{"resultsPerPage":545,"startIndex":0,"totalResults":545,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-30T23:38:12.616","vulnerabilities":[{"cve":{"id":"CVE-2026-118585","sourceIdentifier":"cna@vuldb.com","published":"2026-10-29T00:17:25.920","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in configuroweb inventariobasico c9377cdba474deb3eb5a0704d197b5733af16b47/f9db0c0a04d79ad931c218140df4fb23809d4fab. This vulnerability affects unknown code of the file addlist.php of the component Add Product Page. Such manipulation of the argument product name leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"configuroweb","product":"inventariobasico","cpes":["cpe:2.3:a:configuroweb:inventariobasico:*:*:*:*:*:*:*:*"],"modules":["Add Product Page"],"versions":[{"version":"c9377cdba474deb3eb5a0704d197b5733af16b47","status":"affected"},{"version":"f9db0c0a04d79ad931c218140df4fb23809d4fab","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/configuroweb/inventariobasico/","source":"cna@vuldb.com"},{"url":"https://github.com/configuroweb/inventariobasico/issues/1","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-118585","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1025899","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/428025","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/428025/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-118586","sourceIdentifier":"cna@vuldb.com","published":"2026-10-29T00:17:26.123","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in dfm feedfinder2 up to 0.0.4. This issue affects the function find_feeds of the file feedfinder2.py. Performing a manipulation results in server-side request forgery. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"dfm","product":"feedfinder2","cpes":["cpe:2.3:a:dfm:feedfinder2:*:*:*:*:*:*:*:*"],"versions":[{"version":"0.0.1","status":"affected"},{"version":"0.0.2","status":"affected"},{"version":"0.0.3","status":"affected"},{"version":"0.0.4","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/dfm/feedfinder2/","source":"cna@vuldb.com"},{"url":"https://github.com/dfm/feedfinder2/issues/16","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-118586","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1026092","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/428026","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/428026/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-118589","sourceIdentifier":"cna@vuldb.com","published":"2026-10-29T00:17:26.320","lastModified":"2026-10-29T18:17:27.680","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in nschloe meshio up to 5.3.5. Impacted is an unknown function of the file meshio/_vtk_42.py of the component VTK Reader. Executing a manipulation of the argument DIMENSIONS can lead to uncontrolled memory allocation. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"nschloe","product":"meshio","cpes":["cpe:2.3:a:nschloe:meshio:*:*:*:*:*:*:*:*"],"modules":["VTK Reader"],"versions":[{"version":"5.3.0","status":"affected"},{"version":"5.3.1","status":"affected"},{"version":"5.3.2","status":"affected"},{"version":"5.3.3","status":"affected"},{"version":"5.3.4","status":"affected"},{"version":"5.3.5","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T15:43:42.543685Z","id":"CVE-2026-118589","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-789"}]}],"references":[{"url":"https://github.com/nschloe/meshio/","source":"cna@vuldb.com"},{"url":"https://github.com/nschloe/meshio/issues/1576","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-118589","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1026207","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/428027","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/428027/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-113957","sourceIdentifier":"product-security@apple.com","published":"2026-10-29T01:17:22.333","lastModified":"2026-10-29T15:04:37.187","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pull by digest, so that a user runs an image other than the one they pinned. The fix compares the returned digest to the pinned digest and fails the pull on a mismatch. Tag pulls are exempt, because a tag is mutable by design. The fix also verifies the hash of manifests and blobs when they are fetched. This vulnerability is addressed in container version 1.6.0 and containerization version 0.52.1."}],"affected":[{"source":"product-security@apple.com","affectedData":[{"vendor":"Apple","product":"container","versions":[{"version":"0","lessThan":"1.6.0","versionType":"custom","status":"affected"}]},{"vendor":"Apple","product":"containerization","versions":[{"version":"0","lessThan":"0.52.1","versionType":"custom","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://github.com/apple/containerization/security/advisories/GHSA-vgrw-36j7-r93w","source":"product-security@apple.com"}]}},{"cve":{"id":"CVE-2026-118590","sourceIdentifier":"cna@vuldb.com","published":"2026-10-29T01:17:22.900","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function array_from_file of the file nibabel/volumeutils.py of the component Header Handler. The manipulation leads to uncontrolled memory allocation. The attack is possible to be carried out remotely. The pull request to fix this issue awaits acceptance."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"nipy","product":"nibabel","cpes":["cpe:2.3:a:nipy:nibabel:*:*:*:*:*:*:*:*"],"modules":["Header Handler"],"versions":[{"version":"5.4.0","status":"affected"},{"version":"5.4.1","status":"affected"},{"version":"5.4.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-789"}]}],"references":[{"url":"https://github.com/nipy/nibabel/","source":"cna@vuldb.com"},{"url":"https://github.com/nipy/nibabel/issues/1566","source":"cna@vuldb.com"},{"url":"https://github.com/nipy/nibabel/pull/1587","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-118590","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/1026208","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/428028","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/428028/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-21157","sourceIdentifier":"mobile.security@samsung.com","published":"2026-10-29T01:17:23.187","lastModified":"2026-10-30T04:18:24.393","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity."}],"affected":[{"source":"mobile.security@samsung.com","affectedData":[{"vendor":"Samsung Mobile","product":"Bixby","defaultStatus":"affected","versions":[{"version":"4.0.85.6","lessThan":"*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"mobile.security@samsung.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T00:00:00+00:00","id":"CVE-2026-21157","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=07","source":"mobile.security@samsung.com"}]}},{"cve":{"id":"CVE-2026-113387","sourceIdentifier":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6","published":"2026-10-29T02:16:49.937","lastModified":"2026-10-29T15:12:05.973","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts."}],"affected":[{"source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6","affectedData":[{"vendor":"canva","product":"ortto","defaultStatus":"unaffected","platforms":["WordPress"],"versions":[{"version":"0","lessThan":"1.0.25","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:49:46.256831Z","id":"CVE-2026-113387","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://trust.canva.com?tcuUid=acddc58b-886d-487c-b2d4-837fde87ddc8","source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6"}]}},{"cve":{"id":"CVE-2026-113409","sourceIdentifier":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6","published":"2026-10-29T02:16:50.070","lastModified":"2026-10-29T15:12:05.973","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in an administrator's session when they visited the impacted page."}],"affected":[{"source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6","affectedData":[{"vendor":"canva","product":"ortto","defaultStatus":"unaffected","platforms":["WordPress"],"versions":[{"version":"0","lessThan":"1.0.25","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.7,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:49:28.666693Z","id":"CVE-2026-113409","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://trust.canva.com?tcuUid=acddc58b-886d-487c-b2d4-837fde87ddc8","source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6"}]}},{"cve":{"id":"CVE-2026-114173","sourceIdentifier":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6","published":"2026-10-29T02:16:50.187","lastModified":"2026-10-29T15:12:05.973","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store."}],"affected":[{"source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6","affectedData":[{"vendor":"canva","product":"ortto","defaultStatus":"unaffected","platforms":["WordPress"],"versions":[{"version":"0","lessThan":"1.0.25","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:49:36.815264Z","id":"CVE-2026-114173","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6","type":"Secondary","description":[{"lang":"en","value":"CWE-201"}]}],"references":[{"url":"https://trust.canva.com?tcuUid=acddc58b-886d-487c-b2d4-837fde87ddc8","source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6"}]}},{"cve":{"id":"CVE-2026-16889","sourceIdentifier":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f","published":"2026-10-29T02:16:51.803","lastModified":"2026-10-29T15:56:34.127","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDIT_SYSTEM_SETTINGS permission can upload an HTML file that is then served as text/html from the openEQUELLA origin, resulting in stored cross-site scripting. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or everyone."}],"affected":[{"source":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f","affectedData":[{"vendor":"Apereo Foundation","product":"openEQUELLA","defaultStatus":"unaffected","versions":[{"version":"2019.1","lessThan":"2026.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:51:03.808908Z","id":"CVE-2026-16889","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://github.com/openequella/openEQUELLA/security/advisories/GHSA-q2xv-rffq-mj5w","source":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f"},{"url":"https://openequella.github.io/guides/","source":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f"}]}},{"cve":{"id":"CVE-2026-66088","sourceIdentifier":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f","published":"2026-10-29T02:16:52.523","lastModified":"2026-10-29T15:56:34.127","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of the openEQUELLA service account."}],"affected":[{"source":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f","affectedData":[{"vendor":"Apereo Foundation","product":"openEQUELLA","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:50:52.370616Z","id":"CVE-2026-66088","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f","type":"Secondary","description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-749"}]}],"references":[{"url":"https://github.com/openequella/openEQUELLA/security/advisories/GHSA-q8xp-w3fr-hj4v","source":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f"},{"url":"https://openequella.github.io/guides/","source":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f"}]}},{"cve":{"id":"CVE-2026-66089","sourceIdentifier":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f","published":"2026-10-29T02:16:52.663","lastModified":"2026-10-29T15:56:34.127","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the server to issue requests to attacker-specified locations (SSRF)."}],"affected":[{"source":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f","affectedData":[{"vendor":"Apereo Foundation","product":"openEQUELLA","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.1","versionType":"custom","status":"affected"},{"version":"2026.1","lessThanOrEqual":"2026.2","versionType":"custom","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:50:41.667300Z","id":"CVE-2026-66089","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f","type":"Secondary","description":[{"lang":"en","value":"CWE-611"}]}],"references":[{"url":"https://github.com/openequella/openEQUELLA/security/advisories/GHSA-f9wv-5rpf-rq45","source":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f"},{"url":"https://openequella.github.io/guides/","source":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f"}]}},{"cve":{"id":"CVE-2026-66090","sourceIdentifier":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f","published":"2026-10-29T02:16:52.803","lastModified":"2026-10-29T15:56:34.127","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items (CREATE_ITEM) can submit crafted XML to POST /api/item and cause the server to read arbitrary files accessible to the openEQUELLA service, or make requests to attacker-specified locations (SSRF), including cloud instance metadata services."}],"affected":[{"source":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f","affectedData":[{"vendor":"Apereo Foundation","product":"openEQUELLA","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:50:31.628692Z","id":"CVE-2026-66090","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f","type":"Secondary","description":[{"lang":"en","value":"CWE-611"}]}],"references":[{"url":"https://github.com/openequella/openEQUELLA/security/advisories/GHSA-668q-3hpr-6c96","source":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f"},{"url":"https://openequella.github.io/guides/","source":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f"}]}},{"cve":{"id":"CVE-2026-66091","sourceIdentifier":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f","published":"2026-10-29T02:16:52.933","lastModified":"2026-10-29T15:56:34.127","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details (username, first name, last name and email address) within the same institution."}],"affected":[{"source":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f","affectedData":[{"vendor":"Apereo Foundation","product":"openEQUELLA","defaultStatus":"unaffected","versions":[{"version":"2019.2","lessThan":"2026.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:50:21.266595Z","id":"CVE-2026-66091","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/openequella/openEQUELLA/security/advisories/GHSA-mxj9-pmpw-j4xw","source":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f"},{"url":"https://openequella.github.io/guides/","source":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f"}]}},{"cve":{"id":"CVE-2026-66092","sourceIdentifier":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f","published":"2026-10-29T02:16:53.057","lastModified":"2026-10-29T15:56:34.127","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation. A user holding the EDIT_SYSTEM_SETTINGS permission can set a notice containing an arbitrary script (PUT /api/preloginnotice), resulting in stored cross-site scripting on the login page. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or Everyone"}],"affected":[{"source":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f","affectedData":[{"vendor":"Apereo Foundation","product":"openEQUELLA","defaultStatus":"unaffected","versions":[{"version":"2019.1","lessThan":"2026.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T01:50:05.964473Z","id":"CVE-2026-66092","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/openequella/openEQUELLA/security/advisories/GHSA-9jhj-7h37-3j2c","source":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f"},{"url":"https://openequella.github.io/guides/","source":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f"}]}},{"cve":{"id":"CVE-2026-109516","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T04:18:22.763","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The `/wp-json/woo-telegram/v1/main/` REST endpoint is registered with `permission_callback => '__return_true'` and performs no Telegram webhook signature verification, allowing an unauthenticated attacker to POST a forged bot update with a `message.chat.id` set to any WordPress login name; `bftow_get_user_system_id()` resolves this attacker-supplied value to the targeted account via `get_user_by('login', $tgId)` with no ownership proof, and writes a login token computed as `md5($_SERVER['HTTP_USER_AGENT'] . time())` — both inputs are fully attacker-controlled or bounded within seconds using the response's own `Date` header. The resulting token is redeemable at the unauthenticated, capability-check-free, and nonce-less `?action=bftow_create_order&bftow_token=` endpoint, which calls `wp_set_auth_cookie()` unconditionally via `login_user_by_id`, issuing a persistent authenticated session cookie for the targeted account to the attacker. This makes it possible for unauthenticated attackers to log in as any WordPress user, including administrators, given only that user's username."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"guruteam","product":"Bot for Telegram on WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.3.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:32:41.144741Z","id":"CVE-2026-109516","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/tags/1.3.0/includes/BFTOW_Telegram.php#L91","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/tags/1.3.0/includes/BFTOW_Telegram.php#L98","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/tags/1.3.0/includes/BFTOW_User.php#L149","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/tags/1.3.0/includes/BFTOW_User.php#L44","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/tags/1.3.0/includes/BFTOW_User.php#L62","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bot-for-telegram-on-woocommerce/tags/1.3.0/includes/BFTOW_WooCommerce.php#L42","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f6b73e0-c154-4bc4-90bc-0929053b77b0?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-118426","sourceIdentifier":"security@octopus.com","published":"2026-10-29T04:18:35.260","lastModified":"2026-10-29T16:19:37.750","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group search."}],"affected":[{"source":"security@octopus.com","affectedData":[{"vendor":"Octopus Deploy","product":"Octopus Server","defaultStatus":"unaffected","platforms":["Windows","Linux"],"versions":[{"version":"3.0.0","lessThan":"2026.2.13487","versionType":"custom","status":"affected"},{"version":"2026.3.0","lessThan":"2026.3.15909","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@octopus.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security@octopus.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://advisories.octopus.com/post/2026/sa2026-18","source":"security@octopus.com"}]}},{"cve":{"id":"CVE-2026-40063","sourceIdentifier":"talos-cna@cisco.com","published":"2026-10-29T04:18:36.300","lastModified":"2026-10-29T16:21:34.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to an information leak. An attacker can make an unauthenticated HTTP request to trigger this vulnerability."}],"affected":[{"source":"talos-cna@cisco.com","affectedData":[{"vendor":"frangoteam","product":"Frangoteam","defaultStatus":"unaffected","versions":[{"version":"1.3.2-2809","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"talos-cna@cisco.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:33:04.381157Z","id":"CVE-2026-40063","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"talos-cna@cisco.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2418","source":"talos-cna@cisco.com"}]}},{"cve":{"id":"CVE-2026-42922","sourceIdentifier":"talos-cna@cisco.com","published":"2026-10-29T04:18:36.777","lastModified":"2026-10-29T16:21:34.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability."}],"affected":[{"source":"talos-cna@cisco.com","affectedData":[{"vendor":"frangoteam","product":"Frangoteam","defaultStatus":"unaffected","versions":[{"version":"1.3.2-2809","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"talos-cna@cisco.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:33:18.649823Z","id":"CVE-2026-42922","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"talos-cna@cisco.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2419","source":"talos-cna@cisco.com"}]}},{"cve":{"id":"CVE-2026-42949","sourceIdentifier":"talos-cna@cisco.com","published":"2026-10-29T04:18:36.973","lastModified":"2026-10-29T16:21:34.