.127","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:35:11.211570Z","id":"CVE-2026-106351","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-203"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*","matchCriteriaId":"B5415705-33E5-46D5-8E4D-9EBADC8C5705"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553164077","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106352","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:04.033","lastModified":"2026-10-14T18:49:01.577","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in WebProtect in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:16:54.293060Z","id":"CVE-2026-106352","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553139506","source":"chrome-cve-admin@google.com","tags":["Issue Tracking","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106353","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:04.150","lastModified":"2026-10-14T18:47:57.663","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a co-installed app. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:31:22.046472Z","id":"CVE-2026-106353","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*","matchCriteriaId":"B5415705-33E5-46D5-8E4D-9EBADC8C5705"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/502078791","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106354","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:04.267","lastModified":"2026-10-14T18:47:37.067","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper resource exposure in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:08:15.555155Z","id":"CVE-2026-106354","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-668"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/511796554","source":"chrome-cve-admin@google.com","tags":["Exploit","Issue Tracking","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106355","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:04.380","lastModified":"2026-10-14T18:47:08.253","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in Media in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:32:53.233288Z","id":"CVE-2026-106355","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/559777100","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106356","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:04.500","lastModified":"2026-10-14T18:46:32.160","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Clickjacking in EVP in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:22:12.240639Z","id":"CVE-2026-106356","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1021"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/517090646","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106357","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:04.630","lastModified":"2026-10-14T18:46:17.857","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106357","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/567160162","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106358","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:04.740","lastModified":"2026-10-14T18:46:03.907","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Navigation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106358","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/567160164","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106359","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:04.853","lastModified":"2026-10-14T18:45:23.190","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Confused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:29:42.846465Z","id":"CVE-2026-106359","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-441"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/500532594","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106360","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:04.960","lastModified":"2026-10-14T18:45:05.790","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T21:11:14.945429Z","id":"CVE-2026-106360","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/535639435","source":"chrome-cve-admin@google.com","tags":["Exploit","Issue Tracking","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106361","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:05.073","lastModified":"2026-10-14T18:44:24.497","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect provision of specified functionality in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T15:52:33.213147Z","id":"CVE-2026-106361","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-684"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*","matchCriteriaId":"B5415705-33E5-46D5-8E4D-9EBADC8C5705"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/513781133","source":"chrome-cve-admin@google.com","tags":["Exploit","Issue Tracking","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106362","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:05.183","lastModified":"2026-10-14T18:41:11.973","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T17:18:57.937858Z","id":"CVE-2026-106362","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/514456975","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106363","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:05.287","lastModified":"2026-10-14T18:40:55.480","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in FullScreen in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T15:36:16.857272Z","id":"CVE-2026-106363","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/501896592","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106364","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:05.400","lastModified":"2026-10-14T18:40:10.433","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:35:20.886028Z","id":"CVE-2026-106364","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/540018068","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106365","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:05.507","lastModified":"2026-10-14T18:39:51.703","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T18:39:41.143516Z","id":"CVE-2026-106365","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/498075038","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106366","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:05.620","lastModified":"2026-10-14T18:39:36.233","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incomplete cleanup in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-14T12:37:07.482912Z","id":"CVE-2026-106366","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-459"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/552115620","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106367","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:05.737","lastModified":"2026-10-14T18:39:16.443","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a co-installed app. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T19:48:59.849747Z","id":"CVE-2026-106367","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/520533412","source":"chrome-cve-admin@google.com","tags":["Issue Tracking","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106368","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:05.847","lastModified":"2026-10-14T18:38:18.817","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"UI misrepresentation in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:43:13.967042Z","id":"CVE-2026-106368","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-451"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553252261","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106369","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:05.960","lastModified":"2026-10-14T18:37:40.850","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in Translate in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":4.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-11T16:54:46.174654Z","id":"CVE-2026-106369","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/539043243","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106370","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:06.080","lastModified":"2026-10-14T18:37:10.073","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:23:15.275104Z","id":"CVE-2026-106370","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-908"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/517033396","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106371","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:06.190","lastModified":"2026-10-07T13:46:55.640","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Transactions Platform in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:16:43.821456Z","id":"CVE-2026-106371","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553326010","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106372","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:06.300","lastModified":"2026-10-07T13:46:49.840","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106372","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/557288890","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106373","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:06.413","lastModified":"2026-10-07T13:46:33.070","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Fonts in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106373","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/523699645","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106374","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:06.523","lastModified":"2026-10-07T13:46:26.223","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106374","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-843"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/552832446","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106375","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:06.630","lastModified":"2026-10-07T13:46:20.373","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incomplete cleanup in Dawn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106375","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-459"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/536507840","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106376","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:06.743","lastModified":"2026-10-09T16:42:28.237","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:23:35.502927Z","id":"CVE-2026-106376","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-908"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553881031","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106377","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:06.853","lastModified":"2026-10-07T13:46:14.623","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106377","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-362"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/520179149","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106378","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:06.960","lastModified":"2026-10-07T13:45:31.323","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Privilege elevation in Sandbox in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106378","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-250"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/507596239","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106379","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:07.070","lastModified":"2026-10-07T13:45:26.640","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Skia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:09:26.716604Z","id":"CVE-2026-106379","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-908"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/561987051","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106380","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:07.183","lastModified":"2026-10-07T13:45:22.107","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"UI misrepresentation in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:43:17.738752Z","id":"CVE-2026-106380","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-451"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553168380","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106381","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:07.297","lastModified":"2026-10-13T15:06:42.413","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T18:38:12.768176Z","id":"CVE-2026-106381","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*","matchCriteriaId":"B5415705-33E5-46D5-8E4D-9EBADC8C5705"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/501763586","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106382","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:07.400","lastModified":"2026-10-07T13:45:17.947","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Chromecast in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106382","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/534994449","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106383","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:07.517","lastModified":"2026-10-07T13:45:13.630","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106383","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/567447106","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106384","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:07.623","lastModified":"2026-10-09T15:57:06.930","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:27:52.733543Z","id":"CVE-2026-106384","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/554348119","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106385","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:07.740","lastModified":"2026-10-13T15:06:56.140","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Race condition in Chromoting in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T17:12:40.033539Z","id":"CVE-2026-106385","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-362"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/554874487","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106386","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:07.850","lastModified":"2026-10-09T15:56:50.790","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T14:05:20.346452Z","id":"CVE-2026-106386","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-908"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553156221","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]},{"url":"https://issues.chromium.org/issues/553156221","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106387","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:07.960","lastModified":"2026-10-08T17:16:03.890","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:16:58.329779Z","id":"CVE-2026-106387","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*","matchCriteriaId":"B5415705-33E5-46D5-8E4D-9EBADC8C5705"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/518096516","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106388","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:08.073","lastModified":"2026-10-07T13:41:24.140","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in DataTransfer in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:35:13.079280Z","id":"CVE-2026-106388","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/550512266","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106389","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:08.190","lastModified":"2026-10-09T18:10:18.210","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in USB in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T16:48:29.134427Z","id":"CVE-2026-106389","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/503625361","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106390","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:08.310","lastModified":"2026-10-07T13:41:19.557","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect provision of specified functionality in SanitizerAPI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:16:07.347280Z","id":"CVE-2026-106390","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-684"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/556213916","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106391","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:08.420","lastModified":"2026-10-07T13:41:14.517","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in WebShare in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":4.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.6,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:19:08.219135Z","id":"CVE-2026-106391","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/522325665","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106392","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:08.557","lastModified":"2026-10-07T13:41:09.610","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Information leak in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T21:11:20.841707Z","id":"CVE-2026-106392","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/514426571","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106393","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:08.677","lastModified":"2026-10-07T13:41:03.297","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Storage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106393","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/559793873","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106394","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:08.790","lastModified":"2026-10-07T13:40:55.590","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incomplete cleanup in Glic in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T21:11:11.323767Z","id":"CVE-2026-106394","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-459"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/513122002","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106395","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:08.910","lastModified":"2026-10-08T17:14:50.967","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Dawn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:23:10.423350Z","id":"CVE-2026-106395","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-908"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553121488","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106396","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:09.023","lastModified":"2026-10-15T00:01:55.973","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in Omnibox in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.79","matchCriteriaId":"B375BC7C-20ED-409F-BCA1-FAB693090A7C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/552423127","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106397","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:09.150","lastModified":"2026-10-09T18:09:29.970","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T15:37:38.179053Z","id":"CVE-2026-106397","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*","matchCriteriaId":"B5415705-33E5-46D5-8E4D-9EBADC8C5705"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/503725788","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106398","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:09.270","lastModified":"2026-10-07T13:40:47.383","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T21:11:13.176808Z","id":"CVE-2026-106398","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/543082212","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106399","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:09.380","lastModified":"2026-10-08T17:12:12.487","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Skia in Google Chrome prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially read memory via a crafted file. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:45:36.506465Z","id":"CVE-2026-106399","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/530237174","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106400","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:09.493","lastModified":"2026-10-07T13:40:40.330","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Clickjacking in Messages in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:22:08.004427Z","id":"CVE-2026-106400","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1021"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/518108937","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106401","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:09.617","lastModified":"2026-10-07T13:40:34.283","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds write in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106401","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553129739","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106402","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:09.727","lastModified":"2026-10-07T13:40:26.353","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:26:04.049704Z","id":"CVE-2026-106402","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/514041626","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106403","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:09.843","lastModified":"2026-10-09T15:56:35.053","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Accessibility in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T19:51:37.467082Z","id":"CVE-2026-106403","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/523601696","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106404","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:09.960","lastModified":"2026-10-09T15:56:17.073","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T19:57:38.337520Z","id":"CVE-2026-106404","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553150261","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106405","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:10.073","lastModified":"2026-10-09T14:26:34.313","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Race condition in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":0.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T15:46:13.844675Z","id":"CVE-2026-106405","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-367"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/517150523","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106406","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:10.190","lastModified":"2026-10-07T13:40:21.600","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:22:20.278564Z","id":"CVE-2026-106406","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*","matchCriteriaId":"B5415705-33E5-46D5-8E4D-9EBADC8C5705"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/505186109","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106407","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:10.300","lastModified":"2026-10-09T14:26:24.873","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T12:01:43.636444Z","id":"CVE-2026-106407","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/502648640","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106408","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:10.413","lastModified":"2026-10-09T14:26:20.550","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Protection mechanism failure in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T16:41:45.790411Z","id":"CVE-2026-106408","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-693"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*","matchCriteriaId":"B5415705-33E5-46D5-8E4D-9EBADC8C5705"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/504227656","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106409","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:10.523","lastModified":"2026-10-07T13:40:12.403","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect reference resolution in WebAppInstalls in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106409","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-706"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/559097675","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106410","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:10.640","lastModified":"2026-10-07T13:40:01.720","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":4.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.6,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:19:12.509215Z","id":"CVE-2026-106410","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/517801814","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106411","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:10.750","lastModified":"2026-10-07T13:39:57.600","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106411","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/566136674","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106412","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:10.860","lastModified":"2026-10-07T13:39:08.250","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Race condition in Core in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106412","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-367"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/520755056","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106413","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:10.977","lastModified":"2026-10-07T13:12:57.413","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Race condition in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":4.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.6,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:18:57.405216Z","id":"CVE-2026-106413","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-367"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553336689","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106414","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:11.090","lastModified":"2026-10-07T13:13:12.260","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106414","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*","matchCriteriaId":"B5415705-33E5-46D5-8E4D-9EBADC8C5705"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/504223609","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106415","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:11.200","lastModified":"2026-10-07T13:10:55.633","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Information leak in Enterprise in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:16:09.476667Z","id":"CVE-2026-106415","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/502179715","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106416","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:11.317","lastModified":"2026-10-07T13:10:49.933","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Code injection in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:22:14.129942Z","id":"CVE-2026-106416","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/514072462","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106417","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:11.433","lastModified":"2026-10-07T13:10:43.117","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106417","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/536471438","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106418","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:11.557","lastModified":"2026-10-13T15:06:04.690","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T17:14:04.686305Z","id":"CVE-2026-106418","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/553283471","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106419","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:11.670","lastModified":"2026-10-07T13:10:35.167","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in ANGLE in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106419","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/550379413","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106420","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:11.780","lastModified":"2026-10-07T13:10:28.407","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect calculation in API in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:22:22.242026Z","id":"CVE-2026-106420","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-682"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/477327257","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106421","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:11.893","lastModified":"2026-10-07T13:10:20.327","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106421","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/567873463","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106422","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:12.007","lastModified":"2026-10-09T18:06:39.943","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:35:13.556037Z","id":"CVE-2026-106422","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/519458746","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106423","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:12.130","lastModified":"2026-10-07T13:38:55.930","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106423","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/566347711","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106424","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:12.250","lastModified":"2026-10-08T17:10:33.580","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Information leak in Audio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","baseScore":4.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:35:41.070683Z","id":"CVE-2026-106424","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/513365978","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106425","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:12.370","lastModified":"2026-10-13T19:16:17.500","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in BrowserTag in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":4.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-11T16:56:42.589651Z","id":"CVE-2026-106425","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/501790682","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106426","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:12.483","lastModified":"2026-10-07T13:38:48.257","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-106426","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-362"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/547065823","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106427","sourceIdentifier":"chrome-cve-admin@google.com","published":"2026-10-06T19:18:12.600","lastModified":"2026-10-08T18:11:30.287","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Confused deputy in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low)"}],"affected":[{"source":"chrome-cve-admin@google.com","affectedData":[{"vendor":"Google","product":"Chrome","versions":[{"version":"155.0.8059.39","lessThan":"155.0.8059.39","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:24:19.466418Z","id":"CVE-2026-106427","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"chrome-cve-admin@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-441"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","versionEndExcluding":"155.0.8059.39","matchCriteriaId":"A1E74EB4-9805-4076-AADC-E1ADA0BB8EEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*","matchCriteriaId":"B5415705-33E5-46D5-8E4D-9EBADC8C5705"}]}]}],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://issues.chromium.org/issues/513423334","source":"chrome-cve-admin@google.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-106439","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T19:18:12.720","lastModified":"2026-10-06T20:17:25.917","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.7 and 1.4.0.dev10, Hydra stores legacy instantiate target blocklists and related execution-policy collections in mutable module-level state. An attacker who controls multiple sibling target entries can resolve hydra._internal.target_policy.UNCONTROLLED_EXECUTION_TARGETS.discard through instantiate(), remove a denied target, and then invoke that target because sibling nodes are processed in insertion order against the same modified policy. The mutation persists in process-global state and can enable code execution with the application's privileges, while a narrow execution whitelist supplied by trusted Python code is not bypassed by the reported direct mutation path. This issue is fixed in versions 1.3.7 and 1.4.0.dev10."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"hydra-ecosystem","product":"hydra","versions":[{"version":">= 1.3.4, < 1.3.7","status":"affected"},{"version":">= 1.4.0.dev4, < 1.4.0.dev10","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:48:26.207340Z","id":"CVE-2026-106439","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-470"},{"lang":"en","value":"CWE-693"}]}],"references":[{"url":"https://github.com/hydra-ecosystem/hydra/commit/0dd18084589a3d3e577d1f1a8a48fb485c94a5e6","source":"security-advisories@github.com"},{"url":"https://github.com/hydra-ecosystem/hydra/commit/4720dfca2bde27fa140ec287a05709668fbdf168","source":"security-advisories@github.com"},{"url":"https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.7","source":"security-advisories@github.com"},{"url":"https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-mwj6-rfh8-7qf4","source":"security-advisories@github.com"},{"url":"https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-mwj6-rfh8-7qf4","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-106440","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T19:18:12.877","lastModified":"2026-10-09T02:16:59.577","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Hydra is a framework for elegantly configuring complex applications. From 1.2.0 until 1.3.0 and 1.4.0.dev10, the hydra-optuna-sweeper package accepts a configuration-controlled dotted path in hydra.sweeper.custom_search_space, resolves it with hydra.utils.get_method(), and later invokes the returned callable in the Hydra controller process. Because get_method() is a trusted-input lookup helper and does not apply the execution policy used by instantiate(), an attacker who controls Optuna sweep configuration or command-line overrides can select importable Python code for execution with the application's privileges, including bypassing a trusted execution whitelist on affected Hydra 1.4 development releases. This issue is fixed in versions 1.3.0 and 1.4.0.dev10."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"hydra-ecosystem","product":"hydra","versions":[{"version":">= 1.2.0, < 1.3.0","status":"affected"},{"version":">= 1.4.0.dev4, < 1.4.0.dev10","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:39:29.434404Z","id":"CVE-2026-106440","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-470"}]}],"references":[{"url":"https://github.com/hydra-ecosystem/hydra/commit/0dd18084589a3d3e577d1f1a8a48fb485c94a5e6","source":"security-advisories@github.com"},{"url":"https://github.com/hydra-ecosystem/hydra/commit/4720dfca2bde27fa140ec287a05709668fbdf168","source":"security-advisories@github.com"},{"url":"https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.7","source":"security-advisories@github.com"},{"url":"https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-5jjj-9xc3-rm56","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-106441","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T19:18:13.020","lastModified":"2026-10-07T19:17:32.150","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.6 and 1.4.0.dev9, Hydra passes Python logging configuration to logging.config.dictConfig() without applying Hydra's target policy to handler class values or formatter, filter, handler, queue, and listener factories. An attacker who controls Hydra logging configuration can therefore select an importable class or factory and cause it to be invoked with the application's privileges, even in versions where instantiate() is protected because the logging path does not use instantiate(). This issue is fixed in versions 1.3.6 and 1.4.0.dev9."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"hydra-ecosystem","product":"hydra","versions":[{"version":"< 1.3.6","status":"affected"},{"version":">= 1.4.0.dev0, < 1.4.0.dev9","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T18:49:11.628391Z","id":"CVE-2026-106441","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/hydra-ecosystem/hydra/commit/76bfc30ce1f3105416941dd2e3a562568e369120","source":"security-advisories@github.com"},{"url":"https://github.com/hydra-ecosystem/hydra/commit/ff3e4dba890c29a21d8c2bb867ee87d37ccf21d0","source":"security-advisories@github.com"},{"url":"https://github.com/hydra-ecosystem/hydra/pull/3420","source":"security-advisories@github.com"},{"url":"https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-c3wx-c55w-pxjq","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-106442","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T19:18:13.170","lastModified":"2026-10-07T15:17:11.900","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.6 and 1.4.0.dev9, the instantiate() target blacklist introduced for CVE-2026-68508 incompletely checks the effective callable selected by the target field. Execution wrappers such as timeit.timeit, executable deserialization through pickle.loads, aliases, callable-returning helpers, generic dispatch, and deferred calls can obscure or defer the effective target and bypass name-based authorization. An attacker who causes an application to instantiate untrusted Hydra configuration can use these gaps to execute code with the application's privileges. This issue is fixed in versions 1.3.6 and 1.4.0.dev9."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"hydra-ecosystem","product":"hydra","versions":[{"version":">= 1.3.4, < 1.3.6","status":"affected"},{"version":">= 1.4.0.dev0, < 1.4.0.dev9","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T14:12:56.490404Z","id":"CVE-2026-106442","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-184"}]}],"references":[{"url":"https://github.com/hydra-ecosystem/hydra/commit/2c82bbb3f39603b336cb852461739fdf7a38798a","source":"security-advisories@github.com"},{"url":"https://github.com/hydra-ecosystem/hydra/commit/f462811117b5ecfd2ed652ed52d6b4e3771bd943","source":"security-advisories@github.com"},{"url":"https://github.com/hydra-ecosystem/hydra/pull/3412","source":"security-advisories@github.com"},{"url":"https://github.com/hydra-ecosystem/hydra/pull/3413","source":"security-advisories@github.com"},{"url":"https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.6","source":"security-advisories@github.com"},{"url":"https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-rqx7-p7vv-w7hr","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-106443","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T19:18:13.327","lastModified":"2026-10-06T20:17:26.023","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"WeasyPrint helps web developers to create PDF documents. Prior to 70.0, the image-loading path in weasyprint/images.py passes fetched image bytes from HTML img URLs, CSS image values, SVG image references, and data URIs to Pillow's generic image dispatcher without excluding EPS or PostScript formats. On hosts with Ghostscript installed, Pillow EpsImagePlugin invokes the interpreter for attacker-controlled PostScript, which can produce interpreter-permitted effects and can lead to remote code execution when the installed Ghostscript version has a usable sandbox bypass. Hosts without Ghostscript do not reach this rasterization path. This issue is fixed in version 70.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Kozea","product":"WeasyPrint","versions":[{"version":"< 70.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:27:04.747147Z","id":"CVE-2026-106443","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://github.com/Kozea/WeasyPrint/commit/39cd37ce1610bd890388e26591c569db1cbab542","source":"security-advisories@github.com"},{"url":"https://github.com/Kozea/WeasyPrint/releases/tag/v70.0","source":"security-advisories@github.com"},{"url":"https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-r543-q48m-4c9j","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-106511","sourceIdentifier":"cret@cert.org","published":"2026-10-06T19:18:13.500","lastModified":"2026-10-07T18:17:16.800","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. This vulnerability allows the Proposer role to move funds alone, draining 100% of a contract's EGLD/ESDT balance in two transactions with zero signatures."}],"affected":[{"source":"cret@cert.org","affectedData":[{"vendor":"MultiversX Labs S.R.L.","product":"multisig-improved","versions":[{"version":"GitHub commit 2e6dbea40f9b8ac165572a9efd4304804762a299","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T17:53:21.355591Z","id":"CVE-2026-106511","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-862"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://gist.github.com/x01griax/c03f4be898dc55ccf3bab667c83c7312","source":"cret@cert.org"},{"url":"https://github.com/multiversx/mx-multisig-and-modules","source":"cret@cert.org"},{"url":"https://gist.github.com/x01griax/c03f4be898dc55ccf3bab667c83c7312","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-106512","sourceIdentifier":"5a6e4751-2f3f-4070-9419-94fb35b644e8","published":"2026-10-06T19:18:13.637","lastModified":"2026-10-07T17:16:50.110","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection vectors exist in the unpatched code. First, if the filename contains C0 control characters (CR or LF), PHP refuses to emit the entire Content-Disposition header, silently dropping the attachment disposition. The response body is then served with its own Content-Type (for example text/html for an .html attachment) and renders inline in the browser on the application origin, creating a stored cross-site scripting condition. The commit message notes this is reachable even when the download_attachments_on_load setting is enabled, meaning a victim merely needs to view a page that triggers the download. Second, a double-quote character in the filename terminates the quoted-string value early, permitting injection of additional Content-Disposition parameters. The affected code path covers all callers of CakeResponse::download(), including attribute downloads, proposal downloads, and restSearch exports. An authenticated user who can create or upload an attachment with a crafted filename (for example through MISP attribute naming or proposal attachment naming) can store the malicious filename. When any other authenticated user views the affected page, the unsanitized filename is reflected into the HTTP response header, resulting in header manipulation and potential execution of arbitrary HTML or JavaScript in the context of the application origin. The security impact is equivalent to a stored cross-site scripting vulnerability, allowing session hijacking, data exfiltration, and unauthorized actions on behalf of the victim."}],"affected":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","affectedData":[{"vendor":"MISP","product":"sachertortephp","cpes":["cpe:2.3:a:misp:sachertortephp_\\(cakephp-based_misp_application\\):*:*:*:*:*:*:*:*"],"modules":["CakeResponse::download()"],"programFiles":["lib/Cake/Network/CakeResponse.php"],"repo":"https://github.com/MISP/sachertortephp","versions":[{"version":"0","lessThanOrEqual":"1c2da20cbe3f1e2a91458fe9a017823b7273fdac","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","ssvcData":{"timestamp":"2026-10-06T18:44:54Z","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"Supplier","version":"2.0.3"}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T16:31:14.176143Z","id":"CVE-2026-106512","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-113"}]}],"references":[{"url":"https://github.com/MISP/sachertortephp/commit/afbc551aa6b8aedb87dfa1223a388e9a3178abfd","source":"5a6e4751-2f3f-4070-9419-94fb35b644e8"},{"url":"https://github.com/MISP/sachertortephp/commit/e2c80021729611922817a57d2317b2ffa7ed1439","source":"5a6e4751-2f3f-4070-9419-94fb35b644e8"}]}},{"cve":{"id":"CVE-2026-106513","sourceIdentifier":"5a6e4751-2f3f-4070-9419-94fb35b644e8","published":"2026-10-06T19:18:13.933","lastModified":"2026-10-07T17:16:50.387","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin—through its web UI and API to site-admin users. The background job workers trust raw Redis job payloads without additional validation. An attacker who obtains a hijacked site-admin session (for example, through a stored cross-site scripting vulnerability) can modify the Redis host settings to point at an attacker-controlled Redis server and then restart the workers. Once the workers connect to the attacker's Redis instance, the attacker can inject malicious job payloads that the workers execute, achieving arbitrary command execution as the worker account. Additionally, the download_attachments_on_load setting, which controls inline attachment rendering, was modifiable through the same interface, allowing a hijacked session to re-enable a feature that could facilitate further client-side attacks. The vulnerability requires site-admin privileges and a prior session-compromise mechanism; it does not require unauthenticated access. The impact is remote code execution in the context of the MISP worker process and potential data exfiltration through the attacker-controlled Redis connection."}],"affected":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","affectedData":[{"vendor":"MISP","product":"MISP","defaultStatus":"unaffected","cpes":["cpe:2.3:a:misp:misp_\\(malware_information_sharing_platform\\):*:*:*:*:*:*:*:*"],"modules":["Server settings (app/Model/Server.php)","MISP.redis_host","Plugin.ZeroMQ_redis_host","SimpleBackgroundJobs.redis_host","download_attachments_on_load"],"programFiles":["app/Model/Server.php"],"repo":"https://github.com/MISP/MISP","versions":[{"version":"0","lessThanOrEqual":"2.5.48","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","ssvcData":{"timestamp":"2026-10-06T18:56:14Z","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"Supplier","version":"2.0.3"}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T16:30:36.726944Z","id":"CVE-2026-106513","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","description":[{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-749"}]}],"references":[{"url":"https://github.com/MISP/MISP/commit/2ebf29f93","source":"5a6e4751-2f3f-4070-9419-94fb35b644e8"}]}},{"cve":{"id":"CVE-2026-55307","sourceIdentifier":"dsap-vuln-management@google.com","published":"2026-10-06T19:18:14.633","lastModified":"2026-10-06T20:03:40.690","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In kdn_set_sysregs_prot of hwcrypto-kdn.c, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"dsap-vuln-management@google.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"Android kernel","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":0.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T18:57:35.470935Z","id":"CVE-2026-55307","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-10-01","source":"dsap-vuln-management@google.com"}]}},{"cve":{"id":"CVE-2026-55330","sourceIdentifier":"dsap-vuln-management@google.com","published":"2026-10-06T19:18:14.810","lastModified":"2026-10-07T04:18:09.707","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In BluetoothCccHandlerCallbackImpl of bluetooth_ccc.cc, there is a possible use-after-free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"dsap-vuln-management@google.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"Android kernel","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-55330","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-10-01","source":"dsap-vuln-management@google.com"}]}},{"cve":{"id":"CVE-2026-56906","sourceIdentifier":"dsap-vuln-management@google.com","published":"2026-10-06T19:18:14.920","lastModified":"2026-10-07T04:18:09.973","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In ep_free of eventpoll.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"dsap-vuln-management@google.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"Android kernel","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-56906","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-362"}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-10-01","source":"dsap-vuln-management@google.com"}]}},{"cve":{"id":"CVE-2026-56936","sourceIdentifier":"dsap-vuln-management@google.com","published":"2026-10-06T19:18:15.093","lastModified":"2026-10-06T20:03:40.690","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In wacom_hid_set_device_mode of wacom_sys.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"dsap-vuln-management@google.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"Android kernel","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T18:54:38.594533Z","id":"CVE-2026-56936","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-119"}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-10-01","source":"dsap-vuln-management@google.com"}]}},{"cve":{"id":"CVE-2026-56952","sourceIdentifier":"dsap-vuln-management@google.com","published":"2026-10-06T19:18:15.263","lastModified":"2026-10-07T04:18:10.160","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In platform_msg_handler_init of default_msg_handlers.c, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"dsap-vuln-management@google.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"Android kernel","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-56952","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-10-01","source":"dsap-vuln-management@google.com"}]}},{"cve":{"id":"CVE-2026-63697","sourceIdentifier":"security_alert@emc.com","published":"2026-10-06T19:18:15.447","lastModified":"2026-10-13T19:15:22.307","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell System Update, versions prior to 2.3.0.0, contains an Improper Certificate Validation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"System Update","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.3.0.0 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:22:29.866444Z","id":"CVE-2026-63697","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-295"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:system_update:*:*:*:*:*:*:*:*","versionEndExcluding":"2.3.0.0","matchCriteriaId":"D8F728CF-DA42-4D64-9091-4A7FE91712A6"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000515843/dsa-2026-324-security-update-for-dell-system-update-dsu-vulnerabilities","source":"security_alert@emc.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-70414","sourceIdentifier":"security_alert@emc.com","published":"2026-10-06T19:18:15.713","lastModified":"2026-10-13T18:55:17.347","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain a Plaintext Storage of Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Command | Configure (DCC)","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.2.3.35","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T14:09:50.331834Z","id":"CVE-2026-70414","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-256"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:command\\|configure:*:*:*:*:*:*:*:*","versionEndExcluding":"5.2.3.35","matchCriteriaId":"969F4B0E-360C-4074-8477-617434CB29C1"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000502471/dsa-2026-378-security-update-for-dell-command-configure-for-multiple-vulnerabilities","source":"security_alert@emc.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-71168","sourceIdentifier":"security_alert@emc.com","published":"2026-10-06T19:18:15.847","lastModified":"2026-10-13T18:44:27.467","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Remote execution."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"System Update","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.3.0.0 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.3,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T18:23:35.694227Z","id":"CVE-2026-71168","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:system_update:*:*:*:*:*:*:*:*","versionEndExcluding":"2.3.0.0","matchCriteriaId":"D8F728CF-DA42-4D64-9091-4A7FE91712A6"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000515843/dsa-2026-324-security-update-for-dell-system-update-dsu-vulnerabilities","source":"security_alert@emc.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-82162","sourceIdentifier":"security_alert@emc.com","published":"2026-10-06T19:18:16.150","lastModified":"2026-10-13T18:23:24.760","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain an Improper Handling of Mixed Encoding vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of Privileges."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Command | Configure (DCC)","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.2.3.35","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:47:09.734451Z","id":"CVE-2026-82162","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-175"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:command\\|configure:*:*:*:*:*:*:*:*","versionEndExcluding":"5.2.3.35","matchCriteriaId":"969F4B0E-360C-4074-8477-617434CB29C1"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000502471/dsa-2026-378-security-update-for-dell-command-configure-for-multiple-vulnerabilities","source":"security_alert@emc.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-83550","sourceIdentifier":"secalert@redhat.com","published":"2026-10-06T19:18:16.280","lastModified":"2026-10-07T21:17:20.537","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in postgres-exporter. Due to the blank import of `net/http/pprof`, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process arguments, full goroutine stacks, and sensitive data like database connection strings or passwords from heap dumps. Additionally, repeated CPU profiling through these endpoints can lead to a denial of service."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Multicluster Global Hub","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9","cpes":["cpe:/a:redhat:multicluster_globalhub"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:03:10.342549Z","id":"CVE-2026-83550","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-489"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-83550","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2526444","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-86360","sourceIdentifier":"security_alert@emc.com","published":"2026-10-06T19:18:16.430","lastModified":"2026-10-13T18:18:06.647","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker. This vulnerability is considered critical because it can be leveraged by an unauthenticated attacker to execute arbitrary code with root privileges. Successful exploitation may allow complete compromise of the vulnerable application and underlying operating system. Dell recommends customers upgrade at the earliest opportunity."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"System Update","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.3.0.0 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:46:46.247708Z","id":"CVE-2026-86360","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:system_update:*:*:*:*:*:*:*:*","versionEndExcluding":"2.3.0.0","matchCriteriaId":"D8F728CF-DA42-4D64-9091-4A7FE91712A6"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000515843/dsa-2026-324-security-update-for-dell-system-update-dsu-vulnerabilities","source":"security_alert@emc.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-86361","sourceIdentifier":"security_alert@emc.com","published":"2026-10-06T19:18:16.567","lastModified":"2026-10-14T18:35:40.290","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"System Update","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.3.0.0 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T17:48:33.926155Z","id":"CVE-2026-86361","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-732"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:system_update:*:*:*:*:*:*:*:*","versionEndExcluding":"2.3.0.0","matchCriteriaId":"D8F728CF-DA42-4D64-9091-4A7FE91712A6"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000515843/dsa-2026-324-security-update-for-dell-system-update-dsu-vulnerabilities","source":"security_alert@emc.com","tags":["Vendor Advisory","Patch"]}]}},{"cve":{"id":"CVE-2026-86362","sourceIdentifier":"security_alert@emc.com","published":"2026-10-06T19:18:16.717","lastModified":"2026-10-14T18:35:29.110","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell System Update, versions prior to 2.3.0.0, contains an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"System Update","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.3.0.0 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:27:02.600182Z","id":"CVE-2026-86362","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:system_update:*:*:*:*:*:*:*:*","versionEndExcluding":"2.3.0.0","matchCriteriaId":"D8F728CF-DA42-4D64-9091-4A7FE91712A6"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000515843/dsa-2026-324-security-update-for-dell-system-update-dsu-vulnerabilities","source":"security_alert@emc.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-96890","sourceIdentifier":"product-cna@github.com","published":"2026-10-06T19:18:17.167","lastModified":"2026-10-09T14:04:56.293","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret scanning validator for GCP service account credentials trusted the token endpoint embedded in a committed credential and issued a request to it without restricting the destination. Exploitation required an authenticated user with permission to push to a repository on an instance with GitHub Advanced Security and secret scanning validity checks enabled, a non-default configuration. This vulnerability affected GitHub Enterprise Server 3.20, 3.21, and 3.22 and was fixed in versions 3.20.9, 3.21.7, and 3.22.2. This vulnerability was reported through the GitHub Bug Bounty program."}],"affected":[{"source":"product-cna@github.com","affectedData":[{"vendor":"GitHub","product":"Enterprise Server","defaultStatus":"unknown","versions":[{"version":"3.20.0","lessThan":"3.20.*","versionType":"semver","status":"affected","changes":[{"at":"3.20.9","status":"unaffected"}]},{"version":"3.21.0","lessThan":"3.21.*","versionType":"semver","status":"affected","changes":[{"at":"3.21.7","status":"unaffected"}]},{"version":"3.22.0","lessThan":"3.22.*","versionType":"semver","status":"affected","changes":[{"at":"3.22.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"product-cna@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T16:32:23.669378Z","id":"CVE-2026-96890","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"product-cna@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.20.0","versionEndExcluding":"3.20.9","matchCriteriaId":"DA3ED2EC-AE56-49B8-8D85-FC1067BB77AE"},{"vulnerable":true,"criteria":"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.21.0","versionEndExcluding":"3.21.7","matchCriteriaId":"FA92CD39-64B0-4772-B9F5-7D41919297E9"},{"vulnerable":true,"criteria":"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.22.0","versionEndExcluding":"3.22.2","matchCriteriaId":"54896567-4006-4260-93EA-1799EEA0C496"}]}]}],"references":[{"url":"https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.9","source":"product-cna@github.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.7","source":"product-cna@github.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.2","source":"product-cna@github.com","tags":["Release Notes","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-9226","sourceIdentifier":"security@devolutions.net","published":"2026-10-06T19:18:19.433","lastModified":"2026-10-07T16:19:13.507","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured login-session token exposed in a redirect URL."}],"affected":[{"source":"security@devolutions.net","affectedData":[{"vendor":"Devolutions","product":"Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.3.8","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:16:40.151787Z","id":"CVE-2026-9226","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@devolutions.net","type":"Secondary","description":[{"lang":"en","value":"CWE-294"}]}],"references":[{"url":"https://devolutions.net/security/advisories/DEVO-2026-0035/","source":"security@devolutions.net"}]}},{"cve":{"id":"CVE-2026-101027","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:08.233","lastModified":"2026-10-15T02:32:39.673","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"When `[migrations] ALLOWED_DOMAINS` was configured, a hostname matching the allow list was accepted without checking its resolved address against the local-network restrictions. A user who can start repository migrations and control the DNS of an allowed hostname could make it resolve to loopback or private addresses and bypass `ALLOW_LOCALNETWORKS = false`, reaching internal services from the Gitea server. Instances without `ALLOWED_DOMAINS` configured are not affected by this specific bypass."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T11:37:40.968109Z","id":"CVE-2026-101027","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-346"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39426","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-fqjr-23c8-gg9m","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-101029","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:08.647","lastModified":"2026-10-15T02:29:40.883","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated was not necessarily the address Git later connected to. A low-privileged user who can create migrations or mirrors could direct the server to internal services, reading from and writing to reachable internal Git or HTTP endpoints. Content from internal responses could additionally be disclosed through migration and mirror error messages."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:17:52.447255Z","id":"CVE-2026-101029","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-209"},{"lang":"en","value":"CWE-367"},{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39010","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/pull/39426","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-6g2h-xpg3-rm48","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Exploit","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-101149","sourceIdentifier":"psirt@arista.com","published":"2026-10-06T20:17:08.773","lastModified":"2026-10-07T13:38:48.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary destinations."}],"affected":[{"source":"psirt@arista.com","affectedData":[{"vendor":"Arista Networks","product":"CloudVision Portal","defaultStatus":"unaffected","platforms":["CloudVision Portal, virtual appliance or physical appliance"],"versions":[{"version":"2026.2.0","versionType":"custom","status":"affected"},{"version":"2026.1.0","lessThanOrEqual":"2026.1.2","versionType":"custom","status":"affected"},{"version":"2025.3.0","lessThanOrEqual":"2025.3.3","versionType":"custom","status":"affected"},{"version":"2020.3.0","lessThan":"2025.3.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","baseScore":4.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:51:08.204808Z","id":"CVE-2026-101149","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@arista.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24802-security-advisory-0186","source":"psirt@arista.com"}]}},{"cve":{"id":"CVE-2026-101150","sourceIdentifier":"psirt@arista.com","published":"2026-10-06T20:17:08.937","lastModified":"2026-10-07T13:38:48.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary destinations."}],"affected":[{"source":"psirt@arista.com","affectedData":[{"vendor":"Arista Networks","product":"CloudVision Portal","defaultStatus":"unaffected","platforms":["CloudVision Portal, virtual appliance or physical appliance"],"versions":[{"version":"2026.2.0","versionType":"custom","status":"affected"},{"version":"2026.1.0","lessThanOrEqual":"2026.1.2","versionType":"custom","status":"affected"},{"version":"2025.3.0","lessThanOrEqual":"2025.3.3","versionType":"custom","status":"affected"},{"version":"2023.3.0","lessThan":"2025.3.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","baseScore":4.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:50:37.698532Z","id":"CVE-2026-101150","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@arista.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24802-security-advisory-0186","source":"psirt@arista.com"}]}},{"cve":{"id":"CVE-2026-101151","sourceIdentifier":"psirt@arista.com","published":"2026-10-06T20:17:09.093","lastModified":"2026-10-07T13:38:48.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, redirects the user's browser to an arbitrary external site upon completion of the authentication process."}],"affected":[{"source":"psirt@arista.com","affectedData":[{"vendor":"Arista Networks","product":"CloudVision Portal","defaultStatus":"unaffected","platforms":["CloudVision Portal, virtual appliance or physical appliance"],"versions":[{"version":"2026.2.0","versionType":"custom","status":"affected"},{"version":"2026.1.0","lessThanOrEqual":"2026.1.2","versionType":"custom","status":"affected"},{"version":"2025.3.0","lessThanOrEqual":"2025.3.3","versionType":"custom","status":"affected"},{"version":"2020.3.0","lessThan":"2025.3.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:50:14.324307Z","id":"CVE-2026-101151","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@arista.com","type":"Secondary","description":[{"lang":"en","value":"CWE-601"}]}],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24803-security-advisory-0187","source":"psirt@arista.com"}]}},{"cve":{"id":"CVE-2026-101152","sourceIdentifier":"psirt@arista.com","published":"2026-10-06T20:17:09.243","lastModified":"2026-10-07T13:38:48.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, causes the identity provider (IdP) to deliver authentication material to an attacker-controlled URL instead of to CloudVision."}],"affected":[{"source":"psirt@arista.com","affectedData":[{"vendor":"Arista Networks","product":"CloudVision Portal","defaultStatus":"unaffected","platforms":["CloudVision Portal, virtual appliance or physical appliance"],"versions":[{"version":"2026.2.0","versionType":"custom","status":"affected"},{"version":"2026.1.0","lessThanOrEqual":"2026.1.2","versionType":"custom","status":"affected"},{"version":"2025.3.0","lessThanOrEqual":"2025.3.3","versionType":"custom","status":"affected"},{"version":"2021.1.0","lessThan":"2025.3.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:49:47.242959Z","id":"CVE-2026-101152","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@arista.com","type":"Secondary","description":[{"lang":"en","value":"CWE-601"}]}],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24803-security-advisory-0187","source":"psirt@arista.com"}]}},{"cve":{"id":"CVE-2026-101153","sourceIdentifier":"psirt@arista.com","published":"2026-10-06T20:17:09.400","lastModified":"2026-10-07T13:38:48.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor."}],"affected":[{"source":"psirt@arista.com","affectedData":[{"vendor":"Arista Networks","product":"CloudVision Portal","defaultStatus":"unaffected","platforms":["CloudVision Portal, virtual appliance or physical appliance"],"versions":[{"version":"2026.2.0","versionType":"custom","status":"affected"},{"version":"2026.1.0","lessThanOrEqual":"2026.1.2","versionType":"custom","status":"affected"},{"version":"2025.3.0","lessThanOrEqual":"2025.3.3","versionType":"custom","status":"affected"},{"version":"2025.2.0","lessThanOrEqual":"2025.2.3","versionType":"custom","status":"affected"},{"version":"2025.1.0","lessThanOrEqual":"2025.1.4","versionType":"custom","status":"affected"},{"version":"2024.3.0","lessThanOrEqual":"2024.3.3","versionType":"custom","status":"affected"}]},{"vendor":"Arista Networks","product":"CloudVision Sensor","defaultStatus":"unaffected","platforms":["CloudVision Sensor"],"versions":[{"version":"1.4.0","lessThanOrEqual":"1.4.2","versionType":"custom","status":"affected"},{"version":"1.3.0","lessThanOrEqual":"1.3.1","versionType":"custom","status":"affected"},{"version":"1.0.0","lessThan":"1.3.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:49:23.342532Z","id":"CVE-2026-101153","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@arista.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24804-security-advisory-0188","source":"psirt@arista.com"}]}},{"cve":{"id":"CVE-2026-101154","sourceIdentifier":"psirt@arista.com","published":"2026-10-06T20:17:09.567","lastModified":"2026-10-07T17:16:45.150","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Network Provisioning Image Repository."}],"affected":[{"source":"psirt@arista.com","affectedData":[{"vendor":"Arista Networks","product":"CloudVision Portal","defaultStatus":"unaffected","platforms":["CloudVision Portal, virtual appliance or physical appliance"],"versions":[{"version":"2026.2.0","versionType":"custom","status":"affected"},{"version":"2026.1.0","lessThanOrEqual":"2026.1.2","versionType":"custom","status":"affected"},{"version":"2025.3.0","lessThanOrEqual":"2025.3.3","versionType":"custom","status":"affected"},{"version":"2018.1.0","lessThan":"2025.3.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T16:29:22.498147Z","id":"CVE-2026-101154","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@arista.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24805-security-advisory-0189","source":"psirt@arista.com"}]}},{"cve":{"id":"CVE-2026-101155","sourceIdentifier":"psirt@arista.com","published":"2026-10-06T20:17:09.703","lastModified":"2026-10-07T13:38:48.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Software Management Studio Software Repository."}],"affected":[{"source":"psirt@arista.com","affectedData":[{"vendor":"Arista Networks","product":"CloudVision Portal","defaultStatus":"unaffected","platforms":["CloudVision Portal, virtual appliance or physical appliance"],"versions":[{"version":"2026.2.0","versionType":"custom","status":"affected"},{"version":"2026.1.0","lessThanOrEqual":"2026.1.2","versionType":"custom","status":"affected"},{"version":"2025.3.0","lessThanOrEqual":"2025.3.3","versionType":"custom","status":"affected"},{"version":"2024.2.0","lessThan":"2025.3.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:01:03.294569Z","id":"CVE-2026-101155","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@arista.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24805-security-advisory-0189","source":"psirt@arista.com"}]}},{"cve":{"id":"CVE-2026-101156","sourceIdentifier":"psirt@arista.com","published":"2026-10-06T20:17:09.837","lastModified":"2026-10-07T13:38:48.