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to execute priviledged operation. An attacker can make an unauthenticated HTTP request to trigger this vulnerability."}],"affected":[{"source":"talos-cna@cisco.com","affectedData":[{"vendor":"frangoteam","product":"Frangoteam","defaultStatus":"unaffected","versions":[{"version":"1.3.2-2809","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"talos-cna@cisco.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":5.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:31:54.417414Z","id":"CVE-2026-42949","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"talos-cna@cisco.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2417","source":"talos-cna@cisco.com"}]}},{"cve":{"id":"CVE-2026-93757","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T04:18:43.763","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Wild Apricot Login plugin for WordPress is vulnerable to Authentication Bypass via SSO Email-Collision Account Binding in all versions up to, and including, 1.0.18. When no WildApricot contact-ID mapping is found for an incoming SSO login, the plugin falls back to a network-global `get_user_by('email', ...)` lookup in `Module.php` to resolve a WordPress user, then `UserSynchronizer::syncWaContact()` binds and `Controller::login()` issues a session cookie via `wp_set_auth_cookie()` for that resolved user — both guarded only by `is_super_admin()` — without ever requiring proof of ownership of the matched WordPress account such as a password, local account-linking confirmation, inbox verification, or administrator approval. This makes it possible for attackers with custom-level WildApricot membership access to authenticate as an existing WordPress subsite administrator on a path-based Multisite network, obtaining a valid network-global authentication cookie for the victim without their credentials. Exploitation requires that the attacker control a WildApricot contact whose email address matches the target WordPress administrator's email — achievable via a public zero-fee membership application on the connected WildApricot organization — and that they complete the SSO flow on any subsite where Wild Apricot Login is active; because WordPress user identities and authentication cookies are network-global, the cookie issued on that subsite is equally valid on any other subsite where the victim user holds an administrator role."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wild-apricot","product":"Wild Apricot Login","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.0.18","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:34:17.390489Z","id":"CVE-2026-93757","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wild-apricot-login/tags/1.0.18/Modules/Authorization/WaLogin/Controller.php#L347","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wild-apricot-login/tags/1.0.18/Modules/Core/Module.php#L112","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wild-apricot-login/tags/1.0.18/Modules/Core/Module.php#L159","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wild-apricot-login/tags/1.0.18/Modules/Core/WaApi/Client.php#L22","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/wild-apricot-login/tags/1.0.18/Modules/Synchronization/UserSynchronizer.php#L36","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9adbe55e-f1a1-4fa8-b28d-539d90d81c68?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-93855","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T04:18:43.923","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'subscriberid' parameter in all versions up to, and including, 1.26.1.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce gating the handler uses the hardcoded action value 'sendpress-is-awesome', which is rendered on the same public page served by the [sp-form formid=\"manage\"] shortcode, making it trivially obtainable by unauthenticated visitors and effectively bypassing the nonce as an access control."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"brewlabs","product":"SendPress Newsletters","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.26.1.20","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:32:52.850610Z","id":"CVE-2026-93855","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/sendpress/tags/1.26.1.20/classes/class-sendpress-data.php#L1300","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/sendpress/tags/1.26.1.20/classes/sc/class-sendpress-sc-forms.php#L580","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b562f31-6a57-4719-a0e1-6a92affef844?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-93904","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T04:18:44.543","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to generic SQL Injection via the 'exclude_posts' parameter in all versions up to, and including, 4.1.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The HMAC authentication gate protecting the endpoint is bypassable on any freshly activated installation where an administrator has not yet visited the settings page, because the secret_key option remains empty until lazily generated at that point, allowing an attacker to compute a valid token using hash_hmac('sha256', '', $timestamp) with any chosen timestamp."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"dejanmarkovic","product":"Social Web Suite – Social Media Auto Post, Social Media Auto Publish","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.1.12","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:33:02.271054Z","id":"CVE-2026-93904","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/social-web-suite/trunk/includes/admin/class-socialwebsuite-admin.php#L432","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/social-web-suite/trunk/includes/admin/class-socialwebsuite-admin.php#L479","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/social-web-suite/trunk/includes/admin/class-socialwebsuite-admin.php#L58","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/social-web-suite/trunk/includes/class-socialwebsuite.php#L831","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d338b15-ec26-4239-b90a-1ea8d5ba5ce0?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-96228","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T04:18:45.110","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.8.1. The public final_login_ajax_action handler resolves a user and issues an authenticated session by matching the wp_sslcare_otp table on only the attacker-supplied phone and cap_data, without verifying the SMS OTP or any server-side single-use state. Because cap_data was chosen by the attacker in the public otp_login_ajax_action step (which stores the row before sending the SMS), the finalize step trivially matches and the user is looked up solely by the sslcare_login_phone meta. This makes it possible for unauthenticated attackers who know a phone-linked user's number to take over that account."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"sslplugins","product":"SSL Wireless SMS Notification","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.8.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:34:31.132896Z","id":"CVE-2026-96228","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://plugins.svn.wordpress.org/ssl-wireless-sms-notification/tags/3.8.1/sslWireless.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e4947d5-91f3-4b36-b309-7c52c483be3d?source=cve","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ssl-wireless-sms-notification/ssl-wireless-sms-notification-360-unauthenticated-privilege-escalation","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-96666","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T04:18:45.273","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Schema App Structured Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has enabled the plugin's 'Remove Microdata' option and approves the malicious comment."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"vberkel","product":"Schema App Structured Data","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.3.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:33:19.918616Z","id":"CVE-2026-96666","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/schema-app-structured-data-for-schemaorg/tags/2.3.2/lib/SchemaFront.php#L40","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/schema-app-structured-data-for-schemaorg/tags/2.3.2/lib/SchemaFront.php#L541","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/schema-app-structured-data-for-schemaorg/tags/2.3.2/lib/SchemaFront.php#L547","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e0a6ba5-6b2a-49b2-8780-df5eb6a5eecd?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-96669","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T04:18:45.430","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'service_type' Cookie in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attack is seeded unauthenticated by supplying a payload via the ?type= query parameter on the public checkout page, which the plugin writes directly into the browser's service_type cookie; this cookie value is later persisted to order meta and rendered unescaped in the admin panel."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wpscripts","product":"Food Store – Online Food Delivery & Pickup","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.5.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:32:18.436979Z","id":"CVE-2026-96669","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/food-store/tags/1.5.5/includes/class-wfs-services.php#L150","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/food-store/tags/1.5.5/includes/class-wfs-services.php#L397","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/food-store/tags/1.5.5/includes/class-wfs-services.php#L398","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/food-store/tags/1.5.5/includes/class-wfs-services.php#L521","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/food-store/tags/1.5.5/includes/wfs-core-functions.php#L795","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60725f12-6219-4c5e-8b5c-e925f0837ddb?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-96741","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T04:18:45.600","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption in all versions up to, and including, 5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the administrator has enabled both the 'Google Tag Manager' integration and the 'Replace integration automatically [Beta]' option, and requires the crafted comment to be approved by an administrator."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"mlfactory","product":"DSGVO All in one for WP","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:32:30.976506Z","id":"CVE-2026-96741","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/dsgvo-all-in-one-for-wp/tags/5.0/dsgvo_all_in_one_wp.php#L1611","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/dsgvo-all-in-one-for-wp/tags/5.0/dsgvo_all_in_one_wp.php#L2901","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/dsgvo-all-in-one-for-wp/tags/5.0/dsgvo_all_in_one_wp.php#L2909","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/219b29a6-6148-4cc9-960c-b28f2d90236e?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2024-3586","sourceIdentifier":"contact@wpscan.com","published":"2026-10-29T06:17:16.020","lastModified":"2026-10-29T15:18:27.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The LetterPress  WordPress plugin before 2.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)"}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"LetterPress","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.4.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":0.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:51:46.110487Z","id":"CVE-2024-3586","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/8e3291be-265c-4dec-876c-3e8e3ec0443a/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-103693","sourceIdentifier":"contact@wpscan.com","published":"2026-10-29T06:17:17.197","lastModified":"2026-10-29T15:18:27.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid  WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP object injection that can lead to arbitrary file write and potential remote code execution."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Frontend Dashboard","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.0.5","versionType":"semver","status":"affected"}]},{"vendor":"Unknown","product":"ProfileGrid","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"6.0.0.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:51:37.238576Z","id":"CVE-2026-103693","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://wpscan.com/vulnerability/c156065f-76f1-4f44-bc57-b7d57560813f/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-105258","sourceIdentifier":"contact@wpscan.com","published":"2026-10-29T06:17:17.317","lastModified":"2026-10-29T15:18:27.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Appointment Booking Plugin  WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads the form; on multisite, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary to unauthenticated visitors."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Appointment Booking Plugin","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.7.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":0.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:51:26.341127Z","id":"CVE-2026-105258","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/134c2bda-aa25-4c79-b2b0-171b17e18591/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-108685","sourceIdentifier":"contact@wpscan.com","published":"2026-10-29T06:17:17.443","lastModified":"2026-10-29T15:18:27.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP Post Author  WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator, when a registration form declares one of those fields."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WP Post Author","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.2.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:51:16.580191Z","id":"CVE-2026-108685","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/605832f7-40d5-4a74-a30a-5f5f2906db63/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-108686","sourceIdentifier":"contact@wpscan.com","published":"2026-10-29T06:17:17.583","lastModified":"2026-10-29T15:18:27.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP Post Author  WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticated users to read the reCAPTCHA secret key when one has been saved."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WP Post Author","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.2.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:51:08.162797Z","id":"CVE-2026-108686","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/50b39d25-51dc-49b4-8480-6a6954af8209/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-108763","sourceIdentifier":"contact@wpscan.com","published":"2026-10-29T06:17:17.697","lastModified":"2026-10-29T15:18:27.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Wallet System for WooCommerce  WordPress plugin before 2.8.2 does not restrict its KYC document submission handler to the current user's own account, taking the target user ID from a client-supplied request field with no ownership or capability check, allowing authenticated users with minimal privileges such as Subscriber or Customer to overwrite the KYC documents and verification status of any other user, including an administrator."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Wallet System for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.8.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:50:59.227802Z","id":"CVE-2026-108763","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://wpscan.com/vulnerability/78a72702-c7c1-4f9a-a832-339e04011e34/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-110030","sourceIdentifier":"contact@wpscan.com","published":"2026-10-29T06:17:18.167","lastModified":"2026-10-29T15:18:27.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not honour the site's user-registration setting, allowing anyone to create a WordPress account and obtain a logged-in session even when registration is disabled."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Hide Price Until Login","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.1.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:50:47.494452Z","id":"CVE-2026-110030","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/31d88b39-9d79-4e56-9af1-424d4d404cd2/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-110504","sourceIdentifier":"contact@wpscan.com","published":"2026-10-29T06:17:18.283","lastModified":"2026-10-29T15:18:27.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Enable SVG, WebP, and ICO Upload","defaultStatus":"unaffected","versions":[{"version":"1.1.3","lessThan":"1.1.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:50:33.201986Z","id":"CVE-2026-110504","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/d13d96d9-2ce7-4f83-9738-eb430f9dfb32/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-110505","sourceIdentifier":"contact@wpscan.com","published":"2026-10-29T06:17:18.397","lastModified":"2026-10-29T15:18:27.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitization and perform Stored Cross-Site Scripting attacks that execute in WebKit-based browsers such as Safari."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Enable SVG, WebP, and ICO Upload","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.1.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:50:23.928357Z","id":"CVE-2026-110505","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/5fc2b6c9-a9e6-48c2-99ec-7912da3297ae/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-110983","sourceIdentifier":"contact@wpscan.com","published":"2026-10-29T06:17:18.513","lastModified":"2026-10-29T15:18:27.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights into loading a crafted page."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WP Photo Album Plus","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"9.3.04.004","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:50:13.515960Z","id":"CVE-2026-110983","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://wpscan.com/vulnerability/3375c88c-7f61-47d6-b9e0-76ad86ce1800/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-111739","sourceIdentifier":"contact@wpscan.com","published":"2026-10-29T06:17:18.627","lastModified":"2026-10-29T15:18:27.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS)  WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker who knows a victim's password and holds their own two-factor-enabled account to satisfy the victim's second-factor check with their own code and obtain the victim's session."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Two Factor Authentication","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.17.0","versionType":"semver","status":"affected"}]},{"vendor":"Unknown","product":"All-In-One Security (AIOS)","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.5.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:49:55.598540Z","id":"CVE-2026-111739","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://wpscan.com/vulnerability/32371146-ddd8-4cb1-8a80-65de2d25319f/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-113616","sourceIdentifier":"contact@wpscan.com","published":"2026-10-29T06:17:18.740","lastModified":"2026-10-29T15:18:27.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any user's password, including an administrator's, and take over the account."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"LogixFast Auth","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.0.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:49:44.222557Z","id":"CVE-2026-113616","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://wpscan.com/vulnerability/ea433cee-716a-4c41-b586-193ed864a1be/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-113617","sourceIdentifier":"contact@wpscan.com","published":"2026-10-29T06:17:18.857","lastModified":"2026-10-29T15:18:27.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to read arbitrary files (including ones containing the database credentials) and delete arbitrary files on the server."