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in another authenticated user's browser when that user views or compares the affected configuration. Successful exploitation may allow the attacker to act through the victim's authenticated browser session to access sensitive data, modify configurations, or disrupt managed wireless services."}],"affected":[{"source":"psirt@arista.com","affectedData":[{"vendor":"Arista Networks","product":"CloudVision CUE","defaultStatus":"unaffected","platforms":["CloudVision CUE on-premises, virtual appliance or physical appliance"],"versions":[{"version":"2025.2.0","lessThanOrEqual":"2026.2.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.7,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:04:54.409170Z","id":"CVE-2026-101156","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@arista.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24808-security-advisory-0192","source":"psirt@arista.com"}]}},{"cve":{"id":"CVE-2026-101157","sourceIdentifier":"psirt@arista.com","published":"2026-10-06T20:17:09.983","lastModified":"2026-10-07T13:38:48.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authenticated user views affected content. Successful exploitation may allow the attacker to compromise the victim's authenticated browser session, access sensitive data, modify system state, or disrupt affected services."}],"affected":[{"source":"psirt@arista.com","affectedData":[{"vendor":"Arista Networks","product":"CloudVision CUE","defaultStatus":"unaffected","platforms":["CloudVision CUE on-premises, virtual appliance or physical appliance"],"versions":[{"version":"2021.2.0","lessThanOrEqual":"2026.2.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:05:27.586474Z","id":"CVE-2026-101157","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@arista.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24808-security-advisory-0192","source":"psirt@arista.com"}]}},{"cve":{"id":"CVE-2026-101158","sourceIdentifier":"psirt@arista.com","published":"2026-10-06T20:17:10.127","lastModified":"2026-10-07T13:38:48.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting (XSS). Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting full access to their account and administrative permissions."}],"affected":[{"source":"psirt@arista.com","affectedData":[{"vendor":"Arista Networks","product":"CloudVision Portal","defaultStatus":"unaffected","platforms":["CloudVision Portal on-premises, virtual appliance or physical appliance","CV-CUE on-premises"],"versions":[{"version":"2026.2.0","versionType":"custom","status":"affected"},{"version":"2026.1.0","lessThanOrEqual":"2026.1.2","versionType":"custom","status":"affected"},{"version":"2025.3.0","lessThanOrEqual":"2025.3.3","versionType":"custom","status":"affected"},{"version":"1.0.0","lessThan":"2025.3.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.7,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:51:37.462404Z","id":"CVE-2026-101158","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@arista.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24801-security-advisory-0185","source":"psirt@arista.com"}]}},{"cve":{"id":"CVE-2026-102155","sourceIdentifier":"psirt@arista.com","published":"2026-10-06T20:17:10.400","lastModified":"2026-10-07T13:38:48.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malicious requests, leading to arbitrary local file disclosure and partial denial of service."}],"affected":[{"source":"psirt@arista.com","affectedData":[{"vendor":"Arista Networks","product":"CloudVision CUE","defaultStatus":"unaffected","platforms":["CloudVision CUE on-premises, virtual appliance or physical appliance"],"versions":[{"version":"2021.2.0","lessThanOrEqual":"2026.2.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:01:34.634435Z","id":"CVE-2026-102155","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@arista.com","type":"Secondary","description":[{"lang":"en","value":"CWE-611"}]}],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24806-security-advisory-0190","source":"psirt@arista.com"}]}},{"cve":{"id":"CVE-2026-102156","sourceIdentifier":"psirt@arista.com","published":"2026-10-06T20:17:10.547","lastModified":"2026-10-07T13:38:48.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of Lightweight Directory Access Protocol (LDAP) authentication input may allow an unauthenticated network attacker, under high-complexity conditions, to inject queries against the configured directory service."}],"affected":[{"source":"psirt@arista.com","affectedData":[{"vendor":"Arista Networks","product":"CloudVision CUE","defaultStatus":"unaffected","platforms":["CloudVision CUE on-premises, virtual appliance or physical appliance"],"versions":[{"version":"2021.2.0","lessThanOrEqual":"2026.2.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:04:24.354512Z","id":"CVE-2026-102156","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@arista.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"}]}],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24807-security-advisory-0191","source":"psirt@arista.com"}]}},{"cve":{"id":"CVE-2026-102157","sourceIdentifier":"psirt@arista.com","published":"2026-10-06T20:17:10.700","lastModified":"2026-10-07T13:38:48.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user's transient data."}],"affected":[{"source":"psirt@arista.com","affectedData":[{"vendor":"Arista Networks","product":"CloudVision CUE","defaultStatus":"unaffected","platforms":["CloudVision CUE on-premises, virtual appliance or physical appliance"],"versions":[{"version":"2021.2.0","lessThanOrEqual":"2026.2.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.6,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:01:56.142507Z","id":"CVE-2026-102157","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@arista.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24806-security-advisory-0190","source":"psirt@arista.com"}]}},{"cve":{"id":"CVE-2026-102158","sourceIdentifier":"psirt@arista.com","published":"2026-10-06T20:17:10.837","lastModified":"2026-10-07T13:38:48.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper validation of selected CloudVision CUE application programming interface (API) request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability."}],"affected":[{"source":"psirt@arista.com","affectedData":[{"vendor":"Arista Networks","product":"CloudVision CUE","defaultStatus":"unaffected","platforms":["CloudVision CUE on-premises, virtual appliance or physical appliance"],"versions":[{"version":"2022.2.0","lessThanOrEqual":"2026.2.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:02:19.932346Z","id":"CVE-2026-102158","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@arista.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"}]}],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24806-security-advisory-0190","source":"psirt@arista.com"}]}},{"cve":{"id":"CVE-2026-102159","sourceIdentifier":"psirt@arista.com","published":"2026-10-06T20:17:10.963","lastModified":"2026-10-07T13:38:48.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Successful exploitation may expose sensitive location information or disrupt affected services."}],"affected":[{"source":"psirt@arista.com","affectedData":[{"vendor":"Arista Networks","product":"CloudVision CUE","defaultStatus":"unaffected","platforms":["CloudVision CUE on-premises, virtual appliance or physical appliance"],"versions":[{"version":"2022.3.0","lessThanOrEqual":"2026.2.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:03:00.815750Z","id":"CVE-2026-102159","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@arista.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24806-security-advisory-0190","source":"psirt@arista.com"}]}},{"cve":{"id":"CVE-2026-102160","sourceIdentifier":"psirt@arista.com","published":"2026-10-06T20:17:11.100","lastModified":"2026-10-07T13:38:48.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup request and execute arbitrary commands with the privileges of the affected service."}],"affected":[{"source":"psirt@arista.com","affectedData":[{"vendor":"Arista Networks","product":"CloudVision CUE","defaultStatus":"unaffected","platforms":["CloudVision CUE on-premises, virtual appliance or physical appliance"],"versions":[{"version":"2021.2.0","lessThanOrEqual":"2026.2.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:03:34.193659Z","id":"CVE-2026-102160","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@arista.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24806-security-advisory-0190","source":"psirt@arista.com"}]}},{"cve":{"id":"CVE-2026-102161","sourceIdentifier":"psirt@arista.com","published":"2026-10-06T20:17:11.230","lastModified":"2026-10-07T13:38:48.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers) can forge their source IP address and gain administrative session privileges on the CV-CUE backend."}],"affected":[{"source":"psirt@arista.com","affectedData":[{"vendor":"Arista Networks","product":"CloudVision CUE","defaultStatus":"unaffected","platforms":["CloudVision CUE on-premises, virtual appliance or physical appliance"],"versions":[{"version":"2021.2.0","lessThanOrEqual":"2026.2.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:04:00.722473Z","id":"CVE-2026-102161","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@arista.com","type":"Secondary","description":[{"lang":"en","value":"CWE-290"},{"lang":"en","value":"CWE-798"}]}],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24806-security-advisory-0190","source":"psirt@arista.com"}]}},{"cve":{"id":"CVE-2026-102162","sourceIdentifier":"psirt@arista.com","published":"2026-10-06T20:17:11.377","lastModified":"2026-10-07T13:38:48.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could allow an unauthenticated network-adjacent attacker to send a crafted packet that triggers a stack overflow, resulting in a denial-of-service condition or potentially execute arbitrary code on the device. The wireless gateway service is automatically restarted after a crash, allowing repeated exploitation attempts."}],"affected":[{"source":"psirt@arista.com","affectedData":[{"vendor":"Arista Networks","product":"Wi-Fi Access Points","defaultStatus":"unaffected","platforms":["Wi-Fi Access Points"],"versions":[{"version":"22.0.0","lessThanOrEqual":"22.0.1F-32","versionType":"custom","status":"affected"},{"version":"21.3.0","lessThanOrEqual":"21.3.0M-13","versionType":"custom","status":"affected"},{"version":"1.0.0","lessThan":"21.3.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:05:56.170458Z","id":"CVE-2026-102162","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@arista.com","type":"Secondary","description":[{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24809-security-advisory-0193","source":"psirt@arista.com"}]}},{"cve":{"id":"CVE-2026-102163","sourceIdentifier":"psirt@arista.com","published":"2026-10-06T20:17:11.533","lastModified":"2026-10-07T13:38:48.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency (RF) proximity can send a crafted frame to crash the sensor service, disabling WIPS monitoring on the access point, or potentially achieve remote code execution. No wireless association or authentication is required."}],"affected":[{"source":"psirt@arista.com","affectedData":[{"vendor":"Arista Networks","product":"Wi-Fi Access Points","defaultStatus":"unaffected","platforms":["Wi-Fi Access Points"],"versions":[{"version":"22.0.0","lessThanOrEqual":"22.0.1F-32","versionType":"custom","status":"affected"},{"version":"21.3.0","lessThanOrEqual":"21.3.0M-13","versionType":"custom","status":"affected"},{"version":"1.0.0","lessThan":"21.3.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:07:23.178346Z","id":"CVE-2026-102163","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@arista.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24811-security-advisory-0195","source":"psirt@arista.com"}]}},{"cve":{"id":"CVE-2026-102164","sourceIdentifier":"psirt@arista.com","published":"2026-10-06T20:17:11.667","lastModified":"2026-10-07T13:38:48.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless client associated to the tunnelled SSID can send a crafted packet, causing the access point to reveal memory contents in network traffic. No write primitive or remote code execution is possible."}],"affected":[{"source":"psirt@arista.com","affectedData":[{"vendor":"Arista Networks","product":"Wi-Fi Access Points","defaultStatus":"unaffected","platforms":["Wi-Fi Access Points"],"versions":[{"version":"22.0.0","lessThanOrEqual":"22.0.1F-32","versionType":"custom","status":"affected"},{"version":"21.3.0","lessThanOrEqual":"21.3.0M-13","versionType":"custom","status":"affected"},{"version":"1.0.0","lessThan":"21.3.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:07:46.593021Z","id":"CVE-2026-102164","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@arista.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24812-security-advisory-0196","source":"psirt@arista.com"}]}},{"cve":{"id":"CVE-2026-102165","sourceIdentifier":"psirt@arista.com","published":"2026-10-06T20:17:11.800","lastModified":"2026-10-07T13:38:48.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote code execution. This exploit requires an uncommonly used non-default streaming mode."}],"affected":[{"source":"psirt@arista.com","affectedData":[{"vendor":"Arista Networks","product":"Wi-Fi Access Points","defaultStatus":"unaffected","platforms":["Wi-Fi Access Points"],"versions":[{"version":"22.0.0","lessThanOrEqual":"22.0.1F-32","versionType":"custom","status":"affected"},{"version":"21.3.0","lessThanOrEqual":"21.3.0M-13","versionType":"custom","status":"affected"},{"version":"1.0.0","lessThan":"21.3.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:59:55.213686Z","id":"CVE-2026-102165","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@arista.com","type":"Secondary","description":[{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24814-security-advisory-0198","source":"psirt@arista.com"}]}},{"cve":{"id":"CVE-2026-102167","sourceIdentifier":"psirt@arista.com","published":"2026-10-06T20:17:11.937","lastModified":"2026-10-07T13:38:48.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network segment as the access point's wired uplink."}],"affected":[{"source":"psirt@arista.com","affectedData":[{"vendor":"Arista Networks","product":"Wi-Fi Access Points","defaultStatus":"unaffected","platforms":["Wi-Fi Access Points"],"versions":[{"version":"22.0.0","lessThanOrEqual":"22.0.1F-32","versionType":"custom","status":"affected"},{"version":"21.3.0","lessThanOrEqual":"21.3.0M-13","versionType":"custom","status":"affected"},{"version":"1.0.0","lessThan":"21.3.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:00:24.458435Z","id":"CVE-2026-102167","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@arista.com","type":"Secondary","description":[{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24813-security-advisory-0197","source":"psirt@arista.com"}]}},{"cve":{"id":"CVE-2026-102168","sourceIdentifier":"psirt@arista.com","published":"2026-10-06T20:17:12.067","lastModified":"2026-10-07T13:38:48.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the portal service with a crafted HTTP request. This results in a temporary denial of service until the service automatically restarts. Remote code execution is not possible."}],"affected":[{"source":"psirt@arista.com","affectedData":[{"vendor":"Arista Networks","product":"Wi-Fi Access Points","defaultStatus":"unaffected","platforms":["Wi-Fi Access Points"],"versions":[{"version":"22.0.0","lessThanOrEqual":"22.0.1F-32","versionType":"custom","status":"affected"},{"version":"21.3.0","lessThanOrEqual":"21.3.0M-13","versionType":"custom","status":"affected"},{"version":"1.0.0","lessThan":"21.3.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:06:24.609870Z","id":"CVE-2026-102168","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@arista.com","type":"Secondary","description":[{"lang":"en","value":"CWE-191"}]}],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24810-security-advisory-0194","source":"psirt@arista.com"}]}},{"cve":{"id":"CVE-2026-102169","sourceIdentifier":"psirt@arista.com","published":"2026-10-06T20:17:12.197","lastModified":"2026-10-07T13:38:48.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the portal service with a crafted HTTP request. The service automatically restarts, but a sustained low-rate attack can cause a persistent denial of service of the captive portal. Remote code execution is not possible."}],"affected":[{"source":"psirt@arista.com","affectedData":[{"vendor":"Arista Networks","product":"Wi-Fi Access Points","defaultStatus":"unaffected","platforms":["Wi-Fi Access Points"],"versions":[{"version":"22.0.0","lessThanOrEqual":"22.0.1F-32","versionType":"custom","status":"affected"},{"version":"21.3.0","lessThanOrEqual":"21.3.0M-13","versionType":"custom","status":"affected"},{"version":"1.0.0","lessThan":"21.3.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T20:06:55.662490Z","id":"CVE-2026-102169","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@arista.com","type":"Secondary","description":[{"lang":"en","value":"CWE-476"}]}],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24810-security-advisory-0194","source":"psirt@arista.com"}]}},{"cve":{"id":"CVE-2026-102404","sourceIdentifier":"security@elastic.co","published":"2026-10-06T20:17:12.333","lastModified":"2026-10-13T18:50:46.900","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can submit a specially crafted query that causes uncontrolled memory growth in the query processing engine, resulting in an out-of-memory condition that terminates the Elasticsearch node. The condition can be triggered repeatedly, including by queries embedded in shared resources, causing persistent cluster unavailability."}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Elasticsearch","defaultStatus":"unaffected","versions":[{"version":"8.0.0","lessThanOrEqual":"8.19.22","versionType":"semver","status":"affected"},{"version":"9.0.0","lessThanOrEqual":"9.4.7","versionType":"semver","status":"affected"},{"version":"9.5.0","lessThanOrEqual":"9.5.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:57:13.886439Z","id":"CVE-2026-102404","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.19.23","matchCriteriaId":"0AD1CC1B-04A9-45D0-85E4-C0DAE10E438E"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.4.8","matchCriteriaId":"981FC4D9-6123-4976-859C-26932511601B"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.5.0","versionEndExcluding":"9.5.5","matchCriteriaId":"50BF1B31-EF32-4797-8095-EFD00A168D47"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-185/390859","source":"security@elastic.co","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102406","sourceIdentifier":"security@elastic.co","published":"2026-10-06T20:17:12.480","lastModified":"2026-10-13T18:50:03.820","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, \"tenant\" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation process allowed a user holding delegated Fleet package-management privileges, without direct Elasticsearch administrative privileges, to claim a data stream identifier already in use by another tenant. Because ownership of that identifier was not verified before Fleet applied the uploaded package's generated index and ingest-pipeline settings to already-existing infrastructure, an attacker could redirect an existing tenant's data stream through infrastructure under their control. This exposed the affected tenant's subsequently ingested data to unauthorized disclosure and modification, and prevented that data from reaching its intended destination. Interception could continue even after the malicious package was removed, requiring separate remediation of the affected infrastructure."}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Kibana","defaultStatus":"unaffected","versions":[{"version":"8.14.0","lessThanOrEqual":"8.19.21","versionType":"semver","status":"affected"},{"version":"9.0.0","lessThanOrEqual":"9.4.6","versionType":"semver","status":"affected"},{"version":"9.5.0","lessThanOrEqual":"9.5.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T00:00:00+00:00","id":"CVE-2026-102406","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","versionStartIncluding":"8.14.0","versionEndExcluding":"8.19.22","matchCriteriaId":"2D4E9E70-3390-4E24-86DE-8877F34A03C2"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.4.7","matchCriteriaId":"51B034B7-56C9-4DBE-87EC-7B4268C1B426"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","versionStartIncluding":"9.5.0","versionEndExcluding":"9.5.4","matchCriteriaId":"6309CE44-86CE-4431-9060-25FF2D4E511F"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-4-security-update-esa-2026-187/390860","source":"security@elastic.co","tags":["Vendor Advisory","Mitigation"]}]}},{"cve":{"id":"CVE-2026-102407","sourceIdentifier":"security@elastic.co","published":"2026-10-06T20:17:12.647","lastModified":"2026-10-13T18:48:49.860","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data stream to which they were not otherwise authorized, potentially injecting data into it or affecting its ability to be searched normally. This issue does not allow an attacker to read the contents of a data stream they do not otherwise have access to."}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Elasticsearch","defaultStatus":"unaffected","versions":[{"version":"7.17.5","lessThanOrEqual":"7.17.29","versionType":"semver","status":"affected"},{"version":"8.2.2","lessThanOrEqual":"8.19.18","versionType":"semver","status":"affected"},{"version":"9.0.0","lessThanOrEqual":"9.3.7","versionType":"semver","status":"affected"},{"version":"9.4.0","lessThanOrEqual":"9.4.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:56:21.979941Z","id":"CVE-2026-102407","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"7.17.5","versionEndIncluding":"7.17.29","matchCriteriaId":"8D48BCB0-16CA-4DBC-BB42-45C177EBCDA0"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"8.2.2","versionEndExcluding":"8.19.19","matchCriteriaId":"0FF41451-1E4E-4E72-A667-669AAD3DA284"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.3.8","matchCriteriaId":"EDAA3E3F-D854-4D29-BB31-20A947C9EB1A"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.4.0","versionEndExcluding":"9.4.4","matchCriteriaId":"54F14824-0093-4DA8-95AD-ED8F481722FC"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-188/390861","source":"security@elastic.co","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102408","sourceIdentifier":"security@elastic.co","published":"2026-10-06T20:17:12.777","lastModified":"2026-10-13T18:48:04.190","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators, without validating their computational complexity or bounding their execution time. An authenticated user with read access to any text-based index can submit a specially crafted regular expression that triggers catastrophic backtracking, consuming excessive CPU on Elasticsearch worker threads and degrading query throughput for other tenants on the affected node. The cluster does not crash as a result of this issue."}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Elasticsearch","defaultStatus":"unaffected","versions":[{"version":"8.19.0","lessThanOrEqual":"8.19.21","versionType":"semver","status":"affected"},{"version":"9.1.0","lessThanOrEqual":"9.3.8","versionType":"semver","status":"affected"},{"version":"9.4.0","lessThanOrEqual":"9.4.7","versionType":"semver","status":"affected"},{"version":"9.5.0","lessThanOrEqual":"9.5.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:55:55.653697Z","id":"CVE-2026-102408","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-1333"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"8.19.0","versionEndExcluding":"8.19.22","matchCriteriaId":"63FE0CC1-F119-4FAB-9518-7705F33A7A3D"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.1.0","versionEndExcluding":"9.4.8","matchCriteriaId":"1046DBFA-B87B-49E0-A3F8-DFDF8AFFD15C"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.5.0","versionEndExcluding":"9.5.5","matchCriteriaId":"50BF1B31-EF32-4797-8095-EFD00A168D47"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-8-and-9-5-5-security-update-esa-2026-189/390862","source":"security@elastic.co","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102409","sourceIdentifier":"security@elastic.co","published":"2026-10-06T20:17:12.907","lastModified":"2026-10-13T18:40:20.810","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (CAPEC-130)."}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Elasticsearch","defaultStatus":"unaffected","versions":[{"version":"9.2.0","lessThanOrEqual":"9.2.8","versionType":"semver","status":"affected"},{"version":"9.3.0","lessThanOrEqual":"9.3.8","versionType":"semver","status":"affected"},{"version":"9.4.0","lessThanOrEqual":"9.4.7","versionType":"semver","status":"affected"},{"version":"9.5.0","lessThanOrEqual":"9.5.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:55:32.046618Z","id":"CVE-2026-102409","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-674"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.2.0","versionEndExcluding":"9.4.8","matchCriteriaId":"2376876B-71F4-4062-AE7A-C6E3C69E7B55"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.5.0","versionEndExcluding":"9.5.5","matchCriteriaId":"50BF1B31-EF32-4797-8095-EFD00A168D47"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/elasticsearch-9-4-8-9-5-5-security-update-esa-2026-190/390863","source":"security@elastic.co","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102410","sourceIdentifier":"security@elastic.co","published":"2026-10-06T20:17:13.043","lastModified":"2026-10-09T15:55:37.063","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Experience feature did not enforce a Kibana-level authorization check that an equivalent, related API in the same feature did enforce. As a result, a user who held only data-store-level read access to an index, but no corresponding Kibana feature privilege, could retrieve index-derived metric data through Kibana that the properly-authorized API would otherwise have blocked."}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Kibana","defaultStatus":"unaffected","versions":[{"version":"9.2.0","lessThanOrEqual":"9.3.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:55:09.692900Z","id":"CVE-2026-102410","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","versionStartIncluding":"9.2.0","versionEndExcluding":"9.4.0","matchCriteriaId":"659AB8B4-7BAE-4610-A044-C2C238A0D6B5"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/kibana-9-4-0-security-update-esa-2026-191/390864","source":"security@elastic.co","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102411","sourceIdentifier":"security@elastic.co","published":"2026-10-06T20:17:13.180","lastModified":"2026-10-09T15:49:36.110","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsearch enforces a size limit on the user-supplied metadata field for each individual template resource, but does not limit the total memory used when multiple such resources are retrieved together. A user holding the *manage_index_templates* cluster privilege can register multiple resources each within the individual limit. Retrieving them together materializes all of their metadata values in memory at once, exhausting available heap and causing the affected node to fail with an out-of-memory error, resulting in a denial of service."}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Elasticsearch","defaultStatus":"unaffected","versions":[{"version":"8.0.0","lessThanOrEqual":"8.19.22","versionType":"semver","status":"affected"},{"version":"9.0.0","lessThanOrEqual":"9.4.6","versionType":"semver","status":"affected"},{"version":"9.5.0","lessThanOrEqual":"9.5.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:54:47.882698Z","id":"CVE-2026-102411","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.19.23","matchCriteriaId":"0AD1CC1B-04A9-45D0-85E4-C0DAE10E438E"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.4.7","matchCriteriaId":"4410D477-3311-4D1A-B428-401D0CA104C8"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.5.0","versionEndExcluding":"9.5.3","matchCriteriaId":"9B53D798-705F-469D-B2CC-7B6DD22CC56E"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/elasticsearch-9-4-7-9-5-3-8-19-23-security-update-esa-2026-192/390865","source":"security@elastic.co","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102412","sourceIdentifier":"security@elastic.co","published":"2026-10-06T20:17:13.330","lastModified":"2026-10-09T15:47:16.990","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted to users with Fleet settings administrative access. Successful exploitation could allow an attacker to obtain private cryptographic key material configured for Fleet Server host connections, potentially enabling impersonation of trusted Fleet infrastructure components in deployments where those keys are actively used."}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Kibana","defaultStatus":"unaffected","versions":[{"version":"9.3.0","lessThanOrEqual":"9.3.8","versionType":"semver","status":"affected"},{"version":"9.4.0","lessThanOrEqual":"9.4.7","versionType":"semver","status":"affected"},{"version":"9.5.0","lessThanOrEqual":"9.5.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:54:24.509467Z","id":"CVE-2026-102412","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","versionStartIncluding":"9.3.0","versionEndIncluding":"9.3.8","matchCriteriaId":"6D3A697E-5529-4033-86A8-B651A414C0B2"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","versionStartIncluding":"9.4.0","versionEndExcluding":"9.4.8","matchCriteriaId":"EDD147AC-B8E7-4B19-BB68-A595AF5D9FBA"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","versionStartIncluding":"9.5.0","versionEndExcluding":"9.5.5","matchCriteriaId":"58AD33E2-310F-4DE5-8B3E-C906CA04A036"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/kibana-9-4-8-9-5-5-security-update-esa-2026-193/390866","source":"security@elastic.co","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102413","sourceIdentifier":"security@elastic.co","published":"2026-10-06T20:17:13.463","lastModified":"2026-10-07T13:42:52.070","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoint component processes a file name under certain system locale configurations (including Chinese, Japanese, and Korean locales) on Windows, an unhandled exception can occur during file-path handling. This causes the Elastic Endpoint process to crash and restart repeatedly, which can degrade or disable Elastic Defend's real-time malware prevention and behavioral detection capabilities on the affected host for as long as the condition persists."}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Elastic Agent and Elastic Defend","defaultStatus":"unaffected","versions":[{"version":"8.19.13","lessThanOrEqual":"8.19.21","versionType":"semver","status":"affected"},{"version":"9.2.7","lessThanOrEqual":"9.2.8","versionType":"semver","status":"affected"},{"version":"9.3.0","lessThanOrEqual":"9.3.8","versionType":"semver","status":"affected"},{"version":"9.4.0","lessThanOrEqual":"9.4.7","versionType":"semver","status":"affected"},{"version":"9.5.0","lessThanOrEqual":"9.5.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:53:58.090433Z","id":"CVE-2026-102413","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-248"}]}],"references":[{"url":"https://discuss.elastic.co/t/elastic-agent-endpoint-8-19-22-9-4-8-and-9-5-5-security-update-esa-2026-194/390868","source":"security@elastic.co"}]}},{"cve":{"id":"CVE-2026-103005","sourceIdentifier":"security@elastic.co","published":"2026-10-06T20:17:13.597","lastModified":"2026-10-09T15:45:28.747","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges could cause the cluster to allocate an uncontrolled amount of memory when connector resources with an excessively large `description` field are created and subsequently accessed, exhausting available heap memory and crashing the affected node."}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Elasticsearch","defaultStatus":"unaffected","versions":[{"version":"8.12.0","lessThanOrEqual":"8.19.22","versionType":"semver","status":"affected"},{"version":"9.0.0","lessThanOrEqual":"9.3.8","versionType":"semver","status":"affected"},{"version":"9.4.0","lessThanOrEqual":"9.4.7","versionType":"semver","status":"affected"},{"version":"9.5.0","lessThanOrEqual":"9.5.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:53:36.232961Z","id":"CVE-2026-103005","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-789"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"8.12.0","versionEndExcluding":"8.19.23","matchCriteriaId":"E0571850-1B8D-4572-B6D4-007EB47B595E"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndIncluding":"9.3.8","matchCriteriaId":"B2D68899-0EEE-44A6-975D-FD138659B848"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.4.0","versionEndExcluding":"9.4.8","matchCriteriaId":"D04D7A32-58DC-4691-AA23-B8C81AC7678B"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.5.0","versionEndExcluding":"9.5.5","matchCriteriaId":"50BF1B31-EF32-4797-8095-EFD00A168D47"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-195/390869","source":"security@elastic.co","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-103006","sourceIdentifier":"security@elastic.co","published":"2026-10-06T20:17:13.730","lastModified":"2026-10-09T13:26:04.043","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggregation processing. An authenticated user with read access to a single index can submit a specially crafted request containing deeply nested aggregation definitions. Processing this request triggers unbounded recursive execution that exhausts the server process's available resources, causing the affected node to terminate. The node does not recover automatically and requires manual intervention to restore service."}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Elasticsearch","defaultStatus":"unaffected","versions":[{"version":"8.0.0","lessThanOrEqual":"8.19.20","versionType":"semver","status":"affected"},{"version":"9.0.0","lessThanOrEqual":"9.4.5","versionType":"semver","status":"affected"},{"version":"9.5.0","lessThanOrEqual":"9.5.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:53:13.913756Z","id":"CVE-2026-103006","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-674"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.19.21","matchCriteriaId":"E741C869-ACFA-420B-B1F4-5BC5166A22FD"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.4.6","matchCriteriaId":"E73C9AA0-8BBA-410A-AC54-792E68EC9757"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.5.0","versionEndExcluding":"9.5.2","matchCriteriaId":"4C6BAD9F-3B27-413B-960F-3CCCE5DD354B"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/elasticsearch-8-19-21-9-4-6-9-5-2-security-update-esa-2026-196/390870","source":"security@elastic.co","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-103007","sourceIdentifier":"security@elastic.co","published":"2026-10-06T20:17:13.930","lastModified":"2026-10-09T13:25:39.420","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator delegate limited role-management capability to another user, scoped to specific indices. The authorization check that enforces this scoping does not correctly account for a role-definition setting that can expand the matched index set. A user holding this delegated privilege with a broadly-scoped index pattern can exploit this inconsistency by updating their own assigned role to gain access to indices that should remain restricted, including internal security data. This can enable further escalation up to full administrative control of the cluster."