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Automated Import Products to Cart","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.0.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:49:30.690444Z","id":"CVE-2026-113617","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://wpscan.com/vulnerability/450a5f9e-3b4c-495d-975f-a24a3d458651/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-114270","sourceIdentifier":"contact@wpscan.com","published":"2026-10-29T06:17:18.980","lastModified":"2026-10-29T15:18:27.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The GeoDirectory  WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"GeoDirectory","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.8.197","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:49:17.985964Z","id":"CVE-2026-114270","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/1d217334-b749-4abd-9d95-4941cd69ae55/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-114488","sourceIdentifier":"secalert@redhat.com","published":"2026-10-29T06:17:19.103","lastModified":"2026-10-29T06:17:19.283","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authentication, allowing a pre-auth attacker on the port 3528 to impersonate any principal on every IIOP-exposed @Remote EJB."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Fuse 7","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"wildfly-iiop-openjdk","cpes":["cpe:/a:redhat:jboss_fuse:7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","packageName":"wildfly-ee-dist","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","packageName":"wildfly-iiop-openjdk","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","packageName":"wildfly-iiop-openjdk","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","packageName":"wildfly-iiop-openjdk","cpes":["cpe:/a:redhat:jbosseapxp"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"wildfly-iiop-openjdk","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Primary","description":[{"lang":"en","value":"CWE-829"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-114488","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491619","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-115245","sourceIdentifier":"contact@wpscan.com","published":"2026-10-29T06:17:19.407","lastModified":"2026-10-29T15:18:27.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a spoofable client-supplied content type, allowing unauthenticated attackers to upload arbitrary files, including PHP, which can lead to remote code execution."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Chat AI with Dispatcher","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:48:40.853677Z","id":"CVE-2026-115245","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://wpscan.com/vulnerability/0981b4a5-dc97-4129-833c-8b297d5200bd/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-115259","sourceIdentifier":"contact@wpscan.com","published":"2026-10-29T06:17:19.557","lastModified":"2026-10-29T15:18:27.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper authorization checks when updating post data through one of its REST API routes in all versions up to, and including, 6.5.8. This makes it possible for authenticated attackers, with Author-level access and above, to modify the title, content, excerpt and other fields of arbitrary posts, pages and attachments, including those belonging to other users."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Photo Engine (Media Organizer & Lightroom)","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"6.6.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:48:27.511678Z","id":"CVE-2026-115259","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://wpscan.com/vulnerability/ef3a6287-bc56-464d-a13f-d3aee46a8df5/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-115282","sourceIdentifier":"contact@wpscan.com","published":"2026-10-29T06:17:19.680","lastModified":"2026-10-29T15:18:27.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering posts through its recipe print feature, allowing unauthenticated users to disclose the title, ID and recipe content of unpublished posts, including drafts, pending, private and password-protected posts, that contain a recipe card block. Its optional \"print only published posts\" protection does not prevent this, because the status check is applied to a different post than the one ultimately rendered."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Recipe Card Blocks Lite","defaultStatus":"unaffected","versions":[{"version":"2.6.4","lessThan":"3.6.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:54:09.954499Z","id":"CVE-2026-115282","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/b80a2b0f-6d9a-4532-9a8e-65f889e8077b/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-115299","sourceIdentifier":"contact@wpscan.com","published":"2026-10-29T06:17:19.810","lastModified":"2026-10-29T15:18:27.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Contact Form by Supsystic  WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attacker to overwrite the site's outbound mail configuration, including the SMTP server, its credentials and the notification recipient, by tricking a logged-in administrator into visiting a crafted page, which can route the Contact Form by Supsystic  WordPress plugin before 1.11.1's contact-form notifications through infrastructure the attacker controls."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Contact Form by Supsystic","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.11.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:53:52.244716Z","id":"CVE-2026-115299","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://wpscan.com/vulnerability/102bbaf2-12c8-48b9-bacb-28de2baec45b/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-115300","sourceIdentifier":"contact@wpscan.com","published":"2026-10-29T06:17:19.947","lastModified":"2026-10-29T15:18:27.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Contact Form by Supsystic  WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and analytics by tricking a logged-in administrator into sending a forged request."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Contact Form by Supsystic","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.11.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:53:39.906286Z","id":"CVE-2026-115300","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://wpscan.com/vulnerability/5d994ec5-df25-4cfc-9b9f-fa4fe84b2e94/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-115301","sourceIdentifier":"contact@wpscan.com","published":"2026-10-29T06:17:20.080","lastModified":"2026-10-29T15:18:27.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Contact Form by Supsystic  WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator to perform server-side template injection and execute arbitrary code on the server. The injected template is compiled and executed whenever any visitor loads a page containing the form, so the stored payload also lets an unauthenticated visitor read server-side secrets such as authentication salts and database credentials."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Contact Form by Supsystic","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.11.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:53:31.460062Z","id":"CVE-2026-115301","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://wpscan.com/vulnerability/15274345-5ad4-456f-9b5e-40d575ecb272/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-115302","sourceIdentifier":"contact@wpscan.com","published":"2026-10-29T06:17:20.217","lastModified":"2026-10-29T15:18:27.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Contact Form by Supsystic  WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records, allowing unauthenticated attackers to delete arbitrary statistics entries."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Contact Form by Supsystic","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.11.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:53:11.291447Z","id":"CVE-2026-115302","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/d68d4cd8-e7a7-49d4-97da-93778795eeec/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-118905","sourceIdentifier":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","published":"2026-10-29T06:17:20.343","lastModified":"2026-10-29T16:19:37.750","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.2 through 0.40.5, `nvm_ls` filters installed versions with a sed program that embeds the requested version pattern in a `\\#...#` address, escaping `.` (and, since 0.40.4, `#`) but not backslash. A version string containing `#` (or `\\#`) therefore closes the address early, and the rest of it is parsed as sed commands: with GNU sed, the `e` command runs a shell command as the user; with BSD sed, the `w` and `r` commands write and read files. This is reachable whenever an attacker-influenced version string is passed to `nvm use`, `nvm which`, `nvm ls`, `nvm version`, `nvm run`, or `nvm exec`, or to `nvm-exec` via `NODE_VERSION`, and at least one version is installed. nvm's own `.nvmrc` parser strips comments, so a bare `nvm use` is not affected; however, the bash `cdnvm` and zsh `load-nvmrc` auto-switch hooks documented in the README read `.nvmrc` as-is and pass it to `nvm ls` and `nvm version`, so a user with one of those hooks installed runs the attacker's command just by changing into a directory under a malicious `.nvmrc`; scripts that run `nvm use \"$(cat .nvmrc)\"` are affected the same way. Version 0.40.6 passes any version pattern containing `#` or a newline through the `.nvmrc` content parser first, so no `#` reaches the sed program."}],"affected":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","affectedData":[{"vendor":"nvm-sh","product":"nvm","defaultStatus":"unaffected","repo":"https://github.com/nvm-sh/nvm","versions":[{"version":"0.31.2","lessThan":"0.40.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"weaknesses":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/nvm-sh/nvm/commit/82315e2b189528a006da6701eac30e8c364ffd22","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"},{"url":"https://github.com/nvm-sh/nvm/pull/3854","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"},{"url":"https://github.com/nvm-sh/nvm/releases/tag/v0.40.6","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"},{"url":"https://github.com/nvm-sh/nvm/security/advisories/GHSA-vgqf-vc3m-4wv3","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"}]}},{"cve":{"id":"CVE-2026-15564","sourceIdentifier":"secalert@redhat.com","published":"2026-10-29T06:17:20.590","lastModified":"2026-10-29T18:17:30.800","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to the IIOP port may be able to construct and send malicious objects and achieve deserialization, if the target EJB allows untyped method parameters, and depending on the potential gadget chains available in the running classpath."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","packageName":"wildfly-ejb3","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","packageName":"wildfly-iiop-openjdk","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","packageName":"wildfly-ejb3","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","packageName":"wildfly-iiop-openjdk","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.4,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T15:37:42.666505Z","id":"CVE-2026-15564","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-829"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-15564","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478005","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-19610","sourceIdentifier":"secalert@redhat.com","published":"2026-10-29T06:17:20.797","lastModified":"2026-10-29T15:17:21.990","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations. The issue occurs because the handler for the read-resource operation on the runtime management resource fails to perform required Role-Based Access Control (RBAC) checks. This allows an authenticated user with low-privileged access, such as the Monitor role, to view sensitive system properties and JVM configuration details that should be restricted."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","packageName":"eap74-els-openjdk11-openshift-rhel8/eap74-els-openjdk11-openshift-rhel8","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","packageName":"eap74-els-openjdk17-openshift-rhel8/eap74-els-openjdk17-openshift-rhel8","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","packageName":"eap74-els-openjdk8-openshift-rhel8/eap74-els-openjdk8-openshift-rhel8","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","packageName":"jboss-eap-7-eap74-els-openjdk17-openshift-rhel8/jboss-eap-7-eap74-els-openjdk17-openshift-rhel8","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","packageName":"jboss-eap-7-eap74-els-openjdk8-openshift-rhel8/jboss-eap-7-eap74-els-openjdk8-openshift-rhel8","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","packageName":"wildfly-platform-mbean","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","packageName":"wildfly-platform-mbean","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","defaultStatus":"affected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","packageName":"wildfly-platform-mbean","cpes":["cpe:/a:redhat:jbosseapxp"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"wildfly-platform-mbean","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:23:50.702189Z","id":"CVE-2026-19610","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-19610","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514537","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-78395","sourceIdentifier":"contact@wpscan.com","published":"2026-10-29T06:17:24.000","lastModified":"2026-10-29T15:18:27.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when processing its front-end link submission, allowing unauthenticated users to submit links to a library configured to require login by reusing a form token obtained from another library that does not."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Link Library","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"7.10.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:52:46.891776Z","id":"CVE-2026-78395","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/e2cf7d5f-b9c9-4320-9fc8-4ac8c6d24f78/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-78396","sourceIdentifier":"contact@wpscan.com","published":"2026-10-29T06:17:24.123","lastModified":"2026-10-29T15:18:27.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose display template is used to render it, allowing unauthenticated users to disclose the telephone number, e-mail address and submitter name stored with links that the settings set is configured not to display."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Link Library","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"7.10.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:52:39.197421Z","id":"CVE-2026-78396","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/0eab05a7-8426-40a6-b0ee-5ae3547b842a/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-85007","sourceIdentifier":"contact@wpscan.com","published":"2026-10-29T06:17:24.230","lastModified":"2026-10-29T15:18:27.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Video Player for YouTube  WordPress plugin before 2.1.4 does not perform a capability check on its player-preset AJAX handler, allowing users with the Contributor role and above to read the site-wide player-preset configuration, and in versions before 2.1.1 to modify and delete it as well."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Video Player for YouTube","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.1.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","baseScore":3.8,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:46:12.610882Z","id":"CVE-2026-85007","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://wpscan.com/vulnerability/dd4db01b-8cb9-42d7-8c0b-9afb6e83dc88/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-86794","sourceIdentifier":"contact@wpscan.com","published":"2026-10-29T06:17:24.350","lastModified":"2026-10-29T15:18:27.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks when processing public event submissions, and does not escape several of the submitted values before outputting them in the administration dashboard and on the public calendar, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of an administrator reviewing the submission."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Community Events","defaultStatus":"unaffected","versions":[{"version":"1.4.9","lessThan":"1.6.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:47:52.999713Z","id":"CVE-2026-86794","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/058aa2e1-0b9c-431f-b0e4-4e93e4977a63/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-88928","sourceIdentifier":"contact@wpscan.com","published":"2026-10-29T06:17:24.647","lastModified":"2026-10-29T15:18:27.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when the request references a tokenisation operation, allowing unauthenticated attackers to overwrite the stored payment token associated with existing orders and delete saved card records."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"PAYCOMET for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"5.36","lessThan":"5.46","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:52:19.236626Z","id":"CVE-2026-88928","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://wpscan.com/vulnerability/aa7b4a44-9584-47e5-b3a1-1dcf876a86e4/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-89216","sourceIdentifier":"contact@wpscan.com","published":"2026-10-29T06:17:24.800","lastModified":"2026-10-29T15:18:27.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The vTables  WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and extract data from the database."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"vTables","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"0.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:52:02.325920Z","id":"CVE-2026-89216","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://wpscan.com/vulnerability/f47fbd01-cca8-46fd-aff3-b9c551b08bac/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-93293","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T06:17:24.940","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Password Protected plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bundled Freemius SDK's purchase-completion handler in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. Once the site's Freemius opt-in is complete (the normal state after an administrator clicks \"Allow & Continue\"), the handler processes the 'purchased_plan' request parameter on any wp-admin request from an authenticated user without any capability, nonce, or purchase validation, and stores it in a persistent, site-wide administrative notice. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts that execute automatically when an administrator views a standard admin page such as their Profile page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"saadiqbal","product":"Password Protected – Protect Your Site Content With a Password","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.8.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:34:09.691037Z","id":"CVE-2026-93293","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&new=3766681%40password-protected%2Ftags%2F2.8.5&old=3627972%40password-protected%2Ftags%2F2.8.4","source":"security@wordfence.com"},{"url":"https://ti.wordfence.io/vendors/patch/3925/download","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c0fe97a-a9e4-46e0-bb53-135c2d9a69a4?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-117548","sourceIdentifier":"secalert@redhat.com","published":"2026-10-29T07:16:44.363","lastModified":"2026-10-29T07:16:44.493","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A NULL pointer dereference flaw was found in 389-ds-base. This flaw occurs when a ModifyDN (rename) operation uses an attribute's schema alias name (such as \"commonName\") instead of its canonical name (such as \"cn\") as the new relative distinguished name. An authenticated attacker with the ModifyDN (rename) permission on the affected entry can use this flaw to crash the directory server, causing a denial of service."