}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Elasticsearch","defaultStatus":"unaffected","versions":[{"version":"8.16.0","lessThanOrEqual":"8.19.21","versionType":"semver","status":"affected"},{"version":"9.0.0","lessThanOrEqual":"9.4.6","versionType":"semver","status":"affected"},{"version":"9.5.0","lessThanOrEqual":"9.5.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T00:00:00+00:00","id":"CVE-2026-103007","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"8.16.0","versionEndExcluding":"8.19.22","matchCriteriaId":"12C04678-9CDB-448D-9EA3-D371335B8EAC"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.4.7","matchCriteriaId":"4410D477-3311-4D1A-B428-401D0CA104C8"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.5.0","versionEndExcluding":"9.5.4","matchCriteriaId":"D808C786-9949-4B3D-B987-276F6C407C04"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-197/390871","source":"security@elastic.co","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-103008","sourceIdentifier":"security@elastic.co","published":"2026-10-06T20:17:14.120","lastModified":"2026-10-09T13:21:34.313","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains an uncontrolled recursion weakness in how it builds and serializes geometry values produced by scripted runtime fields. Unlike geometry supplied as text, which is subject to a nesting-depth limit, geometry constructed from a script's output is not bounded. An authenticated user with read access to a single index can submit a request defining such a field with a script that produces a deeply nested structure. Processing this request recurses past the available stack space, causing the affected node to terminate. The node does not recover automatically on all deployments and may require manual intervention to restore service."}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Elasticsearch","defaultStatus":"unaffected","versions":[{"version":"8.12.0","lessThanOrEqual":"8.19.22","versionType":"semver","status":"affected"},{"version":"9.0.0","lessThanOrEqual":"9.4.7","versionType":"semver","status":"affected"},{"version":"9.5.0","lessThanOrEqual":"9.5.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:52:26.398877Z","id":"CVE-2026-103008","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-674"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"8.12.0","versionEndExcluding":"8.19.23","matchCriteriaId":"E0571850-1B8D-4572-B6D4-007EB47B595E"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.4.8","matchCriteriaId":"981FC4D9-6123-4976-859C-26932511601B"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.5.0","versionEndExcluding":"9.5.5","matchCriteriaId":"50BF1B31-EF32-4797-8095-EFD00A168D47"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-198/390872","source":"security@elastic.co","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-103009","sourceIdentifier":"security@elastic.co","published":"2026-10-06T20:17:14.247","lastModified":"2026-10-09T13:13:05.053","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of cross-cluster search requests made through the Remote Cluster Security (RCS) 2.0 model. An authorization check validates a request against one identifying attribute of the target shard, while a separate, independently-supplied identifying attribute in the same request determines which shard is actually accessed. A holder of a cross-cluster API key authorized for one index can craft a request whose two identifying attributes refer to different indices, causing the request to be authorized against an index they can access while actually operating against a different, unauthorized index. This can expose that index's document contents, field mappings, and other metadata, and in limited cases allows modification of retention-lease state on the unauthorized index."}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Elasticsearch","defaultStatus":"unaffected","versions":[{"version":"8.13.0","lessThanOrEqual":"8.19.22","versionType":"semver","status":"affected"},{"version":"9.0.0","lessThanOrEqual":"9.4.7","versionType":"semver","status":"affected"},{"version":"9.5.0","lessThanOrEqual":"9.5.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:52:05.345727Z","id":"CVE-2026-103009","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"8.13.0","versionEndExcluding":"8.19.23","matchCriteriaId":"E0A128CB-E3D5-436D-9358-1F08D54B1B16"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.4.8","matchCriteriaId":"981FC4D9-6123-4976-859C-26932511601B"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"9.5.0","versionEndExcluding":"9.5.5","matchCriteriaId":"50BF1B31-EF32-4797-8095-EFD00A168D47"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-199/390874","source":"security@elastic.co","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-103059","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:14.377","lastModified":"2026-10-15T02:26:26.567","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `LIKE` comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's registered RSA public key for which they can derive the private key could have that key matched to the victim's account and authenticate over SSH as that user. Keys are now looked up by fingerprint."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T14:17:16.900412Z","id":"CVE-2026-103059","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-305"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39423","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-8pwg-hcgm-54cp","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-103504","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:14.487","lastModified":"2026-10-07T21:17:07.427","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Changing an organization team's permission through the API with only the `permission` field did not rebuild the team's per-unit access, and the requested level was not applied as a cap. After an organization owner demoted a team, for example from admin to read, the team's members kept their previous unit permissions, including write access to the team's repositories. The web form was not affected."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:14:37.385135Z","id":"CVE-2026-103504","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-272"}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/38938","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-x8c3-3rp8-2j46","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}},{"cve":{"id":"CVE-2026-103667","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:14.607","lastModified":"2026-10-15T02:25:29.217","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's container registry served blob downloads with a `Content-Type` taken from the media type declared in pushed image manifests, without a `Content-Disposition` or restrictive content security policy. A user who can push container images can publish a blob containing HTML and JavaScript with a `text/html` media type. When a victim who is authenticated to the instance opens the blob URL in a browser, the script runs on the Gitea origin and can perform actions as the victim, such as creating API tokens."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:16:50.727435Z","id":"CVE-2026-103667","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39398","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-7cq7-4v93-8wjm","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-103670","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:14.717","lastModified":"2026-10-15T02:23:07.507","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled without checking whether the new run still needed approval. Because fork pull request runs are inserted under the base repository, a user who can open a pull request from a fork could cancel trusted in-progress runs that share a concurrency group with `cancel-in-progress` enabled, without approval and without running any code. On self-hosted runners this can interrupt deployments and leave partial state behind."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:55:33.888984Z","id":"CVE-2026-103670","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-667"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39399","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-4j4g-m7mr-hp5j","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-104047","sourceIdentifier":"secalert@redhat.com","published":"2026-10-06T20:17:14.823","lastModified":"2026-10-09T12:56:28.107","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query filters. A local user can exploit this vulnerability by submitting a crafted lookup request, manipulating the query logic to cause unauthorized information disclosure from the directory."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:46:03.994568Z","id":"CVE-2026-104047","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Primary","description":[{"lang":"en","value":"CWE-140"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:fedoraproject:sssd:2.12.0:*:*:*:*:*:*:*","matchCriteriaId":"3DC51156-297F-4FE9-B867-D51191E0C9CB"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*","matchCriteriaId":"932D137F-528B-4526-9A89-CD59FA1AB0FE"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*","matchCriteriaId":"142AD0DD-4CF3-4D74-9442-459CE3347E3A"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"F4CFF558-3C47-480D-A2F0-BABF26042943"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"7F6FB57C-2BC7-487C-96DD-132683AEB35D"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*","matchCriteriaId":"D65C2163-CFC2-4ABB-8F4E-CB09CEBD006C"}]}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-104047","source":"secalert@redhat.com","tags":["Vendor Advisory","Issue Tracking"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478616","source":"secalert@redhat.com","tags":["Exploit","Issue Tracking","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-104048","sourceIdentifier":"secalert@redhat.com","published":"2026-10-06T20:17:14.977","lastModified":"2026-10-09T12:54:42.760","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account can bypass access policies and gain unauthorized access to protected services or hosts."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T14:32:33.019028Z","id":"CVE-2026-104048","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1025"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:fedoraproject:sssd:2.12.0:*:*:*:*:*:*:*","matchCriteriaId":"3DC51156-297F-4FE9-B867-D51191E0C9CB"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*","matchCriteriaId":"932D137F-528B-4526-9A89-CD59FA1AB0FE"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*","matchCriteriaId":"142AD0DD-4CF3-4D74-9442-459CE3347E3A"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"F4CFF558-3C47-480D-A2F0-BABF26042943"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"7F6FB57C-2BC7-487C-96DD-132683AEB35D"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*","matchCriteriaId":"D65C2163-CFC2-4ABB-8F4E-CB09CEBD006C"}]}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-104048","source":"secalert@redhat.com","tags":["Vendor Advisory","Issue Tracking"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478613","source":"secalert@redhat.com","tags":["Exploit","Issue Tracking","Mitigation","Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478613","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-104626","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:15.120","lastModified":"2026-10-13T17:24:53.250","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer later approves the run, Gitea passed the already-cancelled job back through concurrency preparation, set it to waiting, and made it claimable by a matching runner, executing fork-controlled workflow code. Exploitation requires the maintainer's later approval action, Actions to be enabled, and a runner that accepts the repository's jobs."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:19:04.289390Z","id":"CVE-2026-104626","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-841"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39399","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-93pj-3x56-5gc2","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-104632","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:15.237","lastModified":"2026-10-13T17:20:01.013","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so when a user with Actions write access cancelled a run that was awaiting approval and then re-ran it, the new jobs were created as waiting rather than blocked while the run still recorded that approval was required. Cancelling and re-running stale fork checks is a routine action that does not involve the approval control, so where Actions is enabled and a matching runner is registered, workflow code taken from the fork pull request head could run on the repository's runners without an explicit approval."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:20:48.432483Z","id":"CVE-2026-104632","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-285"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39399","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-pvjf-7jrm-6w9g","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-104636","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:15.343","lastModified":"2026-10-13T17:18:49.457","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but the subsequent raw Git operations followed HTTP redirects without revalidating the destination. A repository administrator using a policy-allowed endpoint that redirects could make Gitea's Git client send requests to an address that the outbound host policy would otherwise block. The impact depends on the configured policy and the internal services reachable from the server."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:13:39.303785Z","id":"CVE-2026-104636","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39426","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-g4hw-fg4c-89mq","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105111","sourceIdentifier":"security@apache.org","published":"2026-10-06T20:17:15.463","lastModified":"2026-10-07T13:35:14.410","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL.\n\n\n\nThis only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports).\n\n\n\nThis issue affects Apache Commons BCEL: before 6.13.0.\n\n\n\nUsers are recommended to upgrade to version 6.13.0, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Commons BCEL","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.bcel:bcel","repo":"https://gitbox.apache.org/repos/asf/commons-bcel.git","packageURL":"pkg:maven/org.apache.bcel/bcel","versions":[{"version":"0","lessThan":"6.13.0","versionType":"maven","status":"affected"},{"version":"0","lessThan":"fb72c225cbc6ec3d94060ed6edb269f07428d504","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:58:48.850537Z","id":"CVE-2026-105111","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/apache/commons-bcel/commit/fb72c225cbc6ec3d94060ed6edb269f07428d504.patch","source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/co1wfk2lyrmpnfhn49o370pvfl978rw6","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/07/13","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-105239","sourceIdentifier":"security@apache.org","published":"2026-10-06T20:17:15.630","lastModified":"2026-10-09T15:44:02.503","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net.\n\nA NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently not stored. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use EventLogAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache log4net","defaultStatus":"unaffected","collectionURL":"https://nuget.org/packages","packageName":"log4net","packageURL":"pkg:nuget/log4net","versions":[{"version":"1.2.9","lessThan":"3.5.0","versionType":"semver","status":"affected"}]},{"vendor":"Apache Software Foundation","product":"Apache log4net","defaultStatus":"unaffected","collectionURL":"https://nuget.org/packages","packageName":"log4net","repo":"https://gitbox.apache.org/repos/asf/logging-log4net.git","packageURL":"pkg:nuget/log4net","versions":[{"version":"02e1e115435888485f2e28b414d267e39e799e07","lessThan":"dc5855a0720c91590fd7a81d729ea01fdd69e000","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:58:19.202424Z","id":"CVE-2026-105239","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-158"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:log4net:*:*:*:*:*:*:*:*","versionStartIncluding":"1.2.9","versionEndExcluding":"3.5.0","matchCriteriaId":"182F45E2-D20D-4B67-85C1-AFE1D39A5692"}]}]}],"references":[{"url":"https://github.com/apache/logging-log4net/commit/dc5855a0720c91590fd7a81d729ea01fdd69e000","source":"security@apache.org","tags":["Patch"]},{"url":"https://github.com/apache/logging-log4net/pull/315","source":"security@apache.org","tags":["Patch"]},{"url":"https://lists.apache.org/thread.html/9fx1qo5hc0tg8ym0t6p9gt1zpb2qlxpq","source":"security@apache.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/07/14","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-105240","sourceIdentifier":"security@apache.org","published":"2026-10-06T20:17:15.777","lastModified":"2026-10-09T15:41:47.250","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net.\n\nA NUL character in logged content ended the debug output record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently lost. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use OutputDebugStringAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache log4net","defaultStatus":"unaffected","collectionURL":"https://nuget.org/packages","packageName":"log4net","packageURL":"pkg:nuget/log4net","versions":[{"version":"1.2.9","lessThan":"3.5.0","versionType":"semver","status":"affected"}]},{"vendor":"Apache Software Foundation","product":"Apache log4net","defaultStatus":"unaffected","collectionURL":"https://nuget.org/packages","packageName":"log4net","repo":"https://gitbox.apache.org/repos/asf/logging-log4net.git","packageURL":"pkg:nuget/log4net","versions":[{"version":"02e1e115435888485f2e28b414d267e39e799e07","lessThan":"6046fe9d7f353b49fe995361c071ec2eea8f7ef6","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T16:26:58.924030Z","id":"CVE-2026-105240","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-158"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:log4net:*:*:*:*:*:*:*:*","versionStartIncluding":"1.2.9","versionEndExcluding":"3.5.0","matchCriteriaId":"182F45E2-D20D-4B67-85C1-AFE1D39A5692"}]}]}],"references":[{"url":"https://github.com/apache/logging-log4net/commit/6046fe9d7f353b49fe995361c071ec2eea8f7ef6","source":"security@apache.org","tags":["Patch"]},{"url":"https://github.com/apache/logging-log4net/pull/315","source":"security@apache.org","tags":["Patch"]},{"url":"https://lists.apache.org/thread.html/gyw2d4ppy82t1vlpdknkfd1nmzp21z17","source":"security@apache.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/07/18","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-105241","sourceIdentifier":"security@apache.org","published":"2026-10-06T20:17:15.907","lastModified":"2026-10-09T15:29:42.560","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net.\n\nContent that the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, made the write throw. Every buffered event in the batch was discarded, not only the one carrying the content, and a truncated mail could be left in the pickup directory. A party whose data reaches a log message could suppress the records of other events. Only applications that use SmtpPickupDirAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache log4net","defaultStatus":"unaffected","collectionURL":"https://nuget.org/packages","packageName":"log4net","packageURL":"pkg:nuget/log4net","versions":[{"version":"1.2.9","lessThan":"3.5.0","versionType":"semver","status":"affected"}]},{"vendor":"Apache Software Foundation","product":"Apache log4net","defaultStatus":"unaffected","collectionURL":"https://nuget.org/packages","packageName":"log4net","repo":"https://gitbox.apache.org/repos/asf/logging-log4net.git","packageURL":"pkg:nuget/log4net","versions":[{"version":"02e1e115435888485f2e28b414d267e39e799e07","lessThan":"4d2e10f0908199604b4326f9df6d0b43b871e333","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T14:44:42.702949Z","id":"CVE-2026-105241","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-176"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:log4net:*:*:*:*:*:*:*:*","versionStartIncluding":"1.2.9","versionEndExcluding":"3.5.0","matchCriteriaId":"182F45E2-D20D-4B67-85C1-AFE1D39A5692"}]}]}],"references":[{"url":"https://github.com/apache/logging-log4net/commit/4d2e10f0908199604b4326f9df6d0b43b871e333","source":"security@apache.org","tags":["Patch"]},{"url":"https://github.com/apache/logging-log4net/pull/315","source":"security@apache.org","tags":["Patch"]},{"url":"https://lists.apache.org/thread.html/hg8dgh3oy8bp3dhb8nsygk9kw2o401ws","source":"security@apache.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/07/15","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-105242","sourceIdentifier":"security@apache.org","published":"2026-10-06T20:17:16.037","lastModified":"2026-10-09T15:28:34.500","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net.\n\nReading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A sender could suppress the log record of their own request. Only applications on ASP.NET for .NET Framework whose layout uses %aspnet-request are affected.\n\nThis issue affects Apache log4net: from 1.2.11 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache log4net","defaultStatus":"unaffected","collectionURL":"https://nuget.org/packages","packageName":"log4net","packageURL":"pkg:nuget/log4net","versions":[{"version":"1.2.11","lessThan":"3.5.0","versionType":"semver","status":"affected"}]},{"vendor":"Apache Software Foundation","product":"Apache log4net","defaultStatus":"unaffected","collectionURL":"https://nuget.org/packages","packageName":"log4net","repo":"https://gitbox.apache.org/repos/asf/logging-log4net.git","packageURL":"pkg:nuget/log4net","versions":[{"version":"243f1e9f3ee235955bade4b4fe664a903378719a","lessThan":"145203420c579a703008b4b723b6a080757f4964","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T14:48:50.404406Z","id":"CVE-2026-105242","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-755"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:log4net:*:*:*:*:*:*:*:*","versionStartIncluding":"1.2.11","versionEndExcluding":"3.5.0","matchCriteriaId":"70B74F4C-2E8A-4169-9497-E4EC19B7B0BC"}]}]}],"references":[{"url":"https://github.com/apache/logging-log4net/commit/145203420c579a703008b4b723b6a080757f4964","source":"security@apache.org","tags":["Patch"]},{"url":"https://github.com/apache/logging-log4net/pull/316","source":"security@apache.org","tags":["Patch"]},{"url":"https://lists.apache.org/thread.html/zg6dbqm4ztm7j3c21nfsqj0yxm5yrpdx","source":"security@apache.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/07/16","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-105243","sourceIdentifier":"security@apache.org","published":"2026-10-06T20:17:16.167","lastModified":"2026-10-09T15:26:03.430","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient Logging vulnerability in the EventLogAppender of Apache log4net.\n\nLong messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted, and the event log then stored nothing and reported nothing. A party whose data reaches a log message could suppress the whole record by making it long enough. Only applications on Windows that use EventLogAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache log4net","defaultStatus":"unaffected","collectionURL":"https://nuget.org/packages","packageName":"log4net","packageURL":"pkg:nuget/log4net","versions":[{"version":"1.2.9","lessThan":"3.5.0","versionType":"semver","status":"affected"}]},{"vendor":"Apache Software Foundation","product":"Apache log4net","defaultStatus":"unaffected","collectionURL":"https://nuget.org/packages","packageName":"log4net","repo":"https://gitbox.apache.org/repos/asf/logging-log4net.git","packageURL":"pkg:nuget/log4net","versions":[{"version":"02e1e115435888485f2e28b414d267e39e799e07","lessThan":"28fbfb25678c48a8cc5bc9b94ead0dddfc39ffed","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T14:49:30.641089Z","id":"CVE-2026-105243","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-778"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:log4net:*:*:*:*:*:*:*:*","versionStartIncluding":"1.2.9","versionEndExcluding":"3.5.0","matchCriteriaId":"182F45E2-D20D-4B67-85C1-AFE1D39A5692"}]}]}],"references":[{"url":"https://github.com/apache/logging-log4net/commit/28fbfb25678c48a8cc5bc9b94ead0dddfc39ffed","source":"security@apache.org","tags":["Patch"]},{"url":"https://github.com/apache/logging-log4net/pull/315","source":"security@apache.org","tags":["Patch"]},{"url":"https://lists.apache.org/thread.html/jr6fj5skv1vnjbc9jmt8bp151p8ow1rp","source":"security@apache.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/07/17","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-105244","sourceIdentifier":"security@apache.org","published":"2026-10-06T20:17:16.297","lastModified":"2026-10-09T15:18:44.677","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net.\n\nEvery character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.12 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache log4net","defaultStatus":"unaffected","collectionURL":"https://nuget.org/packages","packageName":"log4net","packageURL":"pkg:nuget/log4net","versions":[{"version":"1.2.12","lessThan":"3.5.0","versionType":"semver","status":"affected"}]},{"vendor":"Apache Software Foundation","product":"Apache log4net","defaultStatus":"unaffected","collectionURL":"https://nuget.org/packages","packageName":"log4net","repo":"https://gitbox.apache.org/repos/asf/logging-log4net.git","packageURL":"pkg:nuget/log4net","versions":[{"version":"56a2e146e21ff4737e1ff3ec308810e667873947","lessThan":"77717061b20d4346b6c0ce6b54643d85fb348bc7","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T14:50:00.691563Z","id":"CVE-2026-105244","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-116"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:log4net:*:*:*:*:*:*:*:*","versionStartIncluding":"1.2.12","versionEndExcluding":"3.5.0","matchCriteriaId":"A059FF7A-C9B2-4074-A0D3-E3973E936FDD"}]}]}],"references":[{"url":"https://github.com/apache/logging-log4net/commit/77717061b20d4346b6c0ce6b54643d85fb348bc7","source":"security@apache.org","tags":["Patch"]},{"url":"https://github.com/apache/logging-log4net/pull/315","source":"security@apache.org","tags":["Patch","Vendor Advisory"]},{"url":"https://lists.apache.org/thread.html/q7649hhdodthoqw8jsjgtnb4m8qfy6d6","source":"security@apache.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/07/19","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-106063","sourceIdentifier":"secalert@redhat.com","published":"2026-10-06T20:17:17.090","lastModified":"2026-10-08T08:16:34.063","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. When exporting an image with extremely large width and height, the export path allocates a buffer using a 32-bit width * height (and bytes-per-pixel) product that can overflow. GEGL then writes the full uncompressed extent into the undersized buffer, after integer overflow in the allocation size"}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp:2.8/gimp","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp","cpes":["cpe:/o:redhat:enterprise_linux:9"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T19:33:22.083891Z","id":"CVE-2026-106063","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-119"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-106063","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2546668","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-106444","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T20:17:26.130","lastModified":"2026-10-07T13:58:29.527","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"handlebars-lang","product":"handlebars.js","versions":[{"version":">= 4.0.0, < 4.7.10","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:47:42.547607Z","id":"CVE-2026-106444","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-116"}]}],"references":[{"url":"https://github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725","source":"security-advisories@github.com"},{"url":"https://github.com/handlebars-lang/handlebars.js/pull/2185","source":"security-advisories@github.com"},{"url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10","source":"security-advisories@github.com"},{"url":"https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xw65-4hp5-5hc7","source":"security-advisories@github.com"},{"url":"https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xw65-4hp5-5hc7","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-106445","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T20:17:26.293","lastModified":"2026-10-12T15:17:06.910","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker can render a controlled template with allowProtoMethodsByDefault enabled and an accessible function in the template context, the template can traverse from that function through its prototype to Function.prototype and then obtain the Function constructor through the own-property bypass. This permits attacker-controlled JavaScript to execute with the server application's privileges. This issue is fixed in version 4.7.10."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"handlebars-lang","product":"handlebars.js","versions":[{"version":">= 3.0.0, < 4.7.10","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:42:53.531967Z","id":"CVE-2026-106445","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-184"},{"lang":"en","value":"CWE-1289"}]}],"references":[{"url":"https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa","source":"security-advisories@github.com"},{"url":"https://github.com/handlebars-lang/handlebars.js/pull/2185","source":"security-advisories@github.com"},{"url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10","source":"security-advisories@github.com"},{"url":"https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f","source":"security-advisories@github.com"},{"url":"https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-106446","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T20:17:26.430","lastModified":"2026-10-07T19:17:32.293","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile() and Handlebars.precompile() accept pre-parsed AST objects while validating only selected PathExpression, NumberLiteral, and BooleanLiteral values. This issue bypasses the AST validation introduced in version 4.7.9 for CVE-2026-33937. An attacker who can supply an object instead of a template string can place JavaScript expressions in unchecked values such as Program.blockParams.length, a non-PathExpression parameter depth, a non-string StringLiteral.value, or a non-string PathExpression.original. The compiler emits those values into generated JavaScript, causing code execution in the server process when compile output renders or wherever precompile output is loaded. Applications that pass only template strings are not affected. This issue is fixed in version 4.7.10."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"handlebars-lang","product":"handlebars.js","versions":[{"version":">= 4.0.0, < 4.7.10","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T18:27:28.577129Z","id":"CVE-2026-106446","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-843"}]}],"references":[{"url":"https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2","source":"security-advisories@github.com"},{"url":"https://github.com/handlebars-lang/handlebars.js/pull/2185","source":"security-advisories@github.com"},{"url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10","source":"security-advisories@github.com"},{"url":"https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj","source":"security-advisories@github.com"},{"url":"https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-106447","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T20:17:26.573","lastModified":"2026-10-07T15:17:12.183","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor decoder recursively processes nested CBOR arrays, maps, and tags through _decodeValue() without enforcing a maximum nesting depth. A sufficiently deep structure exhausts the JavaScript call stack, causing a decoding exception and potentially terminating an uncaught request worker or process. This issue is fixed in version 2.0.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"StableLib","product":"stablelib","versions":[{"version":"< 2.0.4","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T14:39:46.797113Z","id":"CVE-2026-106447","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-674"}]}],"references":[{"url":"https://github.com/StableLib/stablelib/commit/0149e18d9d4736e22c257744ca945ebce7899a01","source":"security-advisories@github.com"},{"url":"https://github.com/StableLib/stablelib/releases/tag/@stablelib/cbor@2.0.4","source":"security-advisories@github.com"},{"url":"https://github.com/StableLib/stablelib/security/advisories/GHSA-5jg4-p4qw-cgfr","source":"security-advisories@github.com"},{"url":"https://github.com/StableLib/stablelib/security/advisories/GHSA-5jg4-p4qw-cgfr","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-106448","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T20:17:26.743","lastModified":"2026-10-07T17:16:47.727","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map decoding path creates ordinary JavaScript objects and assigns attacker-controlled keys with bracket assignment. A map key named __proto__ invokes the inherited prototype setter instead of creating an ordinary own property, allowing the decoded object's prototype to contain attacker-controlled authorization or feature-flag values. Downstream code that trusts normal property lookup or merges the decoded object can therefore make security-sensitive decisions using inherited attacker data. This issue is fixed in version 2.0.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"StableLib","product":"stablelib","versions":[{"version":"< 2.0.4","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.9,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:27:16.755969Z","id":"CVE-2026-106448","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1321"}]}],"references":[{"url":"https://github.com/StableLib/stablelib/commit/0f153a63b7552a0e8721f640984113e419015026","source":"security-advisories@github.com"},{"url":"https://github.com/StableLib/stablelib/releases/tag/@stablelib/cbor@2.0.4","source":"security-advisories@github.com"},{"url":"https://github.com/StableLib/stablelib/security/advisories/GHSA-w48f-fwg7-ww6p","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-106449","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T20:17:26.887","lastModified":"2026-10-07T17:16:47.877","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a long sequence of empty blocks in an attacker-controlled compressed stream to exhaust the decoding thread's stack and throw StackOverflowError. The default stopOnEmptyBlock setting is true and is not affected, and the issue does not cause memory corruption. This issue is fixed in version 1.11.