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Directory Server 11","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"redhat-ds:11/389-ds-base","cpes":["cpe:/a:redhat:directory_server:11"]},{"vendor":"Red Hat","product":"Red Hat Directory Server 12","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"redhat-ds:12/389-ds-base","cpes":["cpe:/a:redhat:directory_server:12"]},{"vendor":"Red Hat","product":"Red Hat Directory Server 13","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"389-ds-base","cpes":["cpe:/a:redhat:directory_server:13"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"389-ds-base","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"389-ds-base","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"389-ds-base","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"389-ds:1.4/389-ds-base","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"389-ds-base","cpes":["cpe:/o:redhat:enterprise_linux:9"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Primary","description":[{"lang":"en","value":"CWE-476"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-117548","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2561778","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-117627","sourceIdentifier":"secalert@redhat.com","published":"2026-10-29T07:16:44.533","lastModified":"2026-10-29T07:16:44.653","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped during the JWT-based grant flow. This allows an authenticated client to obtain access tokens for a user even if their identity provider claims should have blocked the login."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhbk/keycloak-rhel9","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-117627","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2561959","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-117688","sourceIdentifier":"secalert@redhat.com","published":"2026-10-29T07:16:44.690","lastModified":"2026-10-29T07:16:44.807","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the client registration component of Keycloak, an open-source identity and access management solution. When a vault provider is used to store sensitive information, an authenticated client owner can use a specially crafted reference to trick the system into revealing secrets. By updating a client secret to point to a vault entry and then requesting the client configuration, the owner can see the secret value in plain text. This could lead to the exposure of sensitive credentials that the user should not be able to access."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhbk/keycloak-rhel9","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Primary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-117688","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2561961","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-117859","sourceIdentifier":"secalert@redhat.com","published":"2026-10-29T07:16:44.840","lastModified":"2026-10-29T18:17:24.930","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component. The issue occurs when an authentication flow is restarted, which incorrectly clears the internal markers used to track PAR consumption while leaving the request active. This allows an attacker to reuse the same authorization request to obtain multiple access tokens, bypassing security requirements for single-use requests."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhbk/keycloak-rhel9","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T15:30:08.711098Z","id":"CVE-2026-117859","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-670"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-117859","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2561991","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-118030","sourceIdentifier":"secalert@redhat.com","published":"2026-10-29T07:16:44.990","lastModified":"2026-10-29T15:17:20.680","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An attacker with a users password could exploit this timing gap to use a single one-time code to log in multiple times simultaneously."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhbk/keycloak-rhel9","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":4.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:18:28.734527Z","id":"CVE-2026-118030","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-362"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-118030","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2562005","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2025-62839","sourceIdentifier":"security@qnapsecurity.com.tw","published":"2026-10-29T08:16:59.863","lastModified":"2026-10-29T15:17:14.150","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.\n\nWe have already fixed the vulnerability in the following version:\nHBS 3 Hybrid Backup Sync 26.4.0.521 and later\nHybrid Backup Sync 26.4.0.521 and later\nHybrid Backup Sync 26.4.1.563 and later"}],"affected":[{"source":"security@qnapsecurity.com.tw","affectedData":[{"vendor":"QNAP Systems Inc.","product":"HBS 3 Hybrid Backup Sync","defaultStatus":"unaffected","versions":[{"version":"26.4.x","lessThan":"26.4.0.521","versionType":"custom","status":"affected"}]},{"vendor":"QNAP Systems Inc.","product":"Hybrid Backup Sync","defaultStatus":"unaffected","versions":[{"version":"26.4.x","lessThan":"26.4.0.521","versionType":"custom","status":"affected"},{"version":"26.4.x","lessThan":"26.4.1.563","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@qnapsecurity.com.tw","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:17:33.034037Z","id":"CVE-2025-62839","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@qnapsecurity.com.tw","type":"Secondary","description":[{"lang":"en","value":"CWE-321"}]}],"references":[{"url":"https://www.qnap.com/en/app-release-notes?keyword=HBS%203&app=HybridBackup&product-line=nas","source":"security@qnapsecurity.com.tw"},{"url":"https://www.qnap.com/en/app-release-notes?keyword=Hybrid&app=HybridBackup&product-line=nas","source":"security@qnapsecurity.com.tw"}]}},{"cve":{"id":"CVE-2025-62841","sourceIdentifier":"security@qnapsecurity.com.tw","published":"2026-10-29T08:17:00.057","lastModified":"2026-10-29T15:17:14.313","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.\n\nWe have already fixed the vulnerability in the following version:\nHBS 3 Hybrid Backup Sync 26.4.0.521 and later\nHybrid Backup Sync 26.4.0.521 and later\nHybrid Backup Sync 26.4.1.563 and later"}],"affected":[{"source":"security@qnapsecurity.com.tw","affectedData":[{"vendor":"QNAP Systems Inc.","product":"HBS 3 Hybrid Backup Sync","defaultStatus":"unaffected","versions":[{"version":"26.4.x","lessThan":"26.4.0.521","versionType":"custom","status":"affected"}]},{"vendor":"QNAP Systems Inc.","product":"Hybrid Backup Sync","defaultStatus":"unaffected","versions":[{"version":"26.4.x","lessThan":"26.4.0.521","versionType":"custom","status":"affected"},{"version":"26.4.x","lessThan":"26.4.1.563","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@qnapsecurity.com.tw","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:15:52.238355Z","id":"CVE-2025-62841","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@qnapsecurity.com.tw","type":"Secondary","description":[{"lang":"en","value":"CWE-321"}]}],"references":[{"url":"https://www.qnap.com/en/app-release-notes?keyword=HBS%203&app=HybridBackup&product-line=nas","source":"security@qnapsecurity.com.tw"},{"url":"https://www.qnap.com/en/app-release-notes?keyword=Hybrid&app=HybridBackup&product-line=nas","source":"security@qnapsecurity.com.tw"}]}},{"cve":{"id":"CVE-2026-117174","sourceIdentifier":"security@synology.com","published":"2026-10-29T08:17:00.210","lastModified":"2026-10-29T08:17:00.210","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: VUL-2026-008368 為先回報之相同問題"}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-114358","sourceIdentifier":"vdisclose@cert-in.org.in","published":"2026-10-29T09:17:07.910","lastModified":"2026-10-29T15:45:15.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"This\nvulnerability exists in the Radius\nXenia M2M Platform due to insufficient validation of user supplied input in\nthe password recovery functionality in the web management interface. An\nunauthenticated remote attacker could exploit this vulnerability by supplying\ncrafted SQL query through input fields to the targeted system. \n\n\n\nSuccessful exploitation of this vulnerability\ncould allow the attacker to gain unauthorized access to sensitive information,\nenumerate database structure or modify database records on the targeted system."}],"affected":[{"source":"vdisclose@cert-in.org.in","affectedData":[{"vendor":"Radius Synergies","product":"Radius Xenia M2M Platform","defaultStatus":"unaffected","versions":[{"version":"Version","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vdisclose@cert-in.org.in","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:13:39.146085Z","id":"CVE-2026-114358","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vdisclose@cert-in.org.in","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0529","source":"vdisclose@cert-in.org.in"}]}},{"cve":{"id":"CVE-2026-115303","sourceIdentifier":"contact@wpscan.com","published":"2026-10-29T09:17:08.097","lastModified":"2026-10-29T15:18:27.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticated users to inject arbitrary email headers such as additional Bcc or Cc recipients into the notification email."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Contact Form by Supsystic","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","versions":[{"version":"0","lessThan":"1.11.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@wpscan.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:43:06.128153Z","id":"CVE-2026-115303","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-93"}]}],"references":[{"url":"https://wpscan.com/vulnerability/c32e3ccd-84cb-42a4-a343-353a02ccb541/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-7190","sourceIdentifier":"cve-coordination@incibe.es","published":"2026-10-29T09:17:08.250","lastModified":"2026-10-29T16:01:04.213","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A cross-site scripting (XSS) vulnerability in the ICTBroadcast software, which affects the demo environment. The vulnerability is found in the ‘login.php’ endpoint, where the ‘editForm[extension_username]’ parameter is reflected in the response without proper filtering. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim’s browser once the victim accesses the malicious URL."}],"affected":[{"source":"cve-coordination@incibe.es","affectedData":[{"vendor":"ICT Innovations","product":"ICT Innovations’ PHP-CGI/PHP-FPM configuration","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"March 2026","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@incibe.es","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:23:44.334470Z","id":"CVE-2026-7190","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve-coordination@incibe.es","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-ict-innovations-php-cgiphp-fpm","source":"cve-coordination@incibe.es"}]}},{"cve":{"id":"CVE-2026-85498","sourceIdentifier":"secalert@redhat.com","published":"2026-10-29T09:17:08.400","lastModified":"2026-10-30T02:17:09.967","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigger this flaw, potentially causing an application crash and resulting in a Denial of Service (DoS)."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Hardened Images","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"polkit-main","cpes":["cpe:/a:redhat:hummingbird:1"],"versions":[{"version":"127-5.1.hum1","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"polkit","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"polkit-pkla-compat","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"polkit","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"polkit-gnome","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"polkit","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"polkit-kde","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"polkit-pkla-compat","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"polkit-qt","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"polkit","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"polkit-pkla-compat","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"polkit","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"polkit-pkla-compat","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 5","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:5"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","baseScore":3.5,"baseSeverity":"LOW","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.1,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:23:55.394570Z","id":"CVE-2026-85498","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:66287","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-85498","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528347","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-103485","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T10:17:00.737","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feature.properties[<template-token>]' parameter in all versions up to, and including, 5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that a site administrator has previously configured a public map using the [leaflet-map]+[leaflet-geojson]+[choropleth] shortcode combination whose GeoJSON src URL is one the attacker controls — for example, through compromise of an external data host, a subdomain takeover, or a site intentionally pointing at an attacker-hosted feed."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"hupe13","product":"Extensions for Leaflet Map","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:34:04.826257Z","id":"CVE-2026-103485","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://downloads.wordpress.org/plugin/extensions-leaflet-map.6.0.zip","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/extensions-leaflet-map/tags/5.4/js/choropleth.js#L40","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/extensions-leaflet-map/tags/5.4/js/choropleth.js#L45","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/extensions-leaflet-map/tags/5.4/php/choropleth.php#L47","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/extensions-leaflet-map/tags/5.4/php/choropleth.php#L80","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00c5eb87-3e08-489a-9b30-2fde4aa2274e?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-103875","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T10:17:01.977","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search-string' parameter in all versions up to, and including, 3.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted site to have a publicly accessible page containing an [mla_gallery] shortcode configured with a pagination output mode and an mla_link_href template that reflects a {+request:...+} token, along with enough attachments to trigger pagination."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"dglingren","product":"Media Library Assistant","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.42","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:33:53.742479Z","id":"CVE-2026-103875","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"http://plugins.trac.wordpress.org/changeset/3760471","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.42/includes/class-mla-data.php#L1548","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.42/includes/class-mla-shortcode-support.php#L2482","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.42/includes/class-mla-shortcode-support.php#L2585","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.43/includes/class-mla-shortcode-support.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/357d9d96-afb1-4b62-90cf-8d38a4cede0e?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-104727","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T10:17:02.133","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'condition' Post Meta Array Keys in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"berocket","product":"Sequential Order Numbers for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.6.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:31:53.004762Z","id":"CVE-2026-104727","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/sequential-order-numbers-for-woocommerce/tags/3.6.5/berocket/includes/custom_post.php#L356","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/sequential-order-numbers-for-woocommerce/tags/3.6.5/berocket/includes/functions.php#L520","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/sequential-order-numbers-for-woocommerce/tags/3.6.5/berocket/templates/conditions.php#L57","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/sequential-order-numbers-for-woocommerce/tags/3.6.5/berocket/templates/conditions.php#L92","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/sequential-order-numbers-for-woocommerce/tags/3.6.5/includes/custom_post.php#L85","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/sequential-order-numbers-for-woocommerce/tags/3.7","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/942bceac-0587-4e74-bf3e-12d56dbb2186?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-107627","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T10:17:02.293","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to have published a page containing a Text Animated block with Content set to Blocks, a Latest Comments block with excerpts enabled nested inside it, and at least one Animated Texts value configured — conditions that cause the gs-textanimate script to be enqueued and process the comment excerpts."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wpsoul","product":"Greenshift – animation and page builder blocks","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"13.2.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:33:34.949698Z","id":"CVE-2026-107627","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/tags/13.2.1/blockrender/element/block.php#L587","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/tags/13.2.1/libs/greentextanimate/index.js#L22","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/tags/13.2.1/libs/greentextanimate/index.js#L5","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3755701/greenshift-animation-and-page-builder-blocks/trunk/libs/greentextanimate/index.js","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c3ad041-8e93-4e2b-b38d-9e0b1149950f?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-107629","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T10:17:02.440","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the affected post page to include an Advanced HTML Element block with Split Text animation enabled wrapping a Latest Comments block that displays comment excerpts, as this configuration causes splittext.js to be enqueued and to process the comment content container."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wpsoul","product":"Greenshift – animation and page builder blocks","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"13.2.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:33:27.900127Z","id":"CVE-2026-107629","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/tags/13.2.1/includes/helper.php#L340","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/tags/13.2.1/init.php#L734","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/tags/13.2.1/libs/utility/splittext.js","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/tags/13.2.1/libs_beauty/utility/splittext.js#L47","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3755701/greenshift-animation-and-page-builder-blocks/trunk/libs/utility/splittext.js","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57280079-9843-4e9e-9060-492f72c9ca44?