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"yawkat","product":"lz4-java","versions":[{"version":"< 1.11.4","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T16:28:27.534978Z","id":"CVE-2026-106449","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-674"}]}],"references":[{"url":"https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8","source":"security-advisories@github.com"},{"url":"https://github.com/yawkat/lz4-java/releases/tag/v1.11.4","source":"security-advisories@github.com"},{"url":"https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-106450","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T20:17:27.037","lastModified":"2026-10-09T02:16:59.843","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader() allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many minimal empty frames to trigger roughly 8 MiB of allocation for every 11 input bytes. The stream produces no decompressed output while consuming CPU and garbage-collection time, so decompressed-size limits do not mitigate the issue; readSingleFrame mode is not affected. This issue is fixed in version 1.11.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"yawkat","product":"lz4-java","versions":[{"version":"< 1.11.4","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:44:05.802349Z","id":"CVE-2026-106450","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://github.com/yawkat/lz4-java/commit/2acc0ec1ead226145c62a817c18c8ed49233a283","source":"security-advisories@github.com"},{"url":"https://github.com/yawkat/lz4-java/releases/tag/v1.11.4","source":"security-advisories@github.com"},{"url":"https://github.com/yawkat/lz4-java/security/advisories/GHSA-gm45-99xc-r7wv","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-106451","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T20:17:27.173","lastModified":"2026-10-07T19:17:32.463","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without exclusive creation, allowing another local user with access to the same shared temporary directory to create or replace the library file before System.load() uses it. Successful exploitation depends on shared-directory permissions, host protections, and winning the race, and can execute native code as the victim; hardened systems may instead cause library loading to fail and fall back to Java implementations. Configurations using a system library, a private java.io.tmpdir, or Java-only implementations are not affected. This issue is fixed in version 1.11.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"yawkat","product":"lz4-java","versions":[{"version":"< 1.11.4","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T18:25:34.130789Z","id":"CVE-2026-106451","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-367"},{"lang":"en","value":"CWE-377"}]}],"references":[{"url":"https://github.com/yawkat/lz4-java/commit/7a48b7f6b8099b9dab6541e4ac2ee0979dc55aa3","source":"security-advisories@github.com"},{"url":"https://github.com/yawkat/lz4-java/releases/tag/v1.11.4","source":"security-advisories@github.com"},{"url":"https://github.com/yawkat/lz4-java/security/advisories/GHSA-mcr4-qmvw-px4g","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-106452","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T20:17:27.317","lastModified":"2026-10-07T13:58:29.527","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill() validates that the compressedLen field in a legacy LZ4Block header is nonnegative but allocates a compressed-input buffer of that attacker-controlled size before reading payload data, allowing a header-only stream to request a near-2 GiB allocation and exhaust the JVM heap. Canonical writers emit raw blocks when compression is not smaller than the original block, but vulnerable readers accept non-canonical oversized compressed blocks. This issue is fixed in version 1.11.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"yawkat","product":"lz4-java","versions":[{"version":"< 1.11.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T10:45:08.750360Z","id":"CVE-2026-106452","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-789"}]}],"references":[{"url":"https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634","source":"security-advisories@github.com"},{"url":"https://github.com/yawkat/lz4-java/releases/tag/v1.11.2","source":"security-advisories@github.com"},{"url":"https://github.com/yawkat/lz4-java/security/advisories/GHSA-4v53-57pg-c464","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-106453","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T20:17:27.457","lastModified":"2026-10-07T17:16:48.007","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte decompressed-length header before validating the compressed input, allowing a five-byte attacker-supplied input whose header declares a large output size to request up to approximately 2 GiB and exhaust the JVM heap. Convenience overloads backed by LZ4FastDecompressor or LZ4SafeDecompressor allocate the untrusted size, while overloads that write to a caller-provided destination buffer are not affected because the caller controls the destination size. This issue is fixed in version 1.11.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"yawkat","product":"lz4-java","versions":[{"version":"< 1.11.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:39:16.300198Z","id":"CVE-2026-106453","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-789"}]}],"references":[{"url":"https://github.com/yawkat/lz4-java/commit/6492ce5aca6bd03ff9e08ee18a2beb94c431371a","source":"security-advisories@github.com"},{"url":"https://github.com/yawkat/lz4-java/releases/tag/v1.11.2","source":"security-advisories@github.com"},{"url":"https://github.com/yawkat/lz4-java/security/advisories/GHSA-6cx8-rjf8-pr8g","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-106454","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T20:17:27.597","lastModified":"2026-10-07T17:16:48.133","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp() in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards but passes all other characters from an authenticated client's LIST or LSUB pattern directly to re.compile(), allowing nested or otherwise expensive regular expression constructs to cause catastrophic backtracking when matched against mailbox names. Because Twisted uses a cooperative single-threaded reactor, the blocking match suspends all server input and output for the duration of the match. No fixed release is available as of this review."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"twisted","product":"twisted","versions":[{"version":"<= 25.5.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T16:25:51.139114Z","id":"CVE-2026-106454","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1333"}]}],"references":[{"url":"https://github.com/twisted/twisted/commit/2f8a3c29246f4eb324690e06a9767a11dc4aec9f","source":"security-advisories@github.com"},{"url":"https://github.com/twisted/twisted/pull/12788","source":"security-advisories@github.com"},{"url":"https://github.com/twisted/twisted/security/advisories/GHSA-8pqf-f4m5-798g","source":"security-advisories@github.com"},{"url":"https://github.com/twisted/twisted/security/advisories/GHSA-8pqf-f4m5-798g","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-70357","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:28.883","lastModified":"2026-10-13T17:16:32.907","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea validates a repository migration hostname against its network allow and block lists before invoking Git, but the Git subprocess independently resolves the hostname when connecting. An attacker who can start a migration and control the destination's DNS can change the address between validation and connection to reach a blocked internal address. The affected path is the Git clone operation; validation in the migration HTTP client's dialer does not protect the independently connecting Git subprocess."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:12:28.154573Z","id":"CVE-2026-70357","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39426","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-p3pc-g8m5-hrrr","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-73278","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:29.000","lastModified":"2026-10-13T16:53:31.257","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenticate through the affected external identity flow can obtain a full session without the passkey verification enforced during password login. One affected path can also persist an external identity link, extending the compromise beyond the initial session; accounts with TOTP configured are outside the reported WebAuthn-only scenario."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"1.16.0","lessThanOrEqual":"1.27.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:00:20.177733Z","id":"CVE-2026-73278","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionStartIncluding":"1.16.0","versionEndExcluding":"1.27.2","matchCriteriaId":"9C549557-A5A6-4F5E-A085-791209EEA87E"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-1.27.2/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/38805","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/pull/38810","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.2","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-92j2-6qcg-c28c","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-76061","sourceIdentifier":"secalert@redhat.com","published":"2026-10-06T20:17:29.123","lastModified":"2026-10-09T02:17:04.590","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty `bind_mount_prefix`, a malicious container or local attacker could use a Container Runtime Interface (CRI) hostPath containing an intermediate absolute symlink. This could cause the bind mount source to resolve outside the intended prefixed root, potentially leading to unauthorized access to files or privilege escalation on the host system."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://github.com/cri-o/cri-o","packageName":"cri-o","versions":[{"version":"0","lessThan":"1.34.14","versionType":"semver","status":"affected"},{"version":"1.35.0","lessThan":"1.35.9","versionType":"semver","status":"affected"},{"version":"1.36.0","lessThan":"1.36.6","versionType":"semver","status":"affected"},{"version":"1.37.0","lessThan":"1.37.1","versionType":"semver","status":"affected"}]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"cri-o","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:41:59.362391Z","id":"CVE-2026-76061","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-59"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-76061","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520330","source":"secalert@redhat.com"},{"url":"https://github.com/cri-o/cri-o/commit/01f90366dc8c8db0df32b4aae7fd067c1eddbb70","source":"secalert@redhat.com"},{"url":"https://github.com/cri-o/cri-o/commit/6d08a9a60ecfabdb3cbea0c8d698e31f1f01cb40","source":"secalert@redhat.com"},{"url":"https://github.com/cri-o/cri-o/commit/d6f58973acfcae93ecc039e0297fbe5f2548b46b","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-76741","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:29.377","lastModified":"2026-10-07T18:17:30.483","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an authenticated remote attacker to cause a denial-of-service condition on the affected system."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"AOS-Switch (AOS-S)","defaultStatus":"affected","versions":[{"version":"16.11.0000","lessThanOrEqual":"16.11.0031","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T17:56:22.499613Z","id":"CVE-2026-76741","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05156en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-76742","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:29.490","lastModified":"2026-10-08T04:17:35.940","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Authentication bypass vulnerabilities exist in the web management interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to gain unauthorized access to the affected system."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"AOS-Switch (AOS-S)","defaultStatus":"affected","versions":[{"version":"16.11.0000","lessThanOrEqual":"16.11.0031","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T00:00:00+00:00","id":"CVE-2026-76742","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05156en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-76743","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:29.603","lastModified":"2026-10-08T04:17:36.107","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability have been identified in the management interface of AOS-S that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain unauthorized access to the affected system."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"AOS-Switch (AOS-S)","defaultStatus":"affected","versions":[{"version":"16.11.0000","lessThanOrEqual":"16.11.0031","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T00:00:00+00:00","id":"CVE-2026-76743","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05156en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-76744","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:29.727","lastModified":"2026-10-08T04:17:36.463","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"AOS-Switch (AOS-S)","defaultStatus":"affected","versions":[{"version":"16.11.0000","lessThanOrEqual":"16.11.0031","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T00:00:00+00:00","id":"CVE-2026-76744","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-120"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05156en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-76745","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:29.840","lastModified":"2026-10-08T04:17:37.007","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Memory corruption vulnerabilities exist in AOS-S that are reachable by an unauthenticated adjacent attacker. Successful exploitation could allow an attacker to execute arbitrary code."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"AOS-Switch (AOS-S)","defaultStatus":"affected","versions":[{"version":"16.11.0000","lessThanOrEqual":"16.11.0031","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T00:00:00+00:00","id":"CVE-2026-76745","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-119"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05156en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-76746","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:29.957","lastModified":"2026-10-07T20:17:14.430","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated buffer overflow vulnerability exists in AOS-S. Successful exploitation could allow an unauthenticated adjacent attacker to expose sensitive memory contents and cause a denial of service on the affected device."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"AOS-Switch (AOS-S)","defaultStatus":"affected","versions":[{"version":"16.11.0000","lessThanOrEqual":"16.11.0031","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T19:20:35.677360Z","id":"CVE-2026-76746","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-120"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05156en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-76747","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:30.067","lastModified":"2026-10-07T20:17:14.563","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to expose sensitive memory contents and cause a denial of service on the device."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"AOS-Switch (AOS-S)","defaultStatus":"affected","versions":[{"version":"16.11.0000","lessThanOrEqual":"16.11.0031","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T19:19:57.213014Z","id":"CVE-2026-76747","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-120"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05156en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-76748","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:30.173","lastModified":"2026-10-08T04:17:37.717","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A privilege escalation vulnerability exists in the API of AOS-S. Successful exploitation could allow an authenticated read-only user to escalate their privileges and gain administrative access to the affected system."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"AOS-Switch (AOS-S)","defaultStatus":"affected","versions":[{"version":"16.11.0000","lessThanOrEqual":"16.11.0031","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T00:00:00+00:00","id":"CVE-2026-76748","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05156en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-76749","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:30.287","lastModified":"2026-10-07T20:17:14.820","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A sensitive information disclosure vulnerability exists in AOS-S. Successful exploitation could allow an unauthenticated remote attacker to access sensitive information."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"AOS-Switch (AOS-S)","defaultStatus":"affected","versions":[{"version":"16.11.0000","lessThanOrEqual":"16.11.0031","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T19:18:34.879290Z","id":"CVE-2026-76749","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05156en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-76750","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:30.397","lastModified":"2026-10-08T04:17:38.110","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of untrusted data vulnerabilities exist in the web interface of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on the affected system."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","defaultStatus":"affected","versions":[{"version":"6.14.0","lessThanOrEqual":"6.14.0","versionType":"semver","status":"affected"},{"version":"6.11.0","lessThanOrEqual":"6.11.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T00:00:00+00:00","id":"CVE-2026-76750","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-76751","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:30.513","lastModified":"2026-10-08T04:17:38.847","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A missing integrity verification vulnerability exists in the OnGuard agent of ClearPass Policy Manager. Successful exploitation could allow an unauthenticated, remote attacker to execute arbitrary code on the affected endpoint with the elevated privileges of the agent."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","defaultStatus":"affected","versions":[{"version":"6.14.0","lessThanOrEqual":"6.14.0","versionType":"semver","status":"affected"},{"version":"6.11.0","lessThanOrEqual":"6.11.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T00:00:00+00:00","id":"CVE-2026-76751","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-353"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-76752","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:30.623","lastModified":"2026-10-08T04:17:39.270","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Authentication bypass vulnerabilities exist in the web-based management and API interfaces of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to circumvent existing authentication controls and gain administrative access to the affected system."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","defaultStatus":"affected","versions":[{"version":"6.14.0","lessThanOrEqual":"6.14.0","versionType":"semver","status":"affected"},{"version":"6.11.0","lessThanOrEqual":"6.11.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T00:00:00+00:00","id":"CVE-2026-76752","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-76753","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:30.740","lastModified":"2026-10-08T04:17:39.570","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A format string vulnerability in an affected service interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to corrupt process memory. Successful exploitation could allow an attacker to execute arbitrary code."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","defaultStatus":"affected","versions":[{"version":"6.14.0","lessThanOrEqual":"6.14.0","versionType":"semver","status":"affected"},{"version":"6.11.0","lessThanOrEqual":"6.11.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T00:00:00+00:00","id":"CVE-2026-76753","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-134"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-76754","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:30.853","lastModified":"2026-10-08T04:17:39.790","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in an affected interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary database commands."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","defaultStatus":"affected","versions":[{"version":"6.14.0","lessThanOrEqual":"6.14.0","versionType":"semver","status":"affected"},{"version":"6.11.0","lessThanOrEqual":"6.11.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T00:00:00+00:00","id":"CVE-2026-76754","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-77"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-79794","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:30.967","lastModified":"2026-10-08T04:17:42.760","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A SQL injection vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary database commands."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","defaultStatus":"affected","versions":[{"version":"6.14.0","lessThanOrEqual":"6.14.0","versionType":"semver","status":"affected"},{"version":"6.11.0","lessThanOrEqual":"6.11.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T00:00:00+00:00","id":"CVE-2026-79794","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-79796","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:31.083","lastModified":"2026-10-08T04:17:42.980","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Vulnerabilities have been identified in the affected interface of ClearPass Policy Manager that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain unauthorized access to the affected system."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","defaultStatus":"affected","versions":[{"version":"6.14.0","lessThanOrEqual":"6.14.0","versionType":"semver","status":"affected"},{"version":"6.11.0","lessThanOrEqual":"6.11.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T00:00:00+00:00","id":"CVE-2026-79796","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-79797","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:31.197","lastModified":"2026-10-08T04:17:43.160","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An improper access control vulnerability exists in the Android client application for HPE Networking ClearPass Policy Manager, where application functionality may be invoked by untrusted sources. Successful exploitation could allow an unauthenticated remote attacker, with user interaction, to obtain sensitive information from the affected user."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","defaultStatus":"affected","versions":[{"version":"6.14.0","lessThanOrEqual":"6.14.0","versionType":"semver","status":"affected"},{"version":"6.11.0","lessThanOrEqual":"6.11.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T00:00:00+00:00","id":"CVE-2026-79797","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-79798","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:31.310","lastModified":"2026-10-08T04:17:43.317","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary database commands."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","defaultStatus":"affected","versions":[{"version":"6.14.0","lessThanOrEqual":"6.14.0","versionType":"semver","status":"affected"},{"version":"6.11.0","lessThanOrEqual":"6.11.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T00:00:00+00:00","id":"CVE-2026-79798","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-79799","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:31.430","lastModified":"2026-10-07T19:17:41.913","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","defaultStatus":"affected","versions":[{"version":"6.14.0","lessThanOrEqual":"6.14.0","versionType":"semver","status":"affected"},{"version":"6.11.0","lessThanOrEqual":"6.11.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T18:20:56.748229Z","id":"CVE-2026-79799","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-79800","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:31.553","lastModified":"2026-10-08T04:17:43.710","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An authenticated path traversal vulnerability exists in the command line interface of ClearPass Policy Manager. Successful exploitation could allow a low-privileged authenticated remote attacker to execute arbitrary code with elevated privileges on the underlying operating system."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","defaultStatus":"affected","versions":[{"version":"6.14.0","lessThanOrEqual":"6.14.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T00:00:00+00:00","id":"CVE-2026-79800","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-79801","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:31.667","lastModified":"2026-10-08T04:17:47.373","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A missing integrity verification vulnerability in the client agent software of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to introduce untrusted code. Successful exploitation could allow an attacker to execute arbitrary code on the affected client system."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","defaultStatus":"affected","versions":[{"version":"6.14.0","lessThanOrEqual":"6.14.0","versionType":"semver","status":"affected"},{"version":"6.11.0","lessThanOrEqual":"6.11.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T00:00:00+00:00","id":"CVE-2026-79801","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-353"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-79802","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:31.783","lastModified":"2026-10-08T04:17:49.230","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A command injection vulnerability exists in the client software of ClearPass Policy Manager. Successful exploitation could allow an attacker who is able to supply crafted input to the affected software to execute arbitrary commands with elevated privileges on the affected host."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","defaultStatus":"affected","versions":[{"version":"6.14.0","lessThanOrEqual":"6.14.0","versionType":"semver","status":"affected"},{"version":"6.11.0","lessThanOrEqual":"6.11.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T00:00:00+00:00","id":"CVE-2026-79802","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-77"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-79803","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:31.900","lastModified":"2026-10-08T04:17:49.827","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A command injection vulnerability exists in the API of ClearPass Policy Manager. Successful exploitation could allow an authenticated remote attacker to escalate privileges and gain administrative control of the affected system."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","defaultStatus":"affected","versions":[{"version":"6.14.0","lessThanOrEqual":"6.14.0","versionType":"semver","status":"affected"},{"version":"6.11.0","lessThanOrEqual":"6.11.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T00:00:00+00:00","id":"CVE-2026-79803","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-77"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-79805","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:32.013","lastModified":"2026-10-08T04:17:50.060","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An authenticated path traversal vulnerability exists in ClearPass Policy Manager. Successful exploitation could allow an attacker to read and modify certain files on the underlying operating system."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","defaultStatus":"affected","versions":[{"version":"6.14.0","lessThanOrEqual":"6.14.0","versionType":"semver","status":"affected"},{"version":"6.11.0","lessThanOrEqual":"6.11.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T00:00:00+00:00","id":"CVE-2026-79805","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-79806","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:32.133","lastModified":"2026-10-08T04:17:50.280","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A privilege escalation vulnerability in the ClearPass Policy Manager OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges. A successful exploit allows a malicious user to escalate to root privileges on the affected Linux client."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","defaultStatus":"affected","versions":[{"version":"6.14.0","lessThanOrEqual":"6.14.0","versionType":"semver","status":"affected"},{"version":"6.11.0","lessThanOrEqual":"6.11.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T00:00:00+00:00","id":"CVE-2026-79806","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-79807","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:32.253","lastModified":"2026-10-08T04:17:50.540","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A missing integrity verification vulnerability in the Windows client software for ClearPass Policy Manager could allow malicious users on a local instance to elevate their user privileges. A successful exploit could allow these users to execute attacker-supplied code with elevated privileges on the local system."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","defaultStatus":"affected","versions":[{"version":"6.14.0","lessThanOrEqual":"6.14.0","versionType":"semver","status":"affected"},{"version":"6.11.0","lessThanOrEqual":"6.11.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T00:00:00+00:00","id":"CVE-2026-79807","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-347"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-79808","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:32.367","lastModified":"2026-10-08T04:17:50.823","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A buffer overflow vulnerability exists in the OnGuard agent of ClearPass Policy Manager. Successful exploitation could allow an authenticated local user to execute arbitrary code with elevated privileges on the affected host or to disrupt the availability of the affected service."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","defaultStatus":"affected","versions":[{"version":"6.14.0","lessThanOrEqual":"6.14.0","versionType":"semver","status":"affected"},{"version":"6.11.0","lessThanOrEqual":"6.11.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T00:00:00+00:00","id":"CVE-2026-79808","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-120"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-79809","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:32.483","lastModified":"2026-10-07T19:17:43.000","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated path traversal vulnerability exists in an API endpoint of ClearPass Policy Manager. Successful exploitation of this vulnerability allows an unauthenticated remote attacker to influence authorization decisions and be assigned an unintended role."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","defaultStatus":"affected","versions":[{"version":"6.14.0","lessThanOrEqual":"6.14.0","versionType":"semver","status":"affected"},{"version":"6.11.0","lessThanOrEqual":"6.11.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T18:06:21.703188Z","id":"CVE-2026-79809","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-79810","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:32.597","lastModified":"2026-10-08T04:17:51.010","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Remote code execution vulnerabilities exist in the affected interface of HPE Networking ClearPass Policy Manager that could allow an authenticated remote attacker with high privileges to execute arbitrary code. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","defaultStatus":"affected","versions":[{"version":"6.14.0","lessThanOrEqual":"6.14.0","versionType":"semver","status":"affected"},{"version":"6.11.0","lessThanOrEqual":"6.11.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T00:00:00+00:00","id":"CVE-2026-79810","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-79811","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:32.720","lastModified":"2026-10-08T04:17:51.437","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A SQL injection vulnerability in the API of ClearPass Policy Manager could allow a remote authenticated attacker with administrative privileges to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to execute arbitrary database commands."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","defaultStatus":"affected","versions":[{"version":"6.14.0","lessThanOrEqual":"6.14.0","versionType":"semver","status":"affected"},{"version":"6.11.0","lessThanOrEqual":"6.11.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T00:00:00+00:00","id":"CVE-2026-79811","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-79812","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:32.837","lastModified":"2026-10-07T19:17:43.360","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A denial of service vulnerability exists in the OnGuard agent of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an authenticated local attacker to interrupt the normal operation of the agent service."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","defaultStatus":"affected","versions":[{"version":"6.14.0","lessThanOrEqual":"6.14.0","versionType":"semver","status":"affected"},{"version":"6.11.0","lessThanOrEqual":"6.11.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T18:02:53.596007Z","id":"CVE-2026-79812","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-79813","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:32.967","lastModified":"2026-10-08T04:17:51.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A local privilege escalation vulnerability exists in the ClearPass client software. Successful exploitation could allow a low-privileged local user to execute commands with elevated privileges on the affected system, if certain conditions outside of the attacker's control are met."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","defaultStatus":"affected","versions":[{"version":"6.14.0","lessThanOrEqual":"6.14.0","versionType":"semver","status":"affected"},{"version":"6.11.0","lessThanOrEqual":"6.11.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T00:00:00+00:00","id":"CVE-2026-79813","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-79814","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:33.090","lastModified":"2026-10-08T04:17:51.890","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An arbitrary file write vulnerability in the ClearPass Policy Manager OnGuard agent could allow malicious users on a local instance to elevate their user privileges if certain preconditions outside of the attacker's control are met. Successful exploitation could allow a local attacker to execute arbitrary code with elevated privileges on the affected system."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","defaultStatus":"affected","versions":[{"version":"6.14.0","lessThanOrEqual":"6.14.0","versionType":"semver","status":"affected"},{"version":"6.11.0","lessThanOrEqual":"6.11.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T00:00:00+00:00","id":"CVE-2026-79814","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-73"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-79815","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:33.197","lastModified":"2026-10-07T19:17:43.720","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A command injection vulnerability in the OnGuard agent of ClearPass Policy Manager could allow an authenticated remote attacker to inject arbitrary commands. Successful exploitation could allow an attacker to execute commands with elevated privileges on the affected Windows endpoint."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","defaultStatus":"affected","versions":[{"version":"6.14.0","lessThanOrEqual":"6.14.0","versionType":"semver","status":"affected"},{"version":"6.11.0","lessThanOrEqual":"6.11.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T17:59:37.214483Z","id":"CVE-2026-79815","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-77"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-79816","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:33.317","lastModified":"2026-10-07T18:17:30.783","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in a client interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct a DOM-based cross-site scripting (XSS) attack against a user of the affected client interface. Successful exploitation could allow an attacker to execute arbitrary script code in a victim's browser context within the affected client interface."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","defaultStatus":"affected","versions":[{"version":"6.14.0","lessThanOrEqual":"6.14.0","versionType":"semver","status":"affected"},{"version":"6.11.0","lessThanOrEqual":"6.11.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T17:58:50.634577Z","id":"CVE-2026-79816","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-79817","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:33.430","lastModified":"2026-10-07T18:17:30.923","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A sensitive information disclosure vulnerability exists in the client software of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an attacker with local access to the affected system to obtain sensitive information."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","defaultStatus":"affected","versions":[{"version":"6.14.0","lessThanOrEqual":"6.14.0","versionType":"semver","status":"affected"},{"version":"6.11.0","lessThanOrEqual":"6.11.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T17:58:13.683051Z","id":"CVE-2026-79817","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-79818","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-06T20:17:33.550","lastModified":"2026-10-07T18:17:31.053","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in an API interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to obtain sensitive information from the affected system."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ClearPass Policy Manager (CPPM)","defaultStatus":"affected","versions":[{"version":"6.14.0","lessThanOrEqual":"6.14.0","versionType":"semver","status":"affected"},{"version":"6.11.0","lessThanOrEqual":"6.11.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T17:57:25.930763Z","id":"CVE-2026-79818","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-79960","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:33.660","lastModified":"2026-10-13T16:51:21.447","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and change repository visibility through push options, for example making a private repository public. Pull requests created through the AGit flow with a deploy key were also attributed to the owner."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T14:20:37.099663Z","id":"CVE-2026-79960","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/37306","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-7769-9pr9-m24h","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-89430","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:34.297","lastModified":"2026-10-13T16:46:04.457","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea validated a push mirror's remote address against the `[migrations]` allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to `git push`, so a name that later resolved to a blocked or internal address was still reached. A user with administrator access to a repository, which includes repositories they create themselves, could aim push mirror synchronization at internal Git services and force-push the repository's contents to them."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:15:42.946496Z","id":"CVE-2026-89430","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-367"},{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39010","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/pull/39426","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-hcgw-r9gf-8mph","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-94114","sourceIdentifier":"security@apache.org","published":"2026-10-06T20:17:34.420","lastModified":"2026-10-08T06:16:45.597","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Symbolic name not mapping to correct class.\n\n\n\nBCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.\n\n\n\nThis issue affects Apache Commons BCEL: before 6.13.0.\n\n\n\nUsers are recommended to upgrade to version 6.13.0, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Commons BCEL","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.bcel:bcel","repo":"https://gitbox.apache.org/repos/asf/commons-bcel.git","packageURL":"pkg:maven/org.apache.bcel/bcel","versions":[{"version":"0","lessThan":"6.13.0","versionType":"maven","status":"affected"},{"version":"0","lessThan":"14890bf2b9014df25f9b4de86f29b5e917e5656b","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T19:59:20.212043Z","id":"CVE-2026-94114","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-386"}]}],"references":[{"url":"https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b.patch","source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/co1wfk2lyrmpnfhn49o370pvfl978rw6","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/07/12","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-94205","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:34.733","lastModified":"2026-10-13T16:41:45.587","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For `pull_request` activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval, while the workflow definition was still taken from the fork head. Where Actions is enabled and a matching runner is registered, fork-controlled workflow code could run on the base repository's runners without an explicit approval."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:11:31.504995Z","id":"CVE-2026-94205","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-441"},{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39399","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-xh39-mxw9-34pp","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Exploit","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-95106","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:34.867","lastModified":"2026-10-13T16:27:19.200","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path to the first entry, while `git checkout`, Gitea Actions, and release archives use the last. A contributor could open a pull request whose diff and file views show benign content while CI and checkouts at the same commit use different, attacker-controlled content. Incoming objects are now checked for consistency; objects already stored in existing repositories are not rescanned."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:07:25.322446Z","id":"CVE-2026-95106","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-706"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39472","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-6pv5-8rp7-8c75","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-95112","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:34.963","lastModified":"2026-10-13T15:36:44.343","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as \"closes\" or \"fixes\" once per Markdown link, giving processing time quadratic in the input size. An authenticated user able to submit issue or comment content could send a crafted body of about 1 MB that keeps a CPU core busy for several minutes while holding a database transaction open."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T12:25:19.083201Z","id":"CVE-2026-95112","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-407"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39396","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-467c-4w7p-8427","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-96399","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:35.270","lastModified":"2026-10-13T15:36:39.100","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gitea rendered issue references, causing a runtime panic that terminated the Gitea process. A user who can edit a repository's external issue tracker settings could make any later rendering of matching content, such as viewing a README, crash the instance for all users."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:10:08.050555Z","id":"CVE-2026-96399","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-125"},{"lang":"en","value":"CWE-248"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39354","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-mw6q-qj47-9g5q","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-96400","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:35.387","lastModified":"2026-10-13T15:36:19.913","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"With `[migrations] ALLOWED_DOMAINS` set to a matching entry such as `*` or a hostname wildcard, Gitea's migration URL validation could permit reserved and link-local addresses, such as `169.254.169.254`, even when `ALLOW_LOCALNETWORKS = false`. The local-network block list did not cover these ranges, and a hostname matching the allow list was accepted regardless of its resolved address. A user who can start migrations on such an instance could reach these addresses from the Gitea server; the default empty `ALLOWED_DOMAINS` configuration is not affected."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T11:35:23.694637Z","id":"CVE-2026-96400","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39426","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-54w9-6cc5-9wj9","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-96404","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:35.500","lastModified":"2026-10-13T15:36:13.843","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"When Gitea's web installer is reachable against a database that already contains users, such as after `INSTALL_LOCK` has been reset to `false`, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its password. If the account is an administrator, the session grants full administrative access, including changing the account's password. Databases with a single user also did not require the reinstall confirmation."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T14:26:36.461394Z","id":"CVE-2026-96404","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39400","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-9h7g-h754-c8x2","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Exploit","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-96580","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:35.600","lastModified":"2026-10-13T15:36:06.190","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea expanded a workflow's static `strategy.matrix` into its full Cartesian product without a size limit when creating a run, before the fork pull request approval gate applied. A user who can open a pull request from a fork could submit a small workflow file whose matrix expands to a very large number of jobs, consuming server memory and potentially terminating the Gitea process. No runner is required. Static matrices above 256 combinations are now rejected before expansion."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:09:08.500896Z","id":"CVE-2026-96580","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39295","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-p3rv-cr5f-9gjh","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-96589","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T20:17:35.710","lastModified":"2026-10-13T15:36:00.433","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"When a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read access as a collaborator so they can review the repository. Rejecting or cancelling the transfer did not revoke this collaboration, so the named recipient kept persistent read access to the private repository, including its code, issues, pull requests and wiki, and could clone it. The repository owner was not notified. Transfer-granted access is now removed while collaborations that existed before the transfer are preserved."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"1.27.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T14:29:18.292283Z","id":"CVE-2026-96589","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-672"},{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.0.0","matchCriteriaId":"B7A6F93E-7785-4553-A8BB-DA84ACFF76F0"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39042","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-xfqq-h54g-92f8","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-101258","sourceIdentifier":"secalert@redhat.com","published":"2026-10-06T21:17:02.120","lastModified":"2026-10-15T17:17:08.383","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path access controls at runtime. An attacker can deliver the document directly or through formats that delegate rendering to Ghostscript (for example EPS import or print conversion workflows). Successful exploitation can compromise confidentiality, integrity, and availability of data accessible to the process running Ghostscript."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ghostscript","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"versions":[{"version":"0:10.02.1-16.el10_2.3","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ghostscript","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb"],"versions":[{"version":"0:9.27-19.el8_10","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ghostscript","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb"],"versions":[{"version":"0:9.54.0-19.el9_8.3","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ghostscript","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ghostscript-fonts","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ghostscript","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ghostscript-chinese","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ghostscript-fonts","cpes":["cpe:/o:redhat:enterprise_linux:7"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:45:32.190435Z","id":"CVE-2026-101258","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:83551","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:83552","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:83553","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-101258","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542396","source":"secalert@redhat.com"},{"url":"https://github.com/v12-security/pocs/tree/main/ghostscript","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-104045","sourceIdentifier":"secalert@redhat.com","published":"2026-10-06T21:17:04.163","lastModified":"2026-10-13T15:35:49.377","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in SSSD. A local user can trigger a Denial of Service (DoS) by exploiting a race condition in the autofs responder between asynchronous enumeration completion and map invalidation. By repeatedly sending concurrent map enumeration and invalidation requests, an attacker can cause memory to leak, leading to excessive memory consumption that can disrupt or crash the autofs service."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:22:48.461487Z","id":"CVE-2026-104045","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-772"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:fedoraproject:sssd:2.12.0:*:*:*:*:*:*:*","matchCriteriaId":"3DC51156-297F-4FE9-B867-D51191E0C9CB"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*","matchCriteriaId":"932D137F-528B-4526-9A89-CD59FA1AB0FE"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*","matchCriteriaId":"142AD0DD-4CF3-4D74-9442-459CE3347E3A"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"F4CFF558-3C47-480D-A2F0-BABF26042943"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"7F6FB57C-2BC7-487C-96DD-132683AEB35D"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*","matchCriteriaId":"D65C2163-CFC2-4ABB-8F4E-CB09CEBD006C"}]}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-104045","source":"secalert@redhat.com","tags":["Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478663","source":"secalert@redhat.com","tags":["Exploit","Issue Tracking","Mitigation","Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478663","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-104046","sourceIdentifier":"secalert@redhat.com","published":"2026-10-06T21:17:04.300","lastModified":"2026-10-13T15:35:28.760","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in SSSD (System Security Services Daemon). When Identity Provider (IdP) authentication is enabled, pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing unbounded memory consumption. This memory exhaustion can lead to a Denial of Service (DoS) by degrading or terminating SSSD authentication services."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:45:05.929929Z","id":"CVE-2026-104046","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:fedoraproject:sssd:2.12.0:*:*:*:*:*:*:*","matchCriteriaId":"3DC51156-297F-4FE9-B867-D51191E0C9CB"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*","matchCriteriaId":"932D137F-528B-4526-9A89-CD59FA1AB0FE"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*","matchCriteriaId":"142AD0DD-4CF3-4D74-9442-459CE3347E3A"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"F4CFF558-3C47-480D-A2F0-BABF26042943"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"7F6FB57C-2BC7-487C-96DD-132683AEB35D"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*","matchCriteriaId":"D65C2163-CFC2-4ABB-8F4E-CB09CEBD006C"}]}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-104046","source":"secalert@redhat.com","tags":["Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478662","source":"secalert@redhat.com","tags":["Exploit","Issue Tracking","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105811","sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","published":"2026-10-06T21:17:04.447","lastModified":"2026-10-07T16:17:34.163","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Authorization bypass through a user-controlled key in the optional Amazon Q Business Lambda hook sample ( q-business-lambda-hook https://github.com/aws-solutions-library-samples/qnabot-on-aws/blob/main/source/docs/lambda_hooks/README.md ), available with QnABot on AWS versions 7.0.0 through 7.4.5, might allow an authenticated remote user to read arbitrary Amazon S3 objects in the deploying AWS account. This sample solution provides an example Lambda hook and requires separate, manual deployment and additional setup. It is not deployed automatically with QnABot. Customers who have not deployed this optional sample hook are not affected and do not need to take action. \n\n\n\nTo remediate this issue, affected customers should update the QnABot on AWS stack to version 7.4.6 or later and then redeploy the Amazon Q Business Lambda hook sample stack. Updating the QnABot on AWS stack alone does not deliver the fix."}],"affected":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","affectedData":[{"vendor":"aws","product":"qnabot-on-aws","defaultStatus":"unaffected","versions":[{"version":"7.0.0","lessThan":"7.4.6","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T14:53:00.915761Z","id":"CVE-2026-105811","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/aws-solutions-library-samples/qnabot-on-aws/releases/tag/v7.4.6","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"},{"url":"https://staging.prod.website.marketing.aws.dev/security/security-bulletins/2026-126-aws/","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}]}},{"cve":{"id":"CVE-2026-105812","sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","published":"2026-10-06T21:17:04.600","lastModified":"2026-10-07T16:17:34.333","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values incorporated into generated Python source without safe literal encoding.\n\n\n\nTo remediate this issue, users should upgrade to version 0.3.14. Because this issue persists into generated source, upgrading alone is not sufficient: agents imported with an affected version must be re-imported with version 0.3.14 or later and their local and deployed output artifacts replaced."}],"affected":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","affectedData":[{"vendor":"aws","product":"bedrock-agentcore-starter-toolkit","defaultStatus":"unaffected","versions":[{"version":"0.1.4","lessThanOrEqual":"0.3.13","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:15:00.790484Z","id":"CVE-2026-105812","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://aws.amazon.com/security/security-bulletins/2026-127-aws/","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"},{"url":"https://pypi.org/project/bedrock-agentcore-starter-toolkit/0.3.14/","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}]}},{"cve":{"id":"CVE-2026-106032","sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","published":"2026-10-06T21:17:04.757","lastModified":"2026-10-07T16:17:34.507","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated remote actor in the same AWS account to cause the environment of a user importing a Bedrock Agent to issue arbitrary outbound requests and read arbitrary local files, via crafted external reference values in the OpenAPI content associated with a Bedrock Agent action group.\n\n\n\nTo remediate this issue, users should upgrade to version 0.3.14. Note that bedrock-agentcore-starter-toolkit is deprecated. The @aws/agentcore npm CLI is the supported replacement and does not contain this issue. Migration to @aws/agentcore is the recommended long-term path."}],"affected":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","affectedData":[{"vendor":"aws","product":"bedrock-agentcore-starter-toolkit","defaultStatus":"unaffected","versions":[{"version":"0.1.4","lessThanOrEqual":"0.3.13","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","baseScore":5.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:18:28.813815Z","id":"CVE-2026-106032","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://pypi.org/project/bedrock-agentcore-starter-toolkit/0.3.14/","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"},{"url":"https://staging.prod.website.marketing.aws.dev/security/security-bulletins/2026-127-aws/","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}]}},{"cve":{"id":"CVE-2026-106062","sourceIdentifier":"secalert@redhat.com","published":"2026-10-06T21:17:04.903","lastModified":"2026-10-16T19:17:02.143","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp:2.8/gimp","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp","cpes":["cpe:/o:redhat:enterprise_linux:9"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T16:25:02.536107Z","id":"CVE-2026-106062","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-119"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-106062","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2546654","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-106455","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T21:17:15.727","lastModified":"2026-10-13T15:27:12.653","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authenticated attacker with control over a TechDocs source repository could cause a documentation build to retrieve and publish data from network locations reachable by the build environment. Exposure depends on deployment topology, build mode, and target endpoint protections. Modern cloud metadata services that require tokens or special headers are not directly accessible through the affected behavior. This issue is fixed in @backstage/plugin-techdocs-node versions 1.14.7 and 1.15.5."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":">= 0.71.1, < 1.50.6","status":"affected"},{"version":">= 1.51.0-next.0, < 1.54.8","status":"affected"}]},{"vendor":"@backstage","product":"plugin-techdocs-node","versions":[{"version":">= 0.11.12, < 1.14.7","status":"affected"},{"version":">= 1.15.0, < 1.15.5","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:46:47.854131Z","id":"CVE-2026-106455","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node:*:*:*:*:*:*:*:*","versionStartIncluding":"0.11.12","versionEndExcluding":"1.14.7","matchCriteriaId":"52DB8917-0644-4484-A243-9A2CFCE3D2DD"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node:*:*:*:*:*:*:*:*","versionStartIncluding":"1.15.0","versionEndExcluding":"1.15.5","matchCriteriaId":"837D9752-08C5-431B-B967-BA9826510E0D"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionStartIncluding":"0.71.1","versionEndExcluding":"1.50.6","matchCriteriaId":"242C6C2C-8D2A-43DF-8F22-B2EBB132CEF4"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionStartIncluding":"1.51.1","versionEndExcluding":"1.54.8","matchCriteriaId":"38754AA7-90F4-4854-BB3C-A7E4D0CB3B34"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:1.51.0:-:*:*:*:*:*:*","matchCriteriaId":"91628A7C-3017-4ACD-A100-330BB9F983B2"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:1.51.0:next0:*:*:*:*:*:*","matchCriteriaId":"C5AEDDFD-39AE-4D5C-91C8-49DA83DF407F"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:1.51.0:next1:*:*:*:*:*:*","matchCriteriaId":"8C1DE1E3-862E-4512-A66B-9804B2451D7F"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:1.51.0:next2:*:*:*:*:*:*","matchCriteriaId":"C5D0AF99-42C1-4AD2-84D6-11327EFD314B"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:1.51.0:next3:*:*:*:*:*:*","matchCriteriaId":"3796F724-6F1F-45CA-BB1F-5F2DCCC37986"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/28aa82ae2815988721dd7bbf43cd69c431dcd71b","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/commit/9f76ea445088961f68c364764cc4b7734f368fc0","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.50.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.8","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.55.0","source":"security-advisories@github.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-q38j-6vcm-2f5m","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106456","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T21:17:15.903","lastModified":"2026-10-07T19:17:32.633","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. From 0.5.0 until 0.6.18, the @backstage/plugin-proxy-backend package is affected by inconsistent credential enforcement for overlapping proxy routes. An operator can configure overlapping proxy paths with different credential requirements. When a parent path permits unauthenticated access and a nested path requires credentials, the parent exemption can also cover requests handled by the nested proxy. An unauthenticated caller may therefore reach the nested upstream through Backstage, including with static upstream credentials configured for that proxy. This issue is fixed in version 0.6.18."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":">= 1.28.0, < 1.55.0","status":"affected"}]},{"vendor":"@backstage","product":"plugin-proxy-backend","versions":[{"version":">= 0.5.0, < 0.6.18","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T18:24:26.049704Z","id":"CVE-2026-106456","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/9df92923ac32558bb80edeceafd8de780c44e218","source":"security-advisories@github.com"},{"url":"https://github.com/backstage/backstage/releases/tag/v1.55.0","source":"security-advisories@github.com"},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-472h-9c5j-prrr","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-106457","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T21:17:16.083","lastModified":"2026-10-07T16:17:38.710","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider package is affected by insufficient audience validation in the cloudflare access auth provider. The Cloudflare Access auth provider verifies a token's signature and team issuer, but affected versions do not verify that the token was issued for the Backstage application. A user holding a valid token for another Access application in the same Cloudflare Zero Trust team may therefore be able to authenticate to Backstage if that token reaches the auth endpoint without the Backstage application's audience already being enforced upstream. Cloudflare Access normally evaluates the protected application before forwarding requests. This issue is fixed in version 0.5.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":">= 1.26.0, < 1.55.0","status":"affected"}]},{"vendor":"@backstage","product":"plugin-auth-backend-module-cloudflare-access-provider","versions":[{"version":">= 0.1.0, < 0.5.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:06:22.900061Z","id":"CVE-2026-106457","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/ed9034cacd9def3b3674f0a764fe992f751e204d","source":"security-advisories@github.com"},{"url":"https://github.com/backstage/backstage/releases/tag/v1.55.0","source":"security-advisories@github.com"},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-q333-f498-w2x7","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-106458","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T21:17:16.270","lastModified":"2026-10-07T17:16:48.263","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. From 0.4.0 until 0.5.15, the @backstage/plugin-catalog-backend-module-bitbucket-server package is affected by inconsistent repository filtering in bitbucket server catalog event updates. Deployments using event-driven updates in the Bitbucket Server catalog provider may ingest catalog locations from repositories that are excluded by the provider's configured project, repository, or archived-repository filters. An authenticated Bitbucket Server user who can push to a filtered-out repository that remains readable by the configured Backstage integration can trigger a legitimate repository event. The affected event path may then add a Location for that repository even though scheduled discovery excludes it. This issue is fixed in version 0.5.15."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":">= 1.38.0, < 1.55.0","status":"affected"}]},{"vendor":"@backstage","product":"plugin-catalog-backend-module-bitbucket-server","versions":[{"version":">= 0.4.0, < 0.5.15","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:27:14.886311Z","id":"CVE-2026-106458","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/989db63b6f87c8fc04d440f296ad89e10c79b363","source":"security-advisories@github.com"},{"url":"https://github.com/backstage/backstage/releases/tag/v1.55.0","source":"security-advisories@github.com"},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-c36c-cf6r-ghgj","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-106459","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T21:17:16.450","lastModified":"2026-10-13T15:27:07.093","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. From 0.3.0 until 0.3.8, the @backstage/plugin-scaffolder-backend-module-sentry package is affected by improper input validation in sentry scaffolder actions. An authenticated internal user who can execute the affected actions may cause the backend to contact unintended destinations and disclose Sentry integration credentials. Subsequent impact depends on network reachability and the privileges granted to the configured token. This issue is fixed in version 0.3.8."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":">= 1.47.0, < 1.54.8","status":"affected"}]},{"vendor":"@backstage","product":"plugin-scaffolder-backend-module-sentry","versions":[{"version":">= 0.3.0, < 0.3.8","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T16:24:24.682526Z","id":"CVE-2026-106459","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend-module-sentry:*:*:*:*:*:node.js:*:*","versionStartIncluding":"0.3.0","versionEndExcluding":"0.3.8","matchCriteriaId":"89DDC4FD-AD5D-4C38-9C4E-F7E379FC1650"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionStartIncluding":"1.47.0","versionEndExcluding":"1.54.8","matchCriteriaId":"56B178BB-BDAC-4205-A753-C0B7779CFCC1"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/b0170fad7962fb8c3d71366b5265cf283c7bbcf7","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.8","source":"security-advisories@github.com","tags":["Patch","Product"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.55.0","source":"security-advisories@github.com","tags":["Patch","Product"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-g734-fhp4-7mfp","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106460","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T21:17:16.707","lastModified":"2026-10-09T02:17:00.153","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normalization. The affected paths include a selected profile email marked verified: false, a matching raw provider email marked email_verified: false, and an email obtained only from an ID token marked email_verified: false. Exploitation requires an admitted identity-provider user who can supply or change an unverified email and a deployment that uses the selected profile email to resolve catalog identities. The verification metadata must apply to the selected email; an absent email_verified claim alone is not affected. In an affected configuration, the user may assume another catalog identity and obtain its associated access and permissions. This issue is fixed in versions 0.6.15 and 0.7.5."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":">= 1.18.0, < 1.49.7","status":"affected"},{"version":">= 1.50.0-next.0, < 1.54.7","status":"affected"}]},{"vendor":"@backstage","product":"plugin-auth-node","versions":[{"version":">= 0.3.0, < 0.6.15","status":"affected"},{"version":">= 0.7.0, < 0.7.5","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:47:50.662934Z","id":"CVE-2026-106460","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/507e65ab9160aae6b602513dbfaebdd6be0ca8bb","source":"security-advisories@github.com"},{"url":"https://github.com/backstage/backstage/commit/f0a43dacd1b501064da042b43eab9c1e06371d38","source":"security-advisories@github.com"},{"url":"https://github.com/backstage/backstage/commit/fc5e30aba8ea7282ed3658c3b985cec71051cf9d","source":"security-advisories@github.com"},{"url":"https://github.com/backstage/backstage/releases/tag/v1.49.7","source":"security-advisories@github.com"},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.7","source":"security-advisories@github.com"},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-xm5q-p7w3-x6cp","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-106461","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T21:17:16.870","lastModified":"2026-10-23T15:01:23.893","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in scaffolder task listing. An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibility intended by a deployment's permission policy. Stored task secrets are not included in the affected response, and no integrity or availability impact was identified. This issue is fixed in version 4.1.