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-107743","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T10:17:02.580","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.5. This is due to the /wp-json/mapster-wp-maps/save-mapmaker REST route being registered with a permission_callback that unconditionally returns true (no capability check, no nonce), together with the mapster_write_config_to_acf() helper only sanitizing string config values with sanitize_text_field() — which strips HTML tags but leaves quote characters intact — and the mapster_wp_map shortcode renderer in mapster_wordpress_maps_shortcode_display() concatenating the stored loading_background_color value into a single-quoted inline style attribute without esc_attr(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"mapster","product":"Mapster WP Maps","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.0.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:31:23.767654Z","id":"CVE-2026-107743","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/mapster-wp-maps/tags/2.0.5/admin/api/class-mapster-wordpress-maps-api.php#L487","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/mapster-wp-maps/tags/2.0.5/admin/api/config-converter.php#L523","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/mapster-wp-maps/tags/2.0.5/admin/api/field-map.php#L304","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/mapster-wp-maps/tags/2.0.5/public/class-mapster-wordpress-maps-public.php#L262","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/mapster-wp-maps/tags/2.0.6/public/class-mapster-wordpress-maps-public.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de1c951f-8b01-44cf-b192-412de9fae4fa?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-109215","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T10:17:02.727","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bbp_reply_content' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has enabled Viewport Images (VPI) and configured a VPI filename that matches an image the attacker can embed in user-generated content — such as a bbPress topic where Subscriber-level Participants are permitted to post replies containing raw img tags."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"litespeedtech","product":"LiteSpeed Cache","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"7.9.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:31:58.165242Z","id":"CVE-2026-109215","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/litespeedtech/lscache_wp/commit/0fc5f9ad69a138b8ee1fe2d07a5e9ac2574e1eb0","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/litespeed-cache/tags/7.9.1/src/media.cls.php#L936","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/litespeed-cache/tags/7.9.1/src/media.cls.php#L968","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/litespeed-cache/tags/7.9.1/src/utility.cls.php#L299","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/litespeed-cache/tags/7.9.2/src/media.cls.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bf9b130-bb1e-43fc-b5c9-337646b8976e?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-110707","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T10:17:02.877","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:group/media:description (XML element in the imported feed)' parameter in all versions up to, and including, 5.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to configure a Feed-to-Post import pointing at an attacker-controlled feed URL and trigger the import via the Run Now action or setup wizard, which is the plugin's standard configuration flow."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"themeisle","product":"RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.2.12","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:32:13.049893Z","id":"CVE-2026-110707","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L1457","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L2445","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L2472","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.11/includes/admin/feedzy-rss-feeds-import.php#L282","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/tags/5.2.13","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47c7e74e-91cb-4bfa-8c21-c60ca0b8cb47?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-111318","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T10:17:03.017","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href attribute of <a> inside .htmega-tab-nav' parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a co-installed plugin such as wpDiscuz with its rich editor enabled whose markup allowlist permits span[class] and a[href] storage, an HT Mega Tabs widget present on the same page as the comment section, and a victim user click on the injected anchor link."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"devitemsllc","product":"HT Mega Addons for Elementor – Elementor Widgets & Template Builder","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.2.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:31:20.669799Z","id":"CVE-2026-111318","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/tags/3.2.7/assets/js/htmega-widgets-active.js#L950","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/tags/3.2.7/assets/js/htmega-widgets-active.js#L967","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/tags/3.2.7/assets/js/htmega-widgets-active.js#L968","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3752766/ht-mega-for-elementor/trunk/assets/js/htmega-widgets-active.js","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe67064b-7b22-48e8-9a07-9870af6c453a?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-111417","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-10-29T10:17:03.160","lastModified":"2026-10-29T15:26:51.413","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the use of a shared token for submitted conversion documents. This may allow unauthorized users to access documents submitted by other users."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"foxit.com","defaultStatus":"unaffected","versions":[{"version":"before 2026-10-29","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:21:13.007500Z","id":"CVE-2026-111417","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2"}]}},{"cve":{"id":"CVE-2026-111418","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-10-29T10:17:03.313","lastModified":"2026-10-29T15:26:51.413","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions on requests to internal IP addresses, potentially allowing discovery of internal network resources."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"foxit.com","defaultStatus":"unaffected","versions":[{"version":"before 2026-10-29","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:21:23.142418Z","id":"CVE-2026-111418","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2"}]}},{"cve":{"id":"CVE-2026-111419","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-10-29T10:17:03.440","lastModified":"2026-10-29T15:26:51.413","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A sensitive information exposure vulnerability exists on the Foxit official website because JavaScript code contains third-party authorization information. This may allow unauthorized parties to obtain or misuse the exposed credentials."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"foxit.com","defaultStatus":"unaffected","versions":[{"version":"before 2026-10-29","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:21:38.355571Z","id":"CVE-2026-111419","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-798"}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2"}]}},{"cve":{"id":"CVE-2026-116763","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T10:17:03.590","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the HTML Minify option (O_OPTM_HTML_MIN) is enabled and a companion plugin renders stored comment content into a raw-text context such as a JSON-LD script block on the same page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"litespeedtech","product":"LiteSpeed Cache","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"7.9.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:31:35.475895Z","id":"CVE-2026-116763","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/litespeed-cache/tags/7.9.1/lib/html-min.cls.php#L103","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/litespeed-cache/tags/7.9.1/lib/html-min.cls.php#L173","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/litespeed-cache/tags/7.9.1/lib/html-min.cls.php#L205","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/litespeed-cache/tags/7.9.1/src/optimize.cls.php#L525","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/litespeed-cache/tags/7.9.1/src/optimizer.cls.php#L57","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3757253%40litespeed-cache&new=3757253%40litespeed-cache","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99f876e0-8f13-468b-b5fa-ca61e3cf57b4?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-117611","sourceIdentifier":"security@checkmk.com","published":"2026-10-29T10:17:03.730","lastModified":"2026-10-29T15:17:20.567","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper certificate validation in Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2.2.0 (EOL): the Certificate Authority stores bundled with \"certifi\" and \"webpki-roots\" include a root CA that trusts eMudhra (emSign) intermediate certificates whose private keys are public."}],"affected":[{"source":"security@checkmk.com","affectedData":[{"vendor":"Checkmk GmbH","product":"Checkmk","defaultStatus":"unaffected","versions":[{"version":"2.5.0","lessThan":"2.5.0p18","versionType":"semver","status":"affected"},{"version":"2.4.0","lessThan":"2.4.0p39","versionType":"semver","status":"affected"},{"version":"2.3.0","lessThan":"2.3.0p52","versionType":"semver","status":"affected"},{"version":"2.2.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@checkmk.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:12:49.762481Z","id":"CVE-2026-117611","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@checkmk.com","type":"Secondary","description":[{"lang":"en","value":"CWE-295"}]}],"references":[{"url":"https://checkmk.com/werk/22169","source":"security@checkmk.com"},{"url":"https://checkmk.com/werk/22623","source":"security@checkmk.com"},{"url":"https://github.com/advisories/GHSA-6q48-6c7w-9gw2","source":"security@checkmk.com"}]}},{"cve":{"id":"CVE-2026-118192","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T10:17:03.997","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'team_id' parameter in all versions up to, and including, 5.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable code path is reached when the season has no associated joomsport_tournament term, which is the default state for newly created seasons."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"beardev","product":"JoomSport – for Sports: Team & League, Football, Hockey & more","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.7.11","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:33:59.898836Z","id":"CVE-2026-118192","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/tags/5.7.11/includes/joomsport-shortcodes.php#L485","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/tags/5.7.11/sportleague/base/wordpress/classes/class-jsport-getplayers.php#L136","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/tags/5.7.11/sportleague/classes/objects/class-jsport-team.php#L280","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/tags/5.7.11/sportleague/classes/objects/class-jsport-team.php#L39","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3770486","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3770486/joomsport-sports-league-results-management/trunk/sportleague/base/wordpress/classes/class-jsport-getplayers.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31931ac8-08f8-4fe7-9318-5a1d8dc89bed?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-88941","sourceIdentifier":"vulnerability@kaspersky.com","published":"2026-10-29T10:17:06.520","lastModified":"2026-10-29T16:19:37.750","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Kaspersky has fixed a vulnerability in the Network Agent for Windows module of Kaspersky Security Center. The vulnerability could potentially cause the Network Agent module of Kaspersky Security Center to malfunction. There are no evidence of the vulnerability exploitation in-the-wild."}],"affected":[{"source":"vulnerability@kaspersky.com","affectedData":[{"vendor":"Kaspersky","product":"Network Agent","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"16.3.0.1207","status":"affected"},{"version":"16.2.0.1477","status":"affected"},{"version":"16.2.0.1023","status":"affected"},{"version":"16.2.0.917","status":"affected"},{"version":"16.1.0.6517","status":"affected"},{"version":"16.0.0.254","status":"affected"},{"version":"15.4.0.8952","status":"affected"},{"version":"15.3.0.392","status":"affected"},{"version":"15.2.0.442","status":"affected"},{"version":"15.1.0.20748","status":"affected"},{"version":"15.1.0.11795","status":"affected"},{"version":"14.0.0.20023","status":"affected"},{"version":"10.5.1781","status":"affected"}]},{"vendor":"Kaspersky","product":"Administration Server","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"15.1.0.22239","status":"affected"},{"version":"15.1.0.20748","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vulnerability@kaspersky.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"vulnerability@kaspersky.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L","baseScore":5.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.0,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:23:11.998474Z","id":"CVE-2026-88941","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vulnerability@kaspersky.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://support.kaspersky.com/vulnerability/list-of-advisories/12430#291026","source":"vulnerability@kaspersky.com"}]}},{"cve":{"id":"CVE-2026-91152","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T10:17:06.693","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'evf_toast_type' parameter in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the sibling evf_toast parameter to decode successfully via atob(), but this is a trivially attacker-controlled prerequisite."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wpeverest","product":"Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.6.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:32:08.899041Z","id":"CVE-2026-91152","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/assets/js/admin/admin.js#L22","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/assets/js/admin/admin.js#L91","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/admin/class-evf-admin-assets.php#L376","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3704878/everest-forms/trunk/assets/js/admin/admin.js","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a017198-daf1-4779-a101-dc539e263e50?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-91153","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T10:17:06.840","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the process. This makes it possible for unauthenticated attackers to extract arbitrary WordPress post meta values — including license keys, API tokens, SMTP credentials, and Stripe or AWS secrets stored on any post type — via form submission notification emails or stored entries. The submission nonce is publicly rendered in every embedded form and can additionally be minted anonymously via the nopriv everest_forms_get_form_update_nonce action, meaning no account or prior authentication of any kind is required to complete the exploit."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wpeverest","product":"Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.6.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T10:31:31.954808Z","id":"CVE-2026-91153","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/themegrill/everest-forms/pull/1669/changes","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/class-evf-ajax.php#L2342","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/class-evf-ajax.php#L681","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/class-evf-form-task.php#L261","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/class-evf-form-task.php#L731","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/class-evf-smart-tags.php#L503","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/shortcodes/class-evf-shortcode-form.php#L370","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3747723/everest-forms/trunk/includes/class-evf-form-task.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b820a342-3aaa-4782-9d82-afe53028b72c?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-105031","sourceIdentifier":"security@apache.org","published":"2026-10-29T11:17:24.290","lastModified":"2026-10-29T15:43:33.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() & pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates.\n\n\n\nThis can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null.\n\n\n\nThis issue does not affect the Win32 SChannel TLS implementation.\n\n\n\nThis issue affects Apache Qpid Proton C: through 0.40.0.\n\n\n\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Qpid Proton C","defaultStatus":"unaffected","packageURL":"pkg:software-id/apache.org/qpid-proton","versions":[{"version":"0","lessThanOrEqual":"0.40.0","versionType":"semver","status":"affected"}]}]}],"metrics":{},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-295"}]}],"references":[{"url":"https://lists.apache.org/thread.html/lc10nrjt2dwcjjhrsgoyy5tqkntsnor4","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/28/22","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-105042","sourceIdentifier":"security@apache.org","published":"2026-10-29T11:17:24.410","lastModified":"2026-10-29T15:43:33.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash.\n\n\n\nThis issue affects Apache Qpid Proton C: through 0.40.0.\n\n\n\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Qpid Proton C","defaultStatus":"unaffected","packageURL":"pkg:software-id/apache.org/qpid-proton","versions":[{"version":"0","lessThanOrEqual":"0.40.0","versionType":"semver","status":"affected"}]}]}],"metrics":{},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-674"}]}],"references":[{"url":"https://lists.apache.org/thread.html/7v54gx7o1ptxcz3h9549w3h9oxo3ns28","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/28/23","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-112827","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T11:17:27.473","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in VillaTheme HANDMADE – Dropshipping for Etsy and WooCommerce handmade-dropshipping-for-etsy-and-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HANDMADE – Dropshipping for Etsy and WooCommerce: from n/a through 1.0.10."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"VillaTheme","product":"HANDMADE – Dropshipping for Etsy and WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"handmade-dropshipping-for-etsy-and-woo","versions":[{"version":"0","lessThanOrEqual":"1.0.10","versionType":"custom","status":"affected","changes":[{"at":"1.0.11","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:18:19.133158Z","id":"CVE-2026-112827","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/handmade-dropshipping-for-etsy-and-woo/vulnerability/wordpress-handmade-dropshipping-for-etsy-and-woocommerce-plugin-1-0-10-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-114193","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T11:17:28.080","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GEO my WordPress: from n/a through 4.5.5.5."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Eyal Fitoussi","product":"GEO my WordPress","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"geo-my-wp","versions":[{"version":"0","lessThanOrEqual":"4.5.5.5","versionType":"custom","status":"affected","changes":[{"at":"4.5.5.7","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:18:24.822482Z","id":"CVE-2026-114193","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/geo-my-wp/vulnerability/wordpress-geo-my-wordpress-plugin-4-5-5-5-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-114230","sourceIdentifier":"security@apache.org","published":"2026-10-29T11:17:28.210","lastModified":"2026-10-29T15:43:33.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means that authentication has not completed yet.\n\n\n\nThis issue affects Apache Qpid Proton C: through 0.40.0.\n\n\n\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Qpid Proton C","defaultStatus":"unaffected","packageURL":"pkg:software-id/apache.org/qpid-proton","versions":[{"version":"0","lessThanOrEqual":"0.40.0","versionType":"semver","status":"affected"}]}]}],"metrics":{},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-305"}]}],"references":[{"url":"https://lists.apache.org/thread.html/ob7vo6swpj4wbb2m3zq9q2vkwfg5dg8k","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/28/24","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-115592","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T11:17:29.937","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OceanWP OceanWP oceanwp allows Reflected XSS.This issue affects OceanWP: from n/a through 4.2.7."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"OceanWP","product":"OceanWP","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"oceanwp","versions":[{"version":"0","lessThanOrEqual":"4.2.7","versionType":"custom","status":"affected","changes":[{"at":"4.2.8","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:18:08.262477Z","id":"CVE-2026-115592","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/oceanwp/vulnerability/wordpress-oceanwp-theme-4-2-7-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-115599","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T11:17:30.070","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThimPress","product":"LearnPress","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"learnpress","versions":[{"version":"0","lessThanOrEqual":"4.4.11","versionType":"custom","status":"affected","changes":[{"at":"4.4.12","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:18:31.065282Z","id":"CVE-2026-115599","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/learnpress/vulnerability/wordpress-learnpress-plugin-4-4-11-broken-access-control-vulnerability-3?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-115611","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T11:17:30.207","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net TableOn posts-table-filterable allows Reflected XSS.This issue affects TableOn: from n/a through 1.0.7."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"PluginUs.Net","product":"TableOn","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"posts-table-filterable","versions":[{"version":"0","lessThanOrEqual":"1.0.7","versionType":"custom","status":"affected","changes":[{"at":"1.0.8","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:17:16.930463Z","id":"CVE-2026-115611","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/posts-table-filterable/vulnerability/wordpress-tableon-plugin-1-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-115942","sourceIdentifier":"security@apache.org","published":"2026-10-29T11:17:30.837","lastModified":"2026-10-29T15:43:33.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A misconfigured wildcard TLS certificate causes a stack read overflow.\n\n\n\nThis issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard.\n\n\n\nThis issue affects Apache Qpid Proton C: through 0.40.0.\n\n\n\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Qpid Proton C","defaultStatus":"unaffected","packageURL":"pkg:software-id/apache.org/qpid-proton","versions":[{"version":"0","lessThanOrEqual":"0.40.0","versionType":"semver","status":"affected"}]}]}],"metrics":{},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://lists.apache.org/thread.html/5z8x4c1939rxs5hod7q7gvgdmjd7p7pt","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/28/25","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-115962","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T11:17:30.967","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue affects myCred: from n/a through 4.0.1."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"myCred","product":"myCred","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"mycred","versions":[{"version":"0","lessThanOrEqual":"4.0.1","versionType":"custom","status":"affected","changes":[{"at":"4.0.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:18:03.748784Z","id":"CVE-2026-115962","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-290"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/mycred/vulnerability/wordpress-mycred-plugin-4-0-1-bypass-vulnerability-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-115963","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T11:17:31.097","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.9."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"VideoWhisper.com","product":"Broadcast Live Video","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"videowhisper-live-streaming-integration","versions":[{"version":"0","lessThanOrEqual":"7.3.9","versionType":"custom","status":"affected","changes":[{"at":"7.3.12","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:18:44.163341Z","id":"CVE-2026-115963","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/videowhisper-live-streaming-integration/vulnerability/wordpress-broadcast-live-video-plugin-7-3-9-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-115964","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T11:17:31.220","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Blind SQL Injection.This issue affects Motors: from n/a through 1.4.126."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"StylemixThemes","product":"Motors","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"motors-car-dealership-classified-listings","versions":[{"version":"0","lessThanOrEqual":"1.4.126","versionType":"custom","status":"affected","changes":[{"at":"1.4.127","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:17:59.145099Z","id":"CVE-2026-115964","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/motors-car-dealership-classified-listings/vulnerability/wordpress-motors-plugin-1-4-126-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-115965","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T11:17:31.357","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allows Blind SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"BuddyPress","product":"BuddyPress","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"buddypress","versions":[{"version":"0","lessThanOrEqual":"14.5.2","versionType":"custom","status":"affected","changes":[{"at":"14.5.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:18:35.291804Z","id":"CVE-2026-115965","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/buddypress/vulnerability/wordpress-buddypress-plugin-14-5-2-sql-injection-vulnerability-2?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-115967","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T11:17:31.493","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Weak Authentication vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Authentication Abuse.This issue affects Login with phone number: from n/a through 1.8.78."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Hamid Alinia","product":"Login with phone number","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"login-with-phone-number","versions":[{"version":"0","lessThanOrEqual":"1.8.78","versionType":"custom","status":"affected","changes":[{"at":"1.8.79","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:18:39.566523Z","id":"CVE-2026-115967","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1390"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/login-with-phone-number/vulnerability/wordpress-login-with-phone-number-plugin-1-8-78-broken-authentication-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-116409","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T11:17:31.630","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-offer-for-woocommerce allows Reflected XSS.This issue affects Upsell Order Bump Offer for WooCommerce: from n/a through 3.1.6."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WP Swings","product":"Upsell Order Bump Offer for WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"upsell-order-bump-offer-for-woocommerce","versions":[{"version":"0","lessThanOrEqual":"3.1.6","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:18:13.351637Z","id":"CVE-2026-116409","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/upsell-order-bump-offer-for-woocommerce/vulnerability/wordpress-upsell-order-bump-offer-for-woocommerce-plugin-3-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-118984","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T11:17:32.257","lastModified":"2026-10-29T13:17:08.997","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock out the operator, take over dashboard login, or disable the login requirement entirely."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"cheaper-inference","product":"OmniRoute","defaultStatus":"unaffected","packageURL":"pkg:npm/omniroute","versions":[{"version":"3.8.0","lessThan":"3.8.52","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:20:39.806428Z","id":"CVE-2026-118984","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-620"}]}],"references":[{"url":"https://github.com/cheaper-inference/OmniRoute","source":"disclosure@vulncheck.com"},{"url":"https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/app/api/settings/require-login/route.ts#L90-L130","source":"disclosure@vulncheck.com"},{"url":"https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/app/api/settings/route.ts#L374-L422","source":"disclosure@vulncheck.com"},{"url":"https://github.com/cheaper-inference/OmniRoute/commit/dde27f4964872c9b43cfd5b8f532693f6c018af6","source":"disclosure@vulncheck.com"},{"url":"https://github.com/cheaper-inference/OmniRoute/pull/16897","source":"disclosure@vulncheck.com"},{"url":"https://github.com/cheaper-inference/OmniRoute/releases/tag/v3.8.52","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/omniroute-3.8.0-before-3.8.52-unverified-password-change-via-api-settings-require-login","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-118989","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T11:17:32.447","lastModified":"2026-10-29T16:21:34.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_file that allows shop_manager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal address, causing the server to fetch internal responses and return them as import data."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"WebToffee","product":"Product Import Export for WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","versions":[{"version":"2.5.1","lessThan":"2.6.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:19:06.542480Z","id":"CVE-2026-118989","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/product-import-export-for-woo/tags/2.6.7/admin/modules/import/import.php#L563","source":"disclosure@vulncheck.com"},{"url":"https://plugins.trac.wordpress.org/browser/product-import-export-for-woo/tags/2.6.7/admin/modules/import/import.php#L661","source":"disclosure@vulncheck.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3766250/","source":"disclosure@vulncheck.com"},{"url":"https://wordpress.org/plugins/product-import-export-for-woo/","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/webtoffee-product-import-export-for-woocommerce-2.5.1-before-2.6.8-ssrf-via-redirects","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-33923","sourceIdentifier":"prodsec@nozominetworks.com","published":"2026-10-29T11:17:32.847","lastModified":"2026-10-29T15:59:29.730","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A signature verification vulnerability was discovered in the update installation functionality due to inconsistent validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that passes signature verification but runs an unsigned script when the bundle is installed. The script runs with root privileges, allowing the attacker to read or modify sensitive data, change the appliance configuration, or shut down the appliance."}],"affected":[{"source":"prodsec@nozominetworks.com","affectedData":[{"vendor":"Nozomi Networks","product":"Guardian","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"26.4.0","versionType":"semver","status":"affected"}]},{"vendor":"Nozomi Networks","product":"CMC","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"26.4.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"prodsec@nozominetworks.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"prodsec@nozominetworks.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:19:57.938573Z","id":"CVE-2026-33923","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"prodsec@nozominetworks.com","type":"Secondary","description":[{"lang":"en","value":"CWE-347"}]}],"references":[{"url":"https://security.nozominetworks.com/NN-2026:21-01","source":"prodsec@nozominetworks.com"}]}},{"cve":{"id":"CVE-2026-33924","sourceIdentifier":"prodsec@nozominetworks.com","published":"2026-10-29T11:17:33.010","lastModified":"2026-10-29T15:59:29.730","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that, when installed, causes arbitrary commands to be executed with root privileges, allowing the attacker to read or modify sensitive data, change the appliance configuration, or shut down the appliance."}],"affected":[{"source":"prodsec@nozominetworks.com","affectedData":[{"vendor":"Nozomi Networks","product":"Guardian","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"26.4.0","versionType":"semver","status":"affected"}]},{"vendor":"Nozomi Networks","product":"CMC","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"26.4.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"prodsec@nozominetworks.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"prodsec@nozominetworks.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:19:24.372035Z","id":"CVE-2026-33924","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"prodsec@nozominetworks.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://security.nozominetworks.com/NN-2026:22-01","source":"prodsec@nozominetworks.com"}]}},{"cve":{"id":"CVE-2026-71569","sourceIdentifier":"security@apache.org","published":"2026-10-29T11:17:34.093","lastModified":"2026-10-29T14:17:58.923","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Server-Side Request Forgery (SSRF) vulnerability in Apache Camel A2A component.\n\n\n\nThis issue affects Apache Camel: from 4.21.0 before 4.22.2.\n\n\n\nWebhookUrlValidator classified a push notification webhook host in two places that did not agree. A host written as an IP literal was matched against a list of string prefixes that named the IPv6 unique local range fc00::/7, while a host reached through a name was resolved and the resulting address classified with the InetAddress predicates isLoopbackAddress, isAnyLocalAddress, isLinkLocalAddress and isSiteLocalAddress. Those predicates do not cover the same ground as the prefix list: isSiteLocalAddress reports the deprecated fec0::/10 block and not the fc00::/7 unique local addresses that replaced it, and the JDK carries no predicate for them at all. The same address was therefore accepted or rejected depending on how it was written, and a webhook URL whose host name resolved into fc00::/7 passed a guard that refused the identical address given as a literal. PushNotificationDispatcher then sent the push notification to that address, together with any Authorization header carried in the same configuration, whose scheme and credentials the registering caller supplies. The webhook URL arrives as TaskPushNotificationConfig.url from the caller registering the push notification, so it is attacker-controlled, and allowLocalWebhookUrls is false by default, which is the configuration in which the guard is expected to hold. The response is not relayed back to the caller who registered the configuration, so what the gap yields is a blind outbound HTTPS request from the Camel process to an internal address the guard was written to refuse; reaching a service that way additionally requires that the name resolve into fc00::/7 in the target environment, that an HTTPS service be listening on that address, and that the TLS handshake succeed for the name being requested, which is why the severity is assessed medium. The same string pre-check was also wrong in the other direction: it matched the raw host string without first establishing that the host was an IP literal, so any name merely beginning with fc or fd, such as fcm.googleapis.com, was refused outright.\n\n\n\nUsers are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. The 4.21.x release line reached end of life before this issue was resolved and will not receive a fix, so deployments on it must move to a supported release. Both the literal and the resolved path now classify the address from its raw bytes with one shared classifier, which recognises fc00::/7 and the shared address space 100.64.0.0/10, as well as IPv4-compatible, NAT64 (64:ff9b::/96) and 6to4 (2002::/16) addresses whose embedded IPv4 address is not globally routable. For deployments that cannot upgrade immediately, place authentication in front of the A2A push notification configuration path so that the webhook URL does not arrive from an untrusted caller, and deny egress from the Camel process to fc00::/7 at the network level; where the deployment has no need of IPv6, starting the JVM with -Djava.net.preferIPv4Stack=true removes the address class the gap turns on. Note that allowLocalWebhookUrls=false is already the default and does not by itself close the gap."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Camel","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.camel:camel-a2a","packageURL":"pkg:maven/org.apache.camel/camel-a2a","versions":[{"version":"4.21.0","lessThan":"4.22.2","versionType":"maven","status":"affected"},{"version":"4.22.2","versionType":"maven","status":"unaffected"},{"version":"4.23.0","versionType":"maven","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:54:30.239589Z","id":"CVE-2026-71569","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://camel.apache.org/security/CVE-2026-71569.html","source":"security@apache.org"},{"url":"https://github.com/apache/camel/pull/25406","source":"security@apache.org"},{"url":"https://github.com/apache/camel/pull/26583","source":"security@apache.org"},{"url":"https://issues.apache.org/jira/browse/CAMEL-24371","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-103665","sourceIdentifier":"vultures@jpcert.or.jp","published":"2026-10-29T12:17:08.980","lastModified":"2026-10-29T15:45:15.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecurely load Dynamic Link Libraries (DLLs). When the installer is launched in a directory containing a specially crafted DLL file, the malicious DLL may be loaded, resulting in arbitrary code execution with administrative privileges."}],"affected":[{"source":"vultures@jpcert.or.jp","affectedData":[{"vendor":"Yamaha Corporation","product":"Yamaha LAN Monitor for Windows","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"Ver.1.9.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV30":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:10:35.298179Z","id":"CVE-2026-103665","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vultures@jpcert.or.jp","type":"Secondary","description":[{"lang":"en","value":"CWE-427"}]}],"references":[{"url":"https://jvn.jp/en/jp/JVN23695234/","source":"vultures@jpcert.or.jp"},{"url":"https://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN23695234.html","source":"vultures@jpcert.or.jp"}]}},{"cve":{"id":"CVE-2026-109216","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T12:17:09.640","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'profile_background[<attacker-chosen key>]' parameter in all versions up to, and including, 5.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitability depends on a consuming plugin or theme built on Meta Box that exposes the background field to lower-privileged users and renders stored values via the rwmb_the_value()/format_single_value() pattern; the effective minimum privilege is whatever role that consumer permits, demonstrated at Subscriber level."