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":"< 1.54.6","status":"affected"}]},{"vendor":"@backstage","product":"plugin-scaffolder-backend","versions":[{"version":"< 4.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T16:22:38.056765Z","id":"CVE-2026-106461","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend:*:*:*:*:*:node.js:*:*","versionEndExcluding":"4.1.0","matchCriteriaId":"7FFCBA10-BF57-4BEB-9437-7F2E67EB6AFA"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionEndExcluding":"1.54.6","matchCriteriaId":"630B6B8B-D515-4FEF-83C7-9CF51C7EB2F5"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/0253c50673f2832b0b1e9f73348186434e7bd09e","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-7hfw-grcm-cqm6","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106462","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T21:17:17.020","lastModified":"2026-10-22T18:53:09.440","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":"< 1.54.6","status":"affected"}]},{"vendor":"@backstage","product":"plugin-scaffolder-backend","versions":[{"version":"< 4.1.0","status":"affected"}]},{"vendor":"@backstage","product":"plugin-scaffolder-backend-module-azure","versions":[{"version":"< 0.2.25","status":"affected"}]},{"vendor":"@backstage","product":"plugin-scaffolder-backend-module-bitbucket-cloud","versions":[{"version":"< 0.3.10","status":"affected"}]},{"vendor":"@backstage","product":"plugin-scaffolder-backend-module-bitbucket-server","versions":[{"version":"< 0.2.25","status":"affected"}]},{"vendor":"@backstage","product":"plugin-scaffolder-backend-module-github","versions":[{"version":"< 0.9.13","status":"affected"}]},{"vendor":"@backstage","product":"plugin-scaffolder-backend-module-gitlab","versions":[{"version":"< 0.11.10","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:13:05.681052Z","id":"CVE-2026-106462","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-441"},{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend:*:*:*:*:*:node.js:*:*","versionEndExcluding":"0.11.10","matchCriteriaId":"554B8EEF-9383-4C89-94CC-6D4E310C401F"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend-module-azure:*:*:*:*:*:node.js:*:*","versionEndExcluding":"0.2.25","matchCriteriaId":"0C67C4AA-6610-4536-9CEF-562872DEB622"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend-module-bitbucket-cloud:*:*:*:*:*:node.js:*:*","versionEndExcluding":"0.3.10","matchCriteriaId":"51A44535-7A5D-46B0-AC79-5E9DAE726BAE"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend-module-bitbucket-server:*:*:*:*:*:node.js:*:*","versionEndExcluding":"0.2.25","matchCriteriaId":"19CE6595-34DE-4124-B304-FDEFCB3FD00B"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend-module-github:*:*:*:*:*:node.js:*:*","versionEndExcluding":"0.9.13","matchCriteriaId":"164D0465-E901-496E-81D9-935CA9E23C73"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend-module-gitlab:*:*:*:*:*:node.js:*:*","versionEndExcluding":"0.11.10","matchCriteriaId":"B41C96A0-5669-463A-BFC7-B459D29A69D3"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionEndExcluding":"1.54.6","matchCriteriaId":"630B6B8B-D515-4FEF-83C7-9CF51C7EB2F5"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/6fb2a41ea47da37eafe5ea744050ef90be6820c0","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-29gx-h2m3-xw44","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106463","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T21:17:17.170","lastModified":"2026-10-22T18:52:52.427","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped catalog users as an access boundary may admit an unintended catalog identity. Depending on sign-in and permission configuration, this may allow unauthorized access with the permissions of a standard authenticated user. This issue is fixed in version 0.8.7."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":"< 1.54.6","status":"affected"}]},{"vendor":"@backstage","product":"plugin-catalog-backend-module-gitlab","versions":[{"version":"< 0.8.7","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:27:12.856170Z","id":"CVE-2026-106463","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-catalog-backend-module-gitlab:*:*:*:*:*:node.js:*:*","versionEndExcluding":"0.8.7","matchCriteriaId":"C12D8B81-1C7C-43B0-99C3-8049ADEDBD2E"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionEndExcluding":"1.54.6","matchCriteriaId":"630B6B8B-D515-4FEF-83C7-9CF51C7EB2F5"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/c211b4b67d28efd2f4fac63e35e2ac515e305cb3","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-gp6m-x9vw-5c5x","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106486","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T21:17:17.323","lastModified":"2026-10-23T15:01:04.000","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate filesystem paths. An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect paths outside the expected working area, potentially compromising backend confidentiality, integrity, or availability. This issue is fixed in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server 0.2.25."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":"< 1.54.6","status":"affected"}]},{"vendor":"@backstage","product":"plugin-scaffolder-backend-module-bitbucket-cloud","versions":[{"version":"< 0.3.10","status":"affected"}]},{"vendor":"@backstage","product":"plugin-scaffolder-backend-module-bitbucket-server","versions":[{"version":"< 0.2.25","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T16:21:14.423550Z","id":"CVE-2026-106486","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-59"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend-module-bitbucket-cloud:*:*:*:*:*:node.js:*:*","versionEndExcluding":"0.3.10","matchCriteriaId":"51A44535-7A5D-46B0-AC79-5E9DAE726BAE"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend-module-bitbucket-server:*:*:*:*:*:node.js:*:*","versionEndExcluding":"0.2.25","matchCriteriaId":"19CE6595-34DE-4124-B304-FDEFCB3FD00B"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionEndExcluding":"1.54.6","matchCriteriaId":"630B6B8B-D515-4FEF-83C7-9CF51C7EB2F5"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/818528e112c36167d76187e9e63fb518399c4dd2","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-g8rx-f7m5-7794","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106487","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T21:17:17.477","lastModified":"2026-10-22T18:49:32.183","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources readable by that identity. The credential is used only with the local in-cluster API endpoint and is not sent to the catalog-supplied endpoint. This issue is fixed in version 0.21.10."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":"< 1.54.6","status":"affected"}]},{"vendor":"@backstage","product":"plugin-kubernetes-backend","versions":[{"version":"< 0.21.10","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","baseScore":5.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:49:36.578700Z","id":"CVE-2026-106487","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-441"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-kubernetes-backend:*:*:*:*:*:node.js:*:*","versionEndExcluding":"0.21.10","matchCriteriaId":"11B8BD51-68C6-4620-B96B-7F49CA782148"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionEndExcluding":"1.54.6","matchCriteriaId":"630B6B8B-D515-4FEF-83C7-9CF51C7EB2F5"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/c14f8be6908f0f719b16356e5492352311e28946","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-h53x-hjx6-25gr","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106488","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T21:17:17.623","lastModified":"2026-10-22T14:44:06.520","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-based identity resolution with a provider that permits unverified email addresses may allow an authenticated provider user to assume another catalog identity. This may grant access and permissions associated with that user. No direct availability impact is demonstrated. This issue is fixed in version 0.4.20."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":"< 1.54.6","status":"affected"}]},{"vendor":"@backstage","product":"plugin-auth-backend-module-oidc-provider","versions":[{"version":"< 0.4.20","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T18:23:07.990382Z","id":"CVE-2026-106488","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-auth-backend-module-oidc-provider:*:*:*:*:*:node.js:*:*","versionEndExcluding":"0.4.20","matchCriteriaId":"373C8BAA-6691-4E8D-9956-CFA4359337F1"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionEndExcluding":"1.54.6","matchCriteriaId":"630B6B8B-D515-4FEF-83C7-9CF51C7EB2F5"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/1b1f05e82161aaabc226c1d7d498d746956bf942","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-826h-28h9-65hg","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106489","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T21:17:17.770","lastModified":"2026-10-22T14:42:34.903","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper authorization enforcement for techdocs static content. An authenticated user with access to one TechDocs documentation site could craft a URL able to read documentation belonging to a different entity. This only affects deployments using the external TechDocs builder with an external storage provider (S3, GCS, etc.) and the permission framework enabled. Instances that do not use the permission framework are unaffected, since TechDocs content is visible to all authenticated users by design. This issue is fixed in version 2.2.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":"< 1.54.6","status":"affected"}]},{"vendor":"@backstage","product":"plugin-techdocs-backend","versions":[{"version":"< 2.2.4","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:27:04.062511Z","id":"CVE-2026-106489","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-techdocs-backend:*:*:*:*:*:node.js:*:*","versionEndExcluding":"2.2.4","matchCriteriaId":"C0473F89-B1F9-4BC7-8F2C-8C2F5F4C3813"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionEndExcluding":"1.54.6","matchCriteriaId":"630B6B8B-D515-4FEF-83C7-9CF51C7EB2F5"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/bf6bbf7326ada7d96d7b2c4ebc4a71546106f311","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-rg9r-hr7g-5gc2","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106490","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T21:17:17.927","lastModified":"2026-10-22T14:40:50.997","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper input validation in techdocs static content requests. When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure. This issue is fixed in version 2.2.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":"< 1.54.6","status":"affected"}]},{"vendor":"@backstage","product":"plugin-techdocs-backend","versions":[{"version":"< 2.2.4","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:27:11.195983Z","id":"CVE-2026-106490","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-23"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-techdocs-backend:*:*:*:*:*:node.js:*:*","versionEndExcluding":"2.2.4","matchCriteriaId":"C0473F89-B1F9-4BC7-8F2C-8C2F5F4C3813"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionEndExcluding":"1.54.6","matchCriteriaId":"630B6B8B-D515-4FEF-83C7-9CF51C7EB2F5"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/40ecc4c2e88b0218125b0a3405d1f6315b321974","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-7mfx-xg57-53c9","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106491","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T21:17:18.073","lastModified":"2026-10-22T14:10:06.117","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by improper input validation in proxy-backend. An authenticated Backstage user could craft a request URL that causes the proxy-backend to forward the request to a path outside the configured base path on the target server. This is limited to target servers already configured as proxy endpoints and requires Backstage authentication by default. This issue is fixed in version 0.6.17."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":"< 1.54.6","status":"affected"}]},{"vendor":"@backstage","product":"plugin-proxy-backend","versions":[{"version":"< 0.6.17","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T17:51:57.186407Z","id":"CVE-2026-106491","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-proxy-backend:*:*:*:*:*:node.js:*:*","versionEndExcluding":"0.6.17","matchCriteriaId":"C59CBFE3-914A-48D7-B4BF-2BC180F9DA66"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionEndExcluding":"1.54.6","matchCriteriaId":"630B6B8B-D515-4FEF-83C7-9CF51C7EB2F5"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/233287d0ce3133e41549bf92a7470c940a41753c","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-9ghw-48h5-v2w5","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106492","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T21:17:18.220","lastModified":"2026-10-22T13:40:44.623","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for. This issue is fixed in versions 0.16.1 and 0.17.8."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":"< 1.49.6","status":"affected"},{"version":">= 1.50.0-next.0, < 1.54.6","status":"affected"}]},{"vendor":"@backstage","product":"backend-defaults","versions":[{"version":"< 0.16.1","status":"affected"},{"version":">= 0.17.0, < 0.17.8","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:50:58.091263Z","id":"CVE-2026-106492","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"},{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/backend-defaults:*:*:*:*:*:node.js:*:*","versionEndExcluding":"0.16.1","matchCriteriaId":"FE0DEC62-AC08-4DBC-B86A-D456E4A68702"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/backend-defaults:*:*:*:*:*:node.js:*:*","versionStartIncluding":"0.17.0","versionEndExcluding":"0.17.8","matchCriteriaId":"A304D66B-E00E-4B3E-9673-5555FA6F56A5"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionEndExcluding":"1.49.6","matchCriteriaId":"8D095FA7-D58D-4B37-84B2-0E565FF215C1"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionStartIncluding":"1.50.0","versionEndExcluding":"1.54.6","matchCriteriaId":"78EE3EAD-3765-4873-8C71-7A3F3AAA900F"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/40346245c53e1bf26dee56601e95c5c4ab9cc124","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/commit/bc80ffdafbc92ff7b8c72347eace13cb8688fd33","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.49.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-cq7v-rfgc-5c7v","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106493","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T21:17:18.370","lastModified":"2026-10-22T13:13:46.153","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog source could cause catalog descriptors to be read from outside the intended storage boundary, limited to locations reachable with the backend's configured credentials. This issue is fixed in 1.54.6."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":"< 1.54.6","status":"affected"}]},{"vendor":"@backstage","product":"plugin-catalog-backend-module-azure","versions":[{"version":"< 0.17.8","status":"affected"}]},{"vendor":"@backstage","product":"plugin-catalog-backend-module-aws","versions":[{"version":"< 0.4.27","status":"affected"}]},{"vendor":"@backstage","product":"plugin-catalog-backend-module-azure","versions":[{"version":"< 0.3.21","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N","baseScore":3.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.3,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","baseScore":4.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T18:14:25.801155Z","id":"CVE-2026-106493","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionEndExcluding":"1.54.6","matchCriteriaId":"630B6B8B-D515-4FEF-83C7-9CF51C7EB2F5"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/backend-defaults:*:*:*:*:*:node.js:*:*","versionEndExcluding":"0.17.8","matchCriteriaId":"F1BE4EA3-10CB-46E1-AB8F-E9CC77196846"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-catalog-backend-module-aws:*:*:*:*:*:node.js:*:*","versionEndExcluding":"0.4.27","matchCriteriaId":"90FB58A5-3006-4BD7-8F9F-DD77E4FA562C"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-catalog-backend-module-azure:*:*:*:*:*:node.js:*:*","versionEndExcluding":"0.3.21","matchCriteriaId":"70E827C0-82D8-4AFB-9B05-63CAF0319C13"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/47ddbd8b4a3efd812309f759c38f4877fbd9e5ff","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-xvh9-35w9-42m4","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106494","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T21:17:18.520","lastModified":"2026-10-22T13:03:53.500","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper input validation in cloud storage url readers. An attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory. In certain deployment configurations, this could lead to content injection. This issue is fixed in version 0.17.8."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":"< 1.54.6","status":"affected"}]},{"vendor":"@backstage","product":"backend-defaults","versions":[{"version":"< 0.17.8","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":0.7,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:31:02.764800Z","id":"CVE-2026-106494","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-73"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/backend_defaults:*:*:*:*:*:node.js:*:*","versionEndExcluding":"0.17.8","matchCriteriaId":"70F1B92F-D365-4641-B414-2E11F3EBF320"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionEndExcluding":"1.54.6","matchCriteriaId":"630B6B8B-D515-4FEF-83C7-9CF51C7EB2F5"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/14e925ce5b905dd8daa64c3009722febda76034c","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-7649-wm97-w3j3","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106547","sourceIdentifier":"0253b833-3e77-4dfe-9d57-17db1a2f0a74","published":"2026-10-06T21:17:18.670","lastModified":"2026-10-07T16:17:40.033","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly execute arbitrary code with a crafted HDF5 file. When a dataset's unallocated chunks are read, H5D__fill_init() fills the fill-value buffer from datatype and dataspace metadata in the file. If that metadata is inconsistent with the buffer's allocated size, the write goes past the end of the buffer. The attacker can control the content written through the fill value stored in the file."}],"affected":[{"source":"0253b833-3e77-4dfe-9d57-17db1a2f0a74","affectedData":[{"vendor":"The HDF Group","product":"HDF5","defaultStatus":"unaffected","modules":["H5VM_array_fill"],"versions":[{"version":"1.10.0","lessThan":"2.2.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"0253b833-3e77-4dfe-9d57-17db1a2f0a74","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:10:00.506526Z","id":"CVE-2026-106547","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0253b833-3e77-4dfe-9d57-17db1a2f0a74","type":"Secondary","description":[{"lang":"en","value":"CWE-122"}]}],"references":[{"url":"https://github.com/HDFGroup/hdf5/pull/6529","source":"0253b833-3e77-4dfe-9d57-17db1a2f0a74"}]}},{"cve":{"id":"CVE-2026-106550","sourceIdentifier":"cret@cert.org","published":"2026-10-06T21:17:18.810","lastModified":"2026-10-07T20:17:10.790","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Mozilla's Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set(). An attacker controlling the configuration key can write arbitrary properties to constructor.<key>, which walk() resolves to the global Object function. This allows overwriting core JavaScript methods such as Object.assign, leading to persistent process-wide failures and requiring a restart. The issue bypasses existing filters that only block constructor.prototype.* and __proto__.*. Exploitation requires an endpoint that forwards attacker-controlled keys into config.set()."}],"affected":[{"source":"cret@cert.org","affectedData":[{"vendor":"Mozilla","product":"Node-convict","versions":[{"version":"6.2.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:05:14.037126Z","id":"CVE-2026-106550","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-915"},{"lang":"en","value":"CWE-1321"}]}],"references":[{"url":"https://github.com/mozilla/node-convict","source":"cret@cert.org"},{"url":"https://github.com/tomasilluminati/security-research/blob/main/CVE-2026-106550/README.md","source":"cret@cert.org"}]}},{"cve":{"id":"CVE-2026-106552","sourceIdentifier":"cve@mitre.org","published":"2026-10-06T21:17:18.917","lastModified":"2026-10-13T15:26:59.587","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"OpenBSD","product":"OpenSSH","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"10.6","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","baseScore":4.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.6,"impactScore":2.5},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T21:11:55.723070Z","id":"CVE-2026-106552","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-23"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*","versionEndExcluding":"10.6","matchCriteriaId":"09209468-5A53-45C0-8698-8C668E53EBEA"}]}]}],"references":[{"url":"https://www.openssh.org/releasenotes.html#10.6","source":"cve@mitre.org","tags":["Release Notes"]}]}},{"cve":{"id":"CVE-2026-106553","sourceIdentifier":"cve@mitre.org","published":"2026-10-06T21:17:19.067","lastModified":"2026-10-13T15:26:43.823","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"OpenBSD","product":"OpenSSH","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"10.6","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N","baseScore":2.2,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":0.8,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T16:22:41.442164Z","id":"CVE-2026-106553","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-669"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*","versionEndExcluding":"10.6","matchCriteriaId":"09209468-5A53-45C0-8698-8C668E53EBEA"}]}]}],"references":[{"url":"https://www.openssh.org/releasenotes.html#10.6","source":"cve@mitre.org","tags":["Release Notes"]}]}},{"cve":{"id":"CVE-2026-106555","sourceIdentifier":"cve@mitre.org","published":"2026-10-06T21:17:19.213","lastModified":"2026-10-13T14:59:09.973","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"OpenBSD","product":"OpenSSH","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"10.6","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N","baseScore":2.2,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":0.8,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:48:46.566284Z","id":"CVE-2026-106555","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-669"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*","versionEndExcluding":"10.6","matchCriteriaId":"09209468-5A53-45C0-8698-8C668E53EBEA"}]}]}],"references":[{"url":"https://www.openssh.org/releasenotes.html#10.6","source":"cve@mitre.org","tags":["Release Notes"]}]}},{"cve":{"id":"CVE-2026-106582","sourceIdentifier":"cve@mitre.org","published":"2026-10-06T21:17:19.370","lastModified":"2026-10-13T14:57:12.573","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"OpenBSD","product":"OpenSSH","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"10.6","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T14:05:18.589106Z","id":"CVE-2026-106582","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-514"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*","versionEndExcluding":"10.6","matchCriteriaId":"09209468-5A53-45C0-8698-8C668E53EBEA"}]}]}],"references":[{"url":"https://arxiv.org/abs/2609.07709","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://www.openssh.org/releasenotes.html#10.6","source":"cve@mitre.org","tags":["Release Notes"]}]}},{"cve":{"id":"CVE-2026-106584","sourceIdentifier":"cve@mitre.org","published":"2026-10-06T21:17:19.520","lastModified":"2026-10-13T14:40:04.283","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"OpenBSD","product":"OpenSSH","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"10.6","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":2.5,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.0,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T16:05:37.710499Z","id":"CVE-2026-106584","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-193"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*","versionEndExcluding":"10.6","matchCriteriaId":"09209468-5A53-45C0-8698-8C668E53EBEA"}]}]}],"references":[{"url":"https://www.openssh.org/releasenotes.html#10.6","source":"cve@mitre.org","tags":["Release Notes"]}]}},{"cve":{"id":"CVE-2026-106585","sourceIdentifier":"cve@mitre.org","published":"2026-10-06T21:17:19.663","lastModified":"2026-10-15T19:17:18.680","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"OpenBSD","product":"OpenSSH","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"10.6","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-15T16:10:38.448263Z","id":"CVE-2026-106585","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-409"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*","versionEndExcluding":"10.6","matchCriteriaId":"09209468-5A53-45C0-8698-8C668E53EBEA"}]}]}],"references":[{"url":"https://www.openssh.org/releasenotes.html#10.6","source":"cve@mitre.org","tags":["Release Notes"]}]}},{"cve":{"id":"CVE-2026-106586","sourceIdentifier":"cve@mitre.org","published":"2026-10-06T21:17:19.803","lastModified":"2026-10-13T14:39:21.643","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"OpenBSD","product":"OpenSSH","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"10.6","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":2.5,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.0,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T16:19:59.160881Z","id":"CVE-2026-106586","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-670"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*","versionEndExcluding":"10.6","matchCriteriaId":"09209468-5A53-45C0-8698-8C668E53EBEA"}]}]}],"references":[{"url":"https://www.openssh.org/releasenotes.html#10.6","source":"cve@mitre.org","tags":["Release Notes"]}]}},{"cve":{"id":"CVE-2026-19029","sourceIdentifier":"0253b833-3e77-4dfe-9d57-17db1a2f0a74","published":"2026-10-06T21:17:20.410","lastModified":"2026-10-07T17:16:54.353","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based buffer over-read in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c in HDF5 through 2.2.0 lets an attacker cause a denial of service (application crash) with a crafted HDF5 file. When the stored minimum bits equal the full precision of the datatype, the decoder copies d_nelmts * size bytes from the compressed chunk without checking that the chunk holds that many bytes. Both values come from attacker-controlled scale-offset filter parameters in the dataset's filter pipeline message."}],"affected":[{"source":"0253b833-3e77-4dfe-9d57-17db1a2f0a74","affectedData":[{"vendor":"The HDF Group","product":"HDF5","defaultStatus":"unaffected","modules":["H5Z__filter_scaleoffset"],"versions":[{"version":"< 2.2.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"0253b833-3e77-4dfe-9d57-17db1a2f0a74","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T16:04:23.864171Z","id":"CVE-2026-19029","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0253b833-3e77-4dfe-9d57-17db1a2f0a74","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/HDFGroup/hdf5/pull/6718","source":"0253b833-3e77-4dfe-9d57-17db1a2f0a74"}]}},{"cve":{"id":"CVE-2026-43598","sourceIdentifier":"psirt@amd.com","published":"2026-10-06T21:17:20.680","lastModified":"2026-10-07T16:17:48.193","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in the AMD ROCm Communication Collectives Library (RCCL) could allow a compromised peer rank or network-adjacent attacker to dereference an attacker-controlled pointer, potentially resulting in remote code execution."}],"affected":[{"source":"psirt@amd.com","affectedData":[{"vendor":"AMD","product":"AMD Instinct™ MI210","defaultStatus":"affected","versions":[{"version":"ROCm 7.14","status":"unaffected"}]},{"vendor":"AMD","product":"AMD Instinct™ MI250","defaultStatus":"affected","versions":[{"version":"ROCm 7.14","status":"unaffected"}]},{"vendor":"AMD","product":"AMD Instinct™ MI300A","defaultStatus":"affected","versions":[{"version":"ROCm 7.14","status":"unaffected"}]},{"vendor":"AMD","product":"AMD Instinct™ MI300X","defaultStatus":"affected","versions":[{"version":"ROCm 7.14","status":"unaffected"}]},{"vendor":"AMD","product":"AMD Instinct™ MI325X","defaultStatus":"affected","versions":[{"version":"ROCm 7.14","status":"unaffected"}]},{"vendor":"AMD","product":"AMD Instinct™ MI350X","defaultStatus":"affected","versions":[{"version":"ROCm 7.14","status":"unaffected"}]},{"vendor":"AMD","product":"AMD Instinct™ MI355X","defaultStatus":"affected","versions":[{"version":"ROCm 7.14","status":"unaffected"}]},{"vendor":"AMD","product":"AMD Instinct™ MI308X","defaultStatus":"affected","versions":[{"version":"ROCm 7.14","status":"unaffected"}]},{"vendor":"AMD","product":"AMD Instinct™ MI250X","defaultStatus":"affected","versions":[{"version":"ROCm 7.14","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@amd.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:00:15.592344Z","id":"CVE-2026-43598","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@amd.com","type":"Secondary","description":[{"lang":"en","value":"CWE-822"}]}],"references":[{"url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6033.html","source":"psirt@amd.com"}]}},{"cve":{"id":"CVE-2026-101023","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T22:16:59.737","lastModified":"2026-10-13T14:39:07.980","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoever holds such an access token could keep access beyond the token's original lifetime."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"28.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:03:22.628993Z","id":"CVE-2026-101023","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.1.0","matchCriteriaId":"A392C59B-D9D1-41C2-BBEC-C0E388C35439"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.1.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39501","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/pull/39507","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.1.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-469m-x4mw-38r3","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-104633","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T22:17:01.200","lastModified":"2026-10-13T14:38:56.493","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated downloads. A source that reported `max_response_items` as `0` made these loops run indefinitely and grow server memory until it was exhausted. Any user who can migrate repositories could point a migration at a server they control and cause a denial of service."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"28.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:51:08.820853Z","id":"CVE-2026-104633","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-835"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.1.0","matchCriteriaId":"A392C59B-D9D1-41C2-BBEC-C0E388C35439"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.1.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39501","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/pull/39507","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.1.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-jj5r-9rpc-8h6h","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105267","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T22:17:02.253","lastModified":"2026-10-13T14:38:48.423","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and without Releases write access could permanently delete published releases of that repository, including their attachments. Protected tag rules covering the release tag still blocked the deletion."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"28.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:02:28.853973Z","id":"CVE-2026-105267","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-732"},{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.1.0","matchCriteriaId":"A392C59B-D9D1-41C2-BBEC-C0E388C35439"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.1.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39501","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/pull/39507","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.1.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-vvqw-mjq8-x248","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105268","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T22:17:02.377","lastModified":"2026-10-13T14:38:35.583","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete attachments that other users had posted in comments on that issue. The contents of the attachments could not be changed."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"28.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T16:09:19.965265Z","id":"CVE-2026-105268","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.1.0","matchCriteriaId":"A392C59B-D9D1-41C2-BBEC-C0E388C35439"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.1.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39501","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/pull/39507","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.1.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-96qg-qxxj-r8xq","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106496","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T22:17:04.407","lastModified":"2026-10-16T15:33:47.510","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent enforcement of allowed location types during catalog processing. Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host. This issue is fixed in version 3.9.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":"< 1.54.6","status":"affected"}]},{"vendor":"@backstage","product":"plugin-catalog-backend","versions":[{"version":"< 3.9.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:27:09.255888Z","id":"CVE-2026-106496","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage_plugin-catalog-backend:*:*:*:*:*:node.js:*:*","versionEndExcluding":"3.9.1","matchCriteriaId":"3F9B5927-DD07-4AB5-AEF2-BECDCC9D2BF7"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionEndExcluding":"1.54.6","matchCriteriaId":"630B6B8B-D515-4FEF-83C7-9CF51C7EB2F5"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/23774b61560d851bc69cd6a77d12561b24d11afd","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-pcmq-25r3-5w9v","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106497","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T22:17:04.560","lastModified":"2026-10-16T15:26:26.157","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent catalog property permission evaluation. In deployments that use affected value-based catalog permission conditions as a confidentiality boundary, an authenticated user could receive catalog entity data that policy authors intended to restrict. This issue is fixed in version 3.9.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":"< 1.54.6","status":"affected"}]},{"vendor":"@backstage","product":"plugin-catalog-backend","versions":[{"version":"< 3.9.