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"metabox","product":"Meta Box – A Framework for Dynamic Websites","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.15.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:17:36.454458Z","id":"CVE-2026-109216","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/wpmetabox/meta-box/pull/1709","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/meta-box/tags/5.15.2/inc/fields/background.php#L154","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/meta-box/tags/5.15.2/inc/sanitizer.php#L170","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/meta-box/tags/5.15.3/inc/fields/background.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a8948f5-8bcf-48f2-b3a6-bfa24ba9bef0?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-109822","sourceIdentifier":"vultures@jpcert.or.jp","published":"2026-10-29T12:17:09.773","lastModified":"2026-10-29T15:45:15.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive information. Configuration files generated by the CONFIG file export function may be read by an unauthenticated attacker."}],"affected":[{"source":"vultures@jpcert.or.jp","affectedData":[{"vendor":"Yamaha Corporation","product":"NWR100","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"Rev.26.00.07","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T11:58:48.271585Z","id":"CVE-2026-109822","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vultures@jpcert.or.jp","type":"Secondary","description":[{"lang":"en","value":"CWE-922"}]}],"references":[{"url":"https://jvn.jp/en/vu/JVNVU91027179/","source":"vultures@jpcert.or.jp"},{"url":"https://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVNVU91027179.html","source":"vultures@jpcert.or.jp"}]}},{"cve":{"id":"CVE-2026-110184","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T12:17:09.917","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Newsmatic theme for WordPress is vulnerable to blind SQL Injection via the 'slug' parameter in all versions up to, and including, 1.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"blazethemes","product":"Newsmatic","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.5.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:17:50.538524Z","id":"CVE-2026-110184","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://themes.trac.wordpress.org/browser/newsmatic/1.5.0/functions.php#L265","source":"security@wordfence.com"},{"url":"https://themes.trac.wordpress.org/browser/newsmatic/1.5.0/functions.php#L268","source":"security@wordfence.com"},{"url":"https://themes.trac.wordpress.org/browser/newsmatic/1.5.0/functions.php#L269","source":"security@wordfence.com"},{"url":"https://themes.trac.wordpress.org/browser/newsmatic/1.5.1/functions.php","source":"security@wordfence.com"},{"url":"https://themes.trac.wordpress.org/ticket/295677","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81a503f9-3bd2-4fb8-8c3e-8d68d41f7918?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-115821","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T12:17:11.767","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billing_first_name, billing_last_name' parameter in all versions up to, and including, 3.7.29 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the Newsman Remarketing feature is enabled and a non-empty Remarketing ID is configured in the plugin settings."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"newsmanapp","product":"NewsmanApp","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.7.29","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:17:06.515151Z","id":"CVE-2026-115821","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/Newsman/WP-Plugin-NewsmanApp/commit/b3ca3b2fdcd070b43b6b2b720d4ee8ac6ebd4a17","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/newsmanapp/tags/3.7.29/includes/remarketing/action/class-abstractaction.php#L85","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/newsmanapp/tags/3.7.29/includes/remarketing/action/class-purchase.php#L77","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/newsmanapp/tags/3.7.29/includes/remarketing/action/class-purchase.php#L78","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3767162/newsmanapp/trunk/includes/remarketing/action/class-purchase.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba6e0223-66d4-4fe7-8c15-6b37990a2f8a?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-119025","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T12:17:12.017","lastModified":"2026-10-29T16:19:37.750","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_endpoint values from malicious MCP servers, which execute when index.js passes them unescaped to powershell -EncodedCommand."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"sindresorhus","product":"open","defaultStatus":"unaffected","packageURL":"pkg:npm/open","versions":[{"version":"7.2.0","lessThan":"11.0.0","versionType":"semver","status":"affected"}]},{"vendor":"modelcontextprotocol","product":"inspector","defaultStatus":"unaffected","packageURL":"pkg:npm/%40modelcontextprotocol/inspector","versions":[{"version":"2.0.0","lessThan":"2.12.0","versionType":"semver","status":"affected"}]},{"vendor":"anomalyco","product":"opencode","defaultStatus":"unaffected","packageURL":"pkg:npm/opencode-ai","versions":[{"version":"1.0.137","lessThan":"1.18.33","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/anomalyco/opencode/commit/29f07e0c69ad8668e0e15b0eb54f2fcb342af98c","source":"disclosure@vulncheck.com"},{"url":"https://github.com/anomalyco/opencode/pull/51414","source":"disclosure@vulncheck.com"},{"url":"https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-q978-78c7-phqw","source":"disclosure@vulncheck.com"},{"url":"https://github.com/sindresorhus/open/blob/v10.2.0/index.js#L189-L203","source":"disclosure@vulncheck.com"},{"url":"https://github.com/sindresorhus/open/blob/v7.2.0/index.js#L60-L99","source":"disclosure@vulncheck.com"},{"url":"https://github.com/sindresorhus/open/commit/274d70446bf38a7b7d50b214dd3962ef8ea9320d","source":"disclosure@vulncheck.com"},{"url":"https://github.com/sindresorhus/open/releases/tag/v11.0.0","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/open-7.2.0-before-11.0.0-os-command-injection-via-powershell-on-windows","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119027","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T12:17:12.167","lastModified":"2026-10-29T18:17:29.510","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init() that executes when the victim builds and imports the generated package."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"oapi-codegen","product":"oapi-codegen","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/oapi-codegen/oapi-codegen/v2","versions":[{"version":"2.5.0","lessThan":"2.8.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T15:37:44.678832Z","id":"CVE-2026-119027","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/oapi-codegen/oapi-codegen/blob/v2.5.0/pkg/codegen/templates/server-urls.tmpl#L4-L5","source":"disclosure@vulncheck.com"},{"url":"https://github.com/oapi-codegen/oapi-codegen/blob/v2.8.0/pkg/codegen/templates/server-urls.tmpl#L5-L7","source":"disclosure@vulncheck.com"},{"url":"https://github.com/oapi-codegen/oapi-codegen/commit/068f1bcd16e4724c72d78d6774008a877b8297b1","source":"disclosure@vulncheck.com"},{"url":"https://github.com/oapi-codegen/oapi-codegen/pull/2626","source":"disclosure@vulncheck.com"},{"url":"https://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.8.1","source":"disclosure@vulncheck.com"},{"url":"https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-g2vv-83pm-v2hc","source":"disclosure@vulncheck.com"},{"url":"https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-rjwr-m7qx-3fjr","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/oapi-codegen-2.5.0-before-2.8.1-code-injection-via-servers-x-go-name-extension","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119028","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T12:17:12.310","lastModified":"2026-10-29T16:19:37.750","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in constants.tmpl and injects a func init(), executing code when the generated package is built and imported."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"oapi-codegen","product":"oapi-codegen","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/oapi-codegen/oapi-codegen/v2","versions":[{"version":"2.0.0","lessThan":"2.8.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:08:08.391763Z","id":"CVE-2026-119028","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/oapi-codegen/oapi-codegen/blob/v2.0.0/pkg/codegen/templates/constants.tmpl#L12","source":"disclosure@vulncheck.com"},{"url":"https://github.com/oapi-codegen/oapi-codegen/blob/v2.8.0/pkg/codegen/templates/constants.tmpl#L16","source":"disclosure@vulncheck.com"},{"url":"https://github.com/oapi-codegen/oapi-codegen/commit/068f1bcd16e4724c72d78d6774008a877b8297b1","source":"disclosure@vulncheck.com"},{"url":"https://github.com/oapi-codegen/oapi-codegen/pull/2626","source":"disclosure@vulncheck.com"},{"url":"https://github.com/oapi-codegen/oapi-codegen/releases/tag/v2.8.1","source":"disclosure@vulncheck.com"},{"url":"https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-g2vv-83pm-v2hc","source":"disclosure@vulncheck.com"},{"url":"https://github.com/oapi-codegen/oapi-codegen/security/advisories/GHSA-xrqw-w576-xgj2","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/oapi-codegen-2.0.0-before-2.8.1-code-injection-via-non-string-enum-values","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-27401","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T12:17:12.563","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.62.0."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"YITH","product":"YITH PayPal Express Checkout for WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"yith-paypal-express-checkout-for-woocommerce","versions":[{"version":"0","lessThanOrEqual":"1.62.0","versionType":"custom","status":"affected","changes":[{"at":"1.62.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:16:58.158479Z","id":"CVE-2026-27401","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/yith-paypal-express-checkout-for-woocommerce/vulnerability/wordpress-yith-paypal-express-checkout-for-woocommerce-plugin-1-62-0-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-5697","sourceIdentifier":"cve-coordination@incibe.es","published":"2026-10-29T12:17:12.850","lastModified":"2026-10-29T16:01:04.213","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed in the victim's browser. The list of assigned parameters and identifiers is as follows: \n parameter 'nombre' in '/usuario' endpoint;"}],"affected":[{"source":"cve-coordination@incibe.es","affectedData":[{"vendor":"SABBATIC","product":"SABBATIC app","defaultStatus":"unaffected","versions":[{"version":"versions prior to 7.96.0.1 y 7.96.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@incibe.es","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:52:46.735764Z","id":"CVE-2026-5697","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve-coordination@incibe.es","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sabbatic-application","source":"cve-coordination@incibe.es"}]}},{"cve":{"id":"CVE-2026-5698","sourceIdentifier":"cve-coordination@incibe.es","published":"2026-10-29T12:17:12.990","lastModified":"2026-10-29T16:01:04.213","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed in the victim's browser. The list of assigned parameters and identifiers is as follows: \nparameters 'titulo_es' and 'add_etiquetas%5B%5D' in '/categorías' endpoint;"}],"affected":[{"source":"cve-coordination@incibe.es","affectedData":[{"vendor":"SABBATIC","product":"SABBATIC app","defaultStatus":"unaffected","versions":[{"version":"versions prior to 7.96.0.1 y 7.96.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@incibe.es","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:52:52.700209Z","id":"CVE-2026-5698","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve-coordination@incibe.es","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sabbatic-application","source":"cve-coordination@incibe.es"}]}},{"cve":{"id":"CVE-2026-5699","sourceIdentifier":"cve-coordination@incibe.es","published":"2026-10-29T12:17:13.113","lastModified":"2026-10-29T16:01:04.213","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed in the victim's browser. The list of assigned parameters and identifiers is as follows: \n parameter 'companyName' in  /empresa  endpoint;"}],"affected":[{"source":"cve-coordination@incibe.es","affectedData":[{"vendor":"SABBATIC","product":"SABBATIC app","defaultStatus":"unaffected","versions":[{"version":"versions prior to 7.96.0.1 y 7.96.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@incibe.es","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:52:58.531844Z","id":"CVE-2026-5699","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve-coordination@incibe.es","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sabbatic-application","source":"cve-coordination@incibe.es"}]}},{"cve":{"id":"CVE-2026-5700","sourceIdentifier":"cve-coordination@incibe.es","published":"2026-10-29T12:17:13.240","lastModified":"2026-10-29T16:01:04.213","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed in the victim's browser. The list of assigned parameters and identifiers is as follows: \nparameter 'observaciones' in  /mis-gastos  endpoint."}],"affected":[{"source":"cve-coordination@incibe.es","affectedData":[{"vendor":"SABBATIC","product":"SABBATIC app","defaultStatus":"unaffected","versions":[{"version":"versions prior to 7.96.0.1 y 7.96.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@incibe.es","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:53:06.383586Z","id":"CVE-2026-5700","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve-coordination@incibe.es","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sabbatic-application","source":"cve-coordination@incibe.es"}]}},{"cve":{"id":"CVE-2026-5702","sourceIdentifier":"cve-coordination@incibe.es","published":"2026-10-29T12:17:13.367","lastModified":"2026-10-29T16:01:04.213","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that allows an attacker can trick an authenticated user into clicking a malicious link or loading a page that sends unauthorized requests to a vulnerable endpoint."}],"affected":[{"source":"cve-coordination@incibe.es","affectedData":[{"vendor":"SABBATIC","product":"SABBATIC app","defaultStatus":"unaffected","versions":[{"version":"versions prior to 7.96.0.1 y 7.96.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@incibe.es","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:53:13.074601Z","id":"CVE-2026-5702","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve-coordination@incibe.es","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sabbatic-application","source":"cve-coordination@incibe.es"}]}},{"cve":{"id":"CVE-2026-92086","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T12:17:14.167","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.7 via the 'post_id' parameter. This makes it possible for unauthenticated attackers to extract personally identifiable information from other users' form inquiry records, including submitted names, email addresses, and free-text message bodies, by enumerating sequential post IDs. Exploitation requires the targeted form to have the querystring setting enabled, but this is a standard documented feature of the plugin."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"websoudan","product":"MW WP Form","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.1.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:17:43.646472Z","id":"CVE-2026-92086","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/web-soudan/mw-wp-form/compare/5.1.6...5.1.8","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/mw-wp-form/tags/5.1.6/classes/models/class.parser.php#L156","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/mw-wp-form/tags/5.1.6/classes/models/class.parser.php#L165","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/mw-wp-form/tags/5.1.6/classes/models/class.parser.php#L208","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e412f8a-f872-47cf-bbce-554b3559ef8a?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-96767","sourceIdentifier":"security@wordfence.com","published":"2026-10-29T12:17:14.300","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 9.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"webaways","product":"NEX-Forms – Ultimate Forms Plugin for WordPress","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"9.3.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T12:17:31.113976Z","id":"CVE-2026-96767","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.3.2/includes/classes/class.dashboard.php#L4631","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.3.2/includes/classes/class.functions.php#L2341","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.3.2/main.php#L2684","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.3.2/main.php#L2844","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.3.2/main.php#L3051","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3755941%40nex-forms-express-wp-form-builder&new=3755941%40nex-forms-express-wp-form-builder","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f80dc1b-2622-4cf5-9975-3609bfa21333?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-97854","sourceIdentifier":"vultures@jpcert.or.jp","published":"2026-10-29T12:17:14.443","lastModified":"2026-10-29T15:45:15.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially crafted request to the affected product."}],"affected":[{"source":"vultures@jpcert.or.jp","affectedData":[{"vendor":"Yamaha Corporation","product":"NWR100","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"Rev.26.00.07","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T11:59:10.318584Z","id":"CVE-2026-97854","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vultures@jpcert.or.jp","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://jvn.jp/en/vu/JVNVU91027179/","source":"vultures@jpcert.or.jp"},{"url":"https://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVNVU91027179.html","source":"vultures@jpcert.or.jp"}]}},{"cve":{"id":"CVE-2026-97860","sourceIdentifier":"vultures@jpcert.or.jp","published":"2026-10-29T12:17:14.577","lastModified":"2026-10-29T15:45:15.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who has write permissions on the system drive may be able to execute arbitrary code with SYSTEM privileges."}],"affected":[{"source":"vultures@jpcert.or.jp","affectedData":[{"vendor":"Yamaha Corporation","product":"YMS-VPN8","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"Ver.1.04.00","versionType":"semver","status":"affected"}]},{"vendor":"Yamaha Corporation","product":"YMS-VPN8-CP","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"Ver.1.04.00","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV30":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:11:53.739786Z","id":"CVE-2026-97860","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vultures@jpcert.or.jp","type":"Secondary","description":[{"lang":"en","value":"CWE-428"}]}],"references":[{"url":"https://jvn.jp/en/jp/JVN30675482/","source":"vultures@jpcert.or.jp"},{"url":"https://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN30675482.html","source":"vultures@jpcert.or.jp"}]}},{"cve":{"id":"CVE-2026-113688","sourceIdentifier":"47237f96-ddbe-4467-a5ee-293a770beacd","published":"2026-10-29T13:17:04.370","lastModified":"2026-10-29T15:59:29.730","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make server-side requests to internal services and observe response information."}],"affected":[{"source":"47237f96-ddbe-4467-a5ee-293a770beacd","affectedData":[{"vendor":"BMC","product":"BMC IT Service Management Suite","defaultStatus":"unknown","modules":["SmartIT URL-based attachments"],"versions":[{"version":"25.3.01","versionType":"custom","status":"affected"},{"version":"25.3.01 hotfix 10","versionType":"custom","status":"unaffected"},{"version":"25.4.01","versionType":"custom","status":"affected"},{"version":"25.4.01 hotfix 22","versionType":"custom","status":"unaffected"},{"version":"26.1.01","versionType":"custom","status":"affected"},{"version":"26.1.01 hotfix 12","versionType":"custom","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"47237f96-ddbe-4467-a5ee-293a770beacd","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:06:38.781172Z","id":"CVE-2026-113688","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"47237f96-ddbe-4467-a5ee-293a770beacd","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/","source":"47237f96-ddbe-4467-a5ee-293a770beacd"},{"url":"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/","source":"47237f96-ddbe-4467-a5ee-293a770beacd"},{"url":"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/","source":"47237f96-ddbe-4467-a5ee-293a770beacd"},{"url":"https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113688/advisory.md","source":"47237f96-ddbe-4467-a5ee-293a770beacd"}]}},{"cve":{"id":"CVE-2026-113689","sourceIdentifier":"47237f96-ddbe-4467-a5ee-293a770beacd","published":"2026-10-29T13:17:04.507","lastModified":"2026-10-29T15:59:29.730","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers."}],"affected":[{"source":"47237f96-ddbe-4467-a5ee-293a770beacd","affectedData":[{"vendor":"BMC","product":"BMC IT Service Management Suite","defaultStatus":"unknown","modules":["SmartIT work notes"],"versions":[{"version":"25.3.01","versionType":"custom","status":"affected"},{"version":"25.3.01 hotfix 10","versionType":"custom","status":"unaffected"},{"version":"25.4.01","versionType":"custom","status":"affected"},{"version":"25.4.01 hotfix 22","versionType":"custom","status":"unaffected"},{"version":"26.1.01","versionType":"custom","status":"affected"},{"version":"26.1.01 hotfix 12","versionType":"custom","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"47237f96-ddbe-4467-a5ee-293a770beacd","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:06:13.315252Z","id":"CVE-2026-113689","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"47237f96-ddbe-4467-a5ee-293a770beacd","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/","source":"47237f96-ddbe-4467-a5ee-293a770beacd"},{"url":"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/","source":"47237f96-ddbe-4467-a5ee-293a770beacd"},{"url":"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/","source":"47237f96-ddbe-4467-a5ee-293a770beacd"},{"url":"https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113689/advisory.md","source":"47237f96-ddbe-4467-a5ee-293a770beacd"}]}},{"cve":{"id":"CVE-2026-113690","sourceIdentifier":"47237f96-ddbe-4467-a5ee-293a770beacd","published":"2026-10-29T13:17:04.633","lastModified":"2026-10-29T15:59:29.730","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers."}],"affected":[{"source":"47237f96-ddbe-4467-a5ee-293a770beacd","affectedData":[{"vendor":"BMC","product":"BMC IT Service Management Suite","defaultStatus":"unknown","modules":["SmartIT attachments"],"versions":[{"version":"25.3.01","versionType":"custom","status":"affected"},{"version":"25.3.01 hotfix 10","versionType":"custom","status":"unaffected"},{"version":"25.4.01","versionType":"custom","status":"affected"},{"version":"25.4.01 hotfix 22","versionType":"custom","status":"unaffected"},{"version":"26.1.01","versionType":"custom","status":"affected"},{"version":"26.1.01 hotfix 12","versionType":"custom","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"47237f96-ddbe-4467-a5ee-293a770beacd","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:05:41.222863Z","id":"CVE-2026-113690","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"47237f96-ddbe-4467-a5ee-293a770beacd","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/","source":"47237f96-ddbe-4467-a5ee-293a770beacd"},{"url":"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/","source":"47237f96-ddbe-4467-a5ee-293a770beacd"},{"url":"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/","source":"47237f96-ddbe-4467-a5ee-293a770beacd"},{"url":"https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113690/advisory.md","source":"47237f96-ddbe-4467-a5ee-293a770beacd"}]}},{"cve":{"id":"CVE-2026-118087","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T13:17:08.573","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.This issue affects Site Reviews: from n/a through 8.3.5."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Gemini Labs","product":"Site Reviews","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"site-reviews","versions":[{"version":"0","lessThanOrEqual":"8.3.5","versionType":"custom","status":"affected","changes":[{"at":"8.3.6","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T13:38:28.309707Z","id":"CVE-2026-118087","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/site-reviews/vulnerability/wordpress-site-reviews-plugin-8-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-118093","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T13:17:08.727","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in WPFunnels Team Product Feed Manager best-woocommerce-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed Manager: from n/a through 7.14.1."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WPFunnels Team","product":"Product Feed Manager","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"best-woocommerce-feed","versions":[{"version":"0","lessThanOrEqual":"7.14.1","versionType":"custom","status":"affected","changes":[{"at":"7.14.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T13:41:45.678426Z","id":"CVE-2026-118093","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/best-woocommerce-feed/vulnerability/wordpress-product-feed-manager-plugin-7-14-1-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-118094","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T13:17:08.857","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Stored XSS.This issue affects Ad Inserter: from n/a through 2.8.18."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Igor Funa","product":"Ad Inserter","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"ad-inserter","versions":[{"version":"0","lessThanOrEqual":"2.8.18","versionType":"custom","status":"affected","changes":[{"at":"2.8.19","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T13:43:23.803540Z","id":"CVE-2026-118094","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/ad-inserter/vulnerability/wordpress-ad-inserter-plugin-2-8-18-cross-site-scripting-xss-vulnerability-5?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-22386","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T13:17:10.440","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.1."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Ahmad","product":"WP Job Portal","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-job-portal","versions":[{"version":"0","lessThanOrEqual":"2.7.1","versionType":"custom","status":"affected","changes":[{"at":"2.7.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T13:42:21.371446Z","id":"CVE-2026-22386","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-job-portal/vulnerability/wordpress-wp-job-portal-plugin-2-7-1-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-24533","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T13:17:10.587","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This issue affects Cozy Blocks: from n/a through 2.2.27."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"CozyThemes","product":"Cozy Blocks","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"cozy-addons","versions":[{"version":"0","lessThanOrEqual":"2.2.27","versionType":"custom","status":"affected","changes":[{"at":"2.2.28","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T13:42:15.422376Z","id":"CVE-2026-24533","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/cozy-addons/vulnerability/wordpress-cozy-blocks-plugin-2-2-27-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39735","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T13:17:11.127","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through 3.9.0.1."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Crocoblock","product":"JetEngine","defaultStatus":"unaffected","collectionURL":"https://crocoblock.com","packageName":"jet-engine","versions":[{"version":"0","lessThanOrEqual":"3.9.0.1","versionType":"custom","status":"affected","changes":[{"at":"3.9.0.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T13:43:48.179702Z","id":"CVE-2026-39735","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-9-0-1-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39741","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T13:17:11.270","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Cloudflare Turnstile: from n/a through 1.44.0."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"RelyWP","product":"Simple Cloudflare Turnstile","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"simple-cloudflare-turnstile","versions":[{"version":"0","lessThanOrEqual":"1.44.0","versionType":"custom","status":"affected","changes":[{"at":"1.44.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T13:42:56.023870Z","id":"CVE-2026-39741","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/simple-cloudflare-turnstile/vulnerability/wordpress-simple-cloudflare-turnstile-plugin-1-44-0-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-42703","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T13:17:11.547","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through 2.4.27."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Kaliforms","product":"Kali Forms","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"kali-forms","versions":[{"version":"0","lessThanOrEqual":"2.4.27","versionType":"custom","status":"affected","changes":[{"at":"2.4.28","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T13:42:10.994391Z","id":"CVE-2026-42703","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/kali-forms/vulnerability/wordpress-kali-forms-plugin-2-4-27-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-48196","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T13:17:12.527","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kaliforms Kali Forms kali-forms allows Stored XSS.This issue affects Kali Forms: from n/a through 2.4.27."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Kaliforms","product":"Kali Forms","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"kali-forms","versions":[{"version":"0","lessThanOrEqual":"2.4.27","versionType":"custom","status":"affected","changes":[{"at":"2.4.28","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T13:38:17.631715Z","id":"CVE-2026-48196","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/kali-forms/vulnerability/wordpress-kali-forms-plugin-2-4-27-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-49142","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T13:17:12.713","lastModified":"2026-10-29T16:19:37.750","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module that allows users with Clinician-level privileges to read and modify arbitrary database contents by submitting crafted values in the form_icd_codes[] POST parameter to the syndromicsurveillance/index endpoint. Attackers can inject an unquoted numeric IN() clause and UNION DISTINCT SELECT statement using hex-encoded literals to abuse MySQL extractvalue() for error-based exfiltration of bcrypt password hashes and execute stacked queries that reset passwords, resulting in full administrative account takeover."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"openemr","product":"openemr","defaultStatus":"unaffected","repo":"https://github.com/openemr/openemr","packageURL":"pkg:github/openemr/openemr","versions":[{"version":"0","lessThan":"8.5.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/openemr/openemr/commit/9b52cc0fc3a4eddd9fa7a096f6a3ac2a57d772d0","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openemr/openemr/pull/14329","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openemr/openemr/releases/tag/v8_5_0","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-w99c-jwcm-24hh","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openemr-before-sql-injection-via-form-icd-codes","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-52709","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T13:17:13.163","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Video Gallery Block video-gallery-block allows Stored XSS.This issue affects Video Gallery Block: from n/a through 1.6.0."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"bPlugins","product":"Video Gallery Block","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"video-gallery-block","versions":[{"version":"0","lessThanOrEqual":"1.6.0","versionType":"custom","status":"affected","changes":[{"at":"1.7.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T13:38:23.518268Z","id":"CVE-2026-52709","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/video-gallery-block/vulnerability/wordpress-video-gallery-block-plugin-1-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-56056","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T13:17:13.450","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid The Post Grid the-post-grid allows Stored XSS.This issue affects The Post Grid: from n/a through 7.9.7."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Mamunur Rashid","product":"The Post Grid","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"the-post-grid","versions":[{"version":"0","lessThanOrEqual":"7.9.7","versionType":"custom","status":"affected","changes":[{"at":"7.9.8","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T13:43:42.522542Z","id":"CVE-2026-56056","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/the-post-grid/vulnerability/wordpress-the-post-grid-plugin-7-9-7-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-93006","sourceIdentifier":"secalert@redhat.com","published":"2026-10-29T13:17:15.723","lastModified":"2026-10-30T02:17:10.323","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the requested file. In PXE network-boot environments this can substitute attacker-chosen boot content for a victim machine."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ceph Storage 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhceph/alloy-rhel10","cpes":["cpe:/a:redhat:ceph_storage:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift4/ose-baremetal-runtimecfg-rhel8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift4/ose-baremetal-runtimecfg-rhel9","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 5","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift5/ose-baremetal-runtimecfg-rhel9","cpes":["cpe:/a:redhat:openshift:5"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 5","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:5"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 13 (Queens)","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/a:redhat:openstack:13"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 18.0","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoso-operators/infra-rhel9-operator","cpes":["cpe:/a:redhat:openstack:18.0"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-672"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-93006","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2536075","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-93007","sourceIdentifier":"secalert@redhat.com","published":"2026-10-29T13:17:15.890","lastModified":"2026-10-30T08:17:00.560","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ceph Storage 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhceph/alloy-rhel10","cpes":["cpe:/a:redhat:ceph_storage:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift4/ose-baremetal-runtimecfg-rhel8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift4/ose-baremetal-runtimecfg-rhel9","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 5","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift5/ose-baremetal-runtimecfg-rhel9","cpes":["cpe:/a:redhat:openshift:5"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 5","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:5"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 13 (Queens)","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/a:redhat:openstack:13"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 18.0","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoso-operators/infra-rhel9-operator","cpes":["cpe:/a:redhat:openstack:18.0"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T15:43:44.687454Z","id":"CVE-2026-93007","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-93007","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2536076","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-93008","sourceIdentifier":"secalert@redhat.com","published":"2026-10-29T13:17:16.053","lastModified":"2026-10-30T01:16:48.057","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking that those records belong to the responding server's authorized zone. In split-DNS deployments that send some domains to a specific upstream, an attacker who controls that upstream can inject cache entries for unrelated names. Later clients may then receive attacker-chosen addresses for those names."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ceph Storage 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhceph/alloy-rhel10","cpes":["cpe:/a:redhat:ceph_storage:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift4/ose-baremetal-runtimecfg-rhel8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift4/ose-baremetal-runtimecfg-rhel9","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 5","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift5/ose-baremetal-runtimecfg-rhel9","cpes":["cpe:/a:redhat:openshift:5"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 5","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:5"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 13 (Queens)","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/a:redhat:openstack:13"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 18.0","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoso-operators/infra-rhel9-operator","cpes":["cpe:/a:redhat:openstack:18.0"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":4.0}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-345"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-93008","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2536079","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-93011","sourceIdentifier":"secalert@redhat.com","published":"2026-10-29T13:17:16.220","lastModified":"2026-10-30T07:16:35.220","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ceph Storage 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhceph/alloy-rhel10","cpes":["cpe:/a:redhat:ceph_storage:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift4/ose-baremetal-runtimecfg-rhel8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift4/ose-baremetal-runtimecfg-rhel9","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 5","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift5/ose-baremetal-runtimecfg-rhel9","cpes":["cpe:/a:redhat:openshift:5"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 5","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:5"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 13 (Queens)","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/a:redhat:openstack:13"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 18.0","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoso-operators/infra-rhel9-operator","cpes":["cpe:/a:redhat:openstack:18.0"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:07:10.217144Z","id":"CVE-2026-93011","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-93011","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2536082","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2019-25781","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T14:17:39.170","lastModified":"2026-10-29T16:19:37.750","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline link parsing that allows remote attackers to exhaust CPU through unmatched brackets. Attackers can submit short Markdown containing repeated [ or ![ characters, forcing LinkInlineProcessor.getText() and getLink() into quadratic scans that keep workers busy for minutes."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Python-Markdown","product":"Markdown","defaultStatus":"unaffected","repo":"https://github.com/Python-Markdown/markdown","packageURL":"pkg:pypi/markdown","versions":[{"version":"3.0","lessThanOrEqual":"3