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T16:19:14.828108Z","id":"CVE-2026-106497","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-178"},{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage_plugin-catalog-backend:*:*:*:*:*:node.js:*:*","versionEndExcluding":"3.9.1","matchCriteriaId":"3F9B5927-DD07-4AB5-AEF2-BECDCC9D2BF7"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionEndExcluding":"1.54.6","matchCriteriaId":"630B6B8B-D515-4FEF-83C7-9CF51C7EB2F5"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/21424faa2e280a6bc6b9e5c5245952f16aafca7b","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-8429-xpcj-3cg5","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106498","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T22:17:04.713","lastModified":"2026-10-16T15:22:13.790","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1, the @backstage/plugin-catalog-backend package is affected by improper url validation in catalog entity placeholder resolution. An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user. This issue is fixed in versions 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":"< 1.49.6","status":"affected"},{"version":">= 1.50.0-next.0, < 1.50.5","status":"affected"},{"version":">= 1.51.0-next.0, < 1.51.3","status":"affected"},{"version":">= 1.52.0-next.0, < 1.53.2","status":"affected"},{"version":">= 1.54.0-next.0, < 1.54.6","status":"affected"}]},{"vendor":"@backstage","product":"plugin-catalog-backend","versions":[{"version":"< 3.5.1","status":"affected"},{"version":">= 3.6.0, < 3.6.2","status":"affected"},{"version":">= 3.7.0, < 3.7.2","status":"affected"},{"version":">= 3.8.0, < 3.8.2","status":"affected"},{"version":">= 3.9.0, < 3.9.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:54:51.540668Z","id":"CVE-2026-106498","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"},{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage_plugin-catalog-backend:*:*:*:*:*:node.js:*:*","versionEndExcluding":"3.5.1","matchCriteriaId":"E352863A-473B-4E3D-B274-1AEDA83923A2"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage_plugin-catalog-backend:*:*:*:*:*:node.js:*:*","versionStartIncluding":"3.6.0","versionEndExcluding":"3.6.2","matchCriteriaId":"64717908-A121-43E2-83FF-56E1BC786A9C"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage_plugin-catalog-backend:*:*:*:*:*:node.js:*:*","versionStartIncluding":"3.7.0","versionEndExcluding":"3.7.2","matchCriteriaId":"1E1F3A76-5F43-4C34-880F-5082BA0FBD8E"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage_plugin-catalog-backend:*:*:*:*:*:node.js:*:*","versionStartIncluding":"3.8.0","versionEndExcluding":"3.8.2","matchCriteriaId":"3A2CAA96-1B99-41FC-AF0C-216DAB8EE659"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage_plugin-catalog-backend:*:*:*:*:*:node.js:*:*","versionStartIncluding":"3.9.0","versionEndExcluding":"3.9.1","matchCriteriaId":"7F0C2290-97C5-404F-B9E1-05A9335E6B82"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionEndExcluding":"1.49.6","matchCriteriaId":"8D095FA7-D58D-4B37-84B2-0E565FF215C1"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionStartIncluding":"1.50.0","versionEndExcluding":"1.50.5","matchCriteriaId":"DC5B9818-20D9-4507-80D2-6242DED888AE"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionStartIncluding":"1.51.0","versionEndExcluding":"1.51.3","matchCriteriaId":"5E1B77C6-895E-4F0A-8195-2533B5FD7847"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionStartIncluding":"1.52.0","versionEndExcluding":"1.53.2","matchCriteriaId":"E18CFF79-956B-4F89-A34E-31FE85217BF2"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionStartIncluding":"1.54.0","versionEndExcluding":"1.54.6","matchCriteriaId":"D3E2CBFE-A84D-4D5C-BF4E-E4460AB99E18"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/0b0f6fc89b4eb4872c76a498abbe1dc65998bb6e","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/commit/286bfc1f9cc3608a073b41016be302785be385d1","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/commit/61a10f19926aeda7f4a32de48d733e6710584634","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/commit/99729e925fd2bd40ba210022351a0ee6318e6197","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/commit/e786ac309ed2d775daf2309393c015c43902d6f6","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.49.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.50.5","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.51.3","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.53.2","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-qgvj-qcf8-xq73","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106499","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T22:17:04.907","lastModified":"2026-10-15T02:16:07.970","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted and exposed to users who can access the resulting task logs. This issue is fixed in version 4.1.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":"< 1.54.6","status":"affected"}]},{"vendor":"@backstage","product":"plugin-scaffolder-backend","versions":[{"version":"< 4.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T17:45:56.549598Z","id":"CVE-2026-106499","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-532"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend:*:*:*:*:*:*:*:*","versionEndExcluding":"4.1.0","matchCriteriaId":"3B5B4E49-5A0D-4578-B1C3-AA1D17BFFFF2"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionEndExcluding":"1.54.6","matchCriteriaId":"630B6B8B-D515-4FEF-83C7-9CF51C7EB2F5"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/dc30fae2d96cb1606d36cc40b242f9b9e539bd70","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-mfvq-x7vr-rgqg","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106500","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T22:17:05.060","lastModified":"2026-10-13T14:38:24.900","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper task state validation in scaffolder backend. An authenticated user with permission to create and access Scaffolder tasks may, under specific timing and deployment conditions, affect files accessible to the Backstage backend. If backend application files are writable, the confidentiality, integrity, and availability of the backend may be compromised. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":"< 1.49.6","status":"affected"},{"version":">= 1.50.0-next.0, < 1.50.5","status":"affected"},{"version":">= 1.51.0-next.0, < 1.54.6","status":"affected"}]},{"vendor":"@backstage","product":"plugin-scaffolder-backend","versions":[{"version":"< 3.3.1","status":"affected"},{"version":">= 3.4.0, < 3.4.1","status":"affected"},{"version":">= 4.0.0, < 4.0.3","status":"affected"},{"version":">= 4.0.4, < 4.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:47:41.478403Z","id":"CVE-2026-106500","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-59"},{"lang":"en","value":"CWE-362"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend:*:*:*:*:*:*:*:*","versionEndExcluding":"3.3.1","matchCriteriaId":"1E40C96F-E2DC-4066-8F97-A2A0E669075E"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend:*:*:*:*:*:*:*:*","versionStartIncluding":"3.4.0","versionEndExcluding":"3.4.1","matchCriteriaId":"E52510C2-B9A3-4309-9CD6-537E7F142C00"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.3","matchCriteriaId":"FE34FC94-86CE-48AE-8E79-C5E5C4FB5FE9"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.4","versionEndExcluding":"4.1.0","matchCriteriaId":"E42114C6-ECBB-46A3-BB2B-BF154CA7D7B1"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionEndExcluding":"1.49.6","matchCriteriaId":"8D095FA7-D58D-4B37-84B2-0E565FF215C1"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionStartIncluding":"1.50.0","versionEndExcluding":"1.50.5","matchCriteriaId":"DC5B9818-20D9-4507-80D2-6242DED888AE"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionStartIncluding":"1.51.0","versionEndExcluding":"1.54.6","matchCriteriaId":"C8071EEF-6BEF-4AC1-B333-CCFC0FFFA72E"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/0d24f1b8701f3dde6cd597f81997c1ea873a43ae","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/commit/56be299dd3ef6706e13e76ea2f8a9b0dd0b6413d","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/commit/9e86c95a1a3ddfd54db03731cd8678aa63495175","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.49.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.50.5","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-xvgh-hmx8-9xxf","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106501","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T22:17:05.217","lastModified":"2026-10-13T14:38:15.587","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":"< 1.49.6","status":"affected"},{"version":">= 1.50.0-next.0, < 1.50.5","status":"affected"},{"version":">= 1.51.0-next.0, < 1.54.6","status":"affected"}]},{"vendor":"@backstage","product":"plugin-scaffolder-backend","versions":[{"version":"< 3.3.1","status":"affected"},{"version":">= 3.4.0, < 3.4.1","status":"affected"},{"version":">= 4.0.0, < 4.0.3","status":"affected"},{"version":">= 4.0.4, < 4.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:30:59.165626Z","id":"CVE-2026-106501","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-201"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend:*:*:*:*:*:*:*:*","versionEndExcluding":"3.3.1","matchCriteriaId":"1E40C96F-E2DC-4066-8F97-A2A0E669075E"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend:*:*:*:*:*:*:*:*","versionStartIncluding":"3.4.0","versionEndExcluding":"3.4.1","matchCriteriaId":"E52510C2-B9A3-4309-9CD6-537E7F142C00"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.3","matchCriteriaId":"FE34FC94-86CE-48AE-8E79-C5E5C4FB5FE9"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.4","versionEndExcluding":"4.1.0","matchCriteriaId":"E42114C6-ECBB-46A3-BB2B-BF154CA7D7B1"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionEndExcluding":"1.49.6","matchCriteriaId":"8D095FA7-D58D-4B37-84B2-0E565FF215C1"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionStartIncluding":"1.50.0","versionEndExcluding":"1.50.5","matchCriteriaId":"DC5B9818-20D9-4507-80D2-6242DED888AE"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionStartIncluding":"1.51.0","versionEndExcluding":"1.54.6","matchCriteriaId":"C8071EEF-6BEF-4AC1-B333-CCFC0FFFA72E"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/66d2219edf0abe33ab7d0c1ced5d069d1e065be5","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/commit/c19838870476a8e29144c84b1a5ac0654ec20fb5","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/commit/e262d649981ff99bb01ca7077807ae3e25e85560","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.49.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.50.5","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-g2v8-7jhw-pp8p","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106502","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T22:17:05.373","lastModified":"2026-10-13T14:38:07.077","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose sensitive information in Scaffolder task failure events. Under specific template and failure conditions, an authenticated user may retrieve backend-managed credentials used during task execution from affected task events. This issue is fixed in version 4.1.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":"< 1.54.6","status":"affected"}]},{"vendor":"@backstage","product":"plugin-scaffolder-backend","versions":[{"version":"< 4.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:08:57.835240Z","id":"CVE-2026-106502","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-532"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend:*:*:*:*:*:*:*:*","versionEndExcluding":"4.1.0","matchCriteriaId":"3B5B4E49-5A0D-4578-B1C3-AA1D17BFFFF2"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionEndExcluding":"1.54.6","matchCriteriaId":"630B6B8B-D515-4FEF-83C7-9CF51C7EB2F5"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/3f1e869708f002fb9838624b7379deb251691b47","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-95p4-vv4g-jxxm","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106503","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T22:17:05.513","lastModified":"2026-10-13T14:37:56.910","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass. An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":"< 1.49.6","status":"affected"},{"version":">= 1.50.0-next.0, < 1.50.5","status":"affected"},{"version":">= 1.51.0-next.0, < 1.54.6","status":"affected"}]},{"vendor":"@backstage","product":"plugin-scaffolder-backend","versions":[{"version":"< 3.3.1","status":"affected"},{"version":">= 3.4.0, < 3.4.1","status":"affected"},{"version":">= 4.0.0, < 4.0.3","status":"affected"},{"version":">= 4.0.4, < 4.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:55:45.447568Z","id":"CVE-2026-106503","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-178"},{"lang":"en","value":"CWE-284"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend:*:*:*:*:*:*:*:*","versionEndExcluding":"3.3.1","matchCriteriaId":"1E40C96F-E2DC-4066-8F97-A2A0E669075E"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend:*:*:*:*:*:*:*:*","versionStartIncluding":"3.4.0","versionEndExcluding":"3.4.1","matchCriteriaId":"E52510C2-B9A3-4309-9CD6-537E7F142C00"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.3","matchCriteriaId":"FE34FC94-86CE-48AE-8E79-C5E5C4FB5FE9"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.4","versionEndExcluding":"4.1.0","matchCriteriaId":"E42114C6-ECBB-46A3-BB2B-BF154CA7D7B1"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionEndExcluding":"1.49.6","matchCriteriaId":"8D095FA7-D58D-4B37-84B2-0E565FF215C1"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionStartIncluding":"1.50.0","versionEndExcluding":"1.50.5","matchCriteriaId":"DC5B9818-20D9-4507-80D2-6242DED888AE"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionStartIncluding":"1.51.0","versionEndExcluding":"1.54.6","matchCriteriaId":"C8071EEF-6BEF-4AC1-B333-CCFC0FFFA72E"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/11c1384c0649b8ab26391c6a4e4f34b80ab0d188","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/commit/a91ed72d540e80b62a73b39bb1563ff5018d52d1","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/commit/e307e4f487103d815e484291b3fda778ab9983bf","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.49.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.50.5","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-hmp2-4m7g-22cv","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106504","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T22:17:05.680","lastModified":"2026-10-13T21:08:57.650","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder task logs. An authenticated user who can create and read scaffolder tasks may be able to observe sensitive values in task logs in deployments with restrictive action permissions and affected templates. Exploitation requires a denied action whose input contains such a value. This issue is fixed in version 4.1.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":"< 1.54.6","status":"affected"}]},{"vendor":"@backstage","product":"plugin-scaffolder-backend","versions":[{"version":"< 4.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T16:20:37.738464Z","id":"CVE-2026-106504","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-532"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend:*:*:*:*:*:*:*:*","versionEndExcluding":"4.1.0","matchCriteriaId":"3B5B4E49-5A0D-4578-B1C3-AA1D17BFFFF2"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionEndExcluding":"1.54.6","matchCriteriaId":"630B6B8B-D515-4FEF-83C7-9CF51C7EB2F5"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/3eb3dc59eb0da0deccd532f19eb460bb452c9efb","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-4xvq-3m68-h444","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106505","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T22:17:05.837","lastModified":"2026-10-09T17:58:21.970","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbitrary code on the TechDocs backend host during documentation generation. This issue is fixed in versions 1.14.6 and 1.15.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":"< 1.50.5","status":"affected"},{"version":">= 1.51.0-next.0, < 1.54.6","status":"affected"}]},{"vendor":"@backstage","product":"plugin-techdocs-node","versions":[{"version":"< 1.14.6","status":"affected"},{"version":">= 1.15.0, < 1.15.4","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":5.3},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T16:12:41.246162Z","id":"CVE-2026-106505","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-426"},{"lang":"en","value":"CWE-436"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node:*:*:*:*:*:*:*:*","versionEndExcluding":"1.14.6","matchCriteriaId":"F5189301-5EC3-4F9F-952B-7993F3BFBF06"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node:*:*:*:*:*:*:*:*","versionStartIncluding":"1.15.0","versionEndExcluding":"1.15.4","matchCriteriaId":"5CB4C5CD-5A68-42D5-AE7F-65362C0E7165"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionEndExcluding":"1.50.5","matchCriteriaId":"FEBB527C-B9CC-4ACD-ACE6-5E42C47576B7"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionStartIncluding":"1.51.1","versionEndExcluding":"1.54.6","matchCriteriaId":"949CA2FA-BF88-425F-910D-3D7E817E6420"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:1.51.0:-:*:*:*:*:*:*","matchCriteriaId":"91628A7C-3017-4ACD-A100-330BB9F983B2"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:1.51.0:next0:*:*:*:*:*:*","matchCriteriaId":"C5AEDDFD-39AE-4D5C-91C8-49DA83DF407F"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:1.51.0:next1:*:*:*:*:*:*","matchCriteriaId":"8C1DE1E3-862E-4512-A66B-9804B2451D7F"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:1.51.0:next2:*:*:*:*:*:*","matchCriteriaId":"C5D0AF99-42C1-4AD2-84D6-11327EFD314B"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:1.51.0:next3:*:*:*:*:*:*","matchCriteriaId":"3796F724-6F1F-45CA-BB1F-5F2DCCC37986"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/a7d995f11a5d27f0efbdbe8bb6c21b06988c79c9","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/commit/ef92d3d2b76046205c580e7152956514c15640db","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.50.5","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-p75x-jh7p-ppcx","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106506","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T22:17:05.993","lastModified":"2026-10-09T17:50:13.653","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input validation in scaffolder task list ordering. An authenticated Backstage user with permission to create and read relevant scaffolder tasks may be able to infer confidential task data under specific conditions. Successful exploitation requires retained task secrets, visibility of a target task, knowledge of the secret structure, and repeated requests. This issue is fixed in version 4.1.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":"< 1.54.6","status":"affected"}]},{"vendor":"@backstage","product":"plugin-scaffolder-backend","versions":[{"version":"< 4.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:27:07.462310Z","id":"CVE-2026-106506","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-202"},{"lang":"en","value":"CWE-203"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend:*:*:*:*:*:*:*:*","versionEndExcluding":"4.1.0","matchCriteriaId":"3B5B4E49-5A0D-4578-B1C3-AA1D17BFFFF2"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionEndExcluding":"1.54.6","matchCriteriaId":"630B6B8B-D515-4FEF-83C7-9CF51C7EB2F5"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/e673a869449874a9169e8f89852e75e862011b93","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-vwp5-f99x-x3rq","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106507","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T22:17:06.153","lastModified":"2026-10-09T17:49:24.090","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by techdocs arbitrary file read via mkdocs snippets. Unsafe path resolution in TechDocs source tree handling allows an authenticated user who can register documentation sources to include content from outside the intended documentation boundary. Depending on deployment, this may expose files readable by the build process. This issue is fixed in version 1.15.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":"< 1.54.6","status":"affected"}]},{"vendor":"@backstage/plugin-techdocs-node","product":"plugin-techdocs-node","versions":[{"version":"< 1.15.4","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:03:07.022146Z","id":"CVE-2026-106507","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-59"},{"lang":"en","value":"CWE-61"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node:*:*:*:*:*:*:*:*","versionEndExcluding":"1.15.4","matchCriteriaId":"DB9CA7E7-4BAC-4C7D-A0D0-1F27F34BBB2C"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionEndExcluding":"1.54.6","matchCriteriaId":"630B6B8B-D515-4FEF-83C7-9CF51C7EB2F5"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/911ca36f10e654c5517da029129230fc05a4f580","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-vmqh-7cj9-mvcj","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106508","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T22:17:06.310","lastModified":"2026-10-09T17:44:55.037","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file exposure through local techdocs publisher. When using the local TechDocs publisher (techdocs.publisher.type: 'local'), it was possible for the documentation serving endpoint to follow filesystem references outside the intended documentation tree, potentially exposing host files to authenticated users. This is mitigated by the fact that exploration requires preconditions that do not arise through normal MkDocs operation. Cloud-based publishers (S3, GCS, Azure Blob Storage) are not affected. This issue is fixed in version 1.15.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":"< 1.54.6","status":"affected"}]},{"vendor":"@backstage","product":"plugin-techdocs-node","versions":[{"version":"< 1.15.4","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:56:28.353880Z","id":"CVE-2026-106508","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-59"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node:*:*:*:*:*:*:*:*","versionEndExcluding":"1.15.4","matchCriteriaId":"DB9CA7E7-4BAC-4C7D-A0D0-1F27F34BBB2C"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionEndExcluding":"1.54.6","matchCriteriaId":"630B6B8B-D515-4FEF-83C7-9CF51C7EB2F5"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/6aecb26f337ffec1d4e67ce903cf1e39b6082ec4","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-cm77-ch27-6w6v","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106509","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T22:17:06.463","lastModified":"2026-10-09T17:34:17.120","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to build documentation locally or in a container, a user with write access to a registered repository can include configuration values in mkdocs.yml that cause arbitrary code execution during the documentation build process. This issue is fixed in versions 1.14.6 and 1.15.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":"< 1.50.5","status":"affected"},{"version":">= 1.51.0-next.0, < 1.54.6","status":"affected"}]},{"vendor":"@backstage","product":"plugin-techdocs-node","versions":[{"version":"< 1.14.6","status":"affected"},{"version":">= 1.15.0, < 1.15.4","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":5.3},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T18:01:39.138438Z","id":"CVE-2026-106509","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-1336"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node:*:*:*:*:*:*:*:*","versionEndExcluding":"1.14.6","matchCriteriaId":"F5189301-5EC3-4F9F-952B-7993F3BFBF06"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage_plugin-techdocs-node:*:*:*:*:*:*:*:*","versionStartIncluding":"1.15.0","versionEndExcluding":"1.15.4","matchCriteriaId":"5CB4C5CD-5A68-42D5-AE7F-65362C0E7165"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionEndExcluding":"1.50.5","matchCriteriaId":"FEBB527C-B9CC-4ACD-ACE6-5E42C47576B7"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionStartIncluding":"1.51.1","versionEndExcluding":"1.54.6","matchCriteriaId":"949CA2FA-BF88-425F-910D-3D7E817E6420"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:1.51.0:-:*:*:*:*:*:*","matchCriteriaId":"91628A7C-3017-4ACD-A100-330BB9F983B2"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:1.51.0:next0:*:*:*:*:*:*","matchCriteriaId":"C5AEDDFD-39AE-4D5C-91C8-49DA83DF407F"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:1.51.0:next1:*:*:*:*:*:*","matchCriteriaId":"8C1DE1E3-862E-4512-A66B-9804B2451D7F"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:1.51.0:next2:*:*:*:*:*:*","matchCriteriaId":"C5D0AF99-42C1-4AD2-84D6-11327EFD314B"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:1.51.0:next3:*:*:*:*:*:*","matchCriteriaId":"3796F724-6F1F-45CA-BB1F-5F2DCCC37986"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/02cd7cdbb18b687446277b5602adaee7f1d53cbb","source":"security-advisories@github.com","tags":["Exploit","Patch"]},{"url":"https://github.com/backstage/backstage/commit/a900a9953c8f7ad3ba1906d1d257725a9996cc9d","source":"security-advisories@github.com","tags":["Exploit","Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.50.5","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-8w7q-29mw-gf5c","source":"security-advisories@github.com","tags":["Vendor Advisory","Mitigation"]}]}},{"cve":{"id":"CVE-2026-106587","sourceIdentifier":"cve@mitre.org","published":"2026-10-06T22:17:06.620","lastModified":"2026-10-09T16:39:23.107","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"OpenBSD","product":"OpenSSH","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"10.6","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","baseScore":3.6,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.0,"impactScore":2.5},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:53:46.966005Z","id":"CVE-2026-106587","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-843"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*","versionEndExcluding":"10.6","matchCriteriaId":"09209468-5A53-45C0-8698-8C668E53EBEA"}]}]}],"references":[{"url":"https://www.openssh.org/releasenotes.html#10.6","source":"cve@mitre.org","tags":["Release Notes"]}]}},{"cve":{"id":"CVE-2026-106588","sourceIdentifier":"cve@mitre.org","published":"2026-10-06T22:17:06.770","lastModified":"2026-10-07T15:17:18.253","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"OpenBSD","product":"OpenSSH","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"10.6","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T14:04:11.896291Z","id":"CVE-2026-106588","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-653"}]}],"references":[{"url":"https://www.openssh.org/releasenotes.html#10.6","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-106589","sourceIdentifier":"cve@mitre.org","published":"2026-10-06T22:17:06.920","lastModified":"2026-10-07T16:17:44.730","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related to the GatewayPorts and StreamLocalForwarding configuration options, and lack of support for file-descriptor passing and unprivileged allocation of PTY devices."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"OpenBSD","product":"OpenSSH","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"10.6","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":2.9,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.4,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:42:26.762471Z","id":"CVE-2026-106589","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-272"}]}],"references":[{"url":"https://www.openssh.org/releasenotes.html#10.6","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-65122","sourceIdentifier":"psirt@nvidia.com","published":"2026-10-06T22:17:07.270","lastModified":"2026-10-07T16:17:50.707","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA TensorRT contains a vulnerability where an attacker can cause an out of bounds read. A successful exploit of this vulnerability may lead to denial of service."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"TensorRT","defaultStatus":"unaffected","platforms":["All platforms"],"versions":[{"version":"0 to 11.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:39:00.561001Z","id":"CVE-2026-65122","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5891","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65122","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65122","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-65142","sourceIdentifier":"psirt@nvidia.com","published":"2026-10-06T22:17:07.430","lastModified":"2026-10-07T16:17:50.840","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA Model-Optimizer contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"Model-Optimizer","defaultStatus":"unaffected","platforms":["All"],"versions":[{"version":"0-0.43.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:40:25.300722Z","id":"CVE-2026-65142","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5903","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65142","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65142","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-86684","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T22:17:07.570","lastModified":"2026-10-13T18:05:50.717","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with `[security] IMPORT_LOCAL_PATHS = true`, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the server when the repository owner has that permission. Gitea then pushed the repository's refs into an existing Git repository at that path with the permissions of the Gitea process."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"1.18.0","lessThanOrEqual":"28.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:05:48.076581Z","id":"CVE-2026-86684","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionStartIncluding":"1.18.0","versionEndExcluding":"28.1.0","matchCriteriaId":"D4547B13-CEBE-486D-99F6-426D24328126"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.1.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39501","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/pull/39507","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.1.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-7v5j-mph8-9w6g","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Exploit","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-89182","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T22:17:07.690","lastModified":"2026-10-13T18:03:37.053","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as private, but the post-receive hook still applied the `repo.private=false` push option to an empty repository created by push. Any user who can create repositories could make their new repository public in violation of the instance policy. The default configuration is not affected."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"1.27.0","lessThanOrEqual":"28.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T11:33:52.355355Z","id":"CVE-2026-89182","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionStartIncluding":"1.27.0","versionEndExcluding":"28.1.0","matchCriteriaId":"C6BE01FE-1756-403D-AA0E-FAF561831D0A"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.1.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39501","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/pull/39507","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.1.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-fx95-gwfc-grgc","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Mitigation","Vendor Advisory"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-fx95-gwfc-grgc","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-96594","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T22:17:07.810","lastModified":"2026-10-13T17:59:22.620","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by the browser on the Gitea origin. A user who can push to a repository could run JavaScript in the session of a victim who opens the media URL and act with the victim's permissions."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"28.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:04:06.630412Z","id":"CVE-2026-96594","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.1.0","matchCriteriaId":"A392C59B-D9D1-41C2-BBEC-C0E388C35439"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.1.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39501","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/pull/39507","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.1.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-94rx-fqm6-q23v","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-97208","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T22:17:07.927","lastModified":"2026-10-13T17:56:32.037","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whether mirroring was enabled and not the `[mirror] DISABLE_NEW_PUSH` setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where the site administrator had disabled them. A push mirror pushes all refs of the repository to a remote chosen by the caller, on each commit or on a schedule."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"28.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:04:45.452755Z","id":"CVE-2026-97208","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*","versionEndExcluding":"28.1.0","matchCriteriaId":"A392C59B-D9D1-41C2-BBEC-C0E388C35439"}]}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.1.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39501","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/pull/39507","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.1.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-8hhh-mqpg-jpxc","source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-97626","sourceIdentifier":"88ee5874-cf24-4952-aea0-31affedb7ff2","published":"2026-10-06T22:17:08.047","lastModified":"2026-10-07T21:17:22.833","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Requesting a user or organization profile page (`GET /{username}`) with an `Accept: application/rss+xml` or `Accept: application/atom+xml` header returned the owner's activity feed without the visibility check that the profile page and the `.rss` and `.atom` routes apply. Anonymous users, restricted users and non-members could confirm the existence of limited or private users and private organizations and read their profile details and public activity, also when `[other] ENABLE_FEED` was disabled. Activity in private repositories was not included."}],"affected":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","affectedData":[{"vendor":"Gitea","product":"Gitea","defaultStatus":"unaffected","packageName":"gitea.dev","versions":[{"version":"0","lessThanOrEqual":"28.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:01:32.598207Z","id":"CVE-2026-97626","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://blog.gitea.com/release-of-28.1.0/","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39501","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/pull/39507","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.1.0","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-hf55-9cwq-2x64","source":"88ee5874-cf24-4952-aea0-31affedb7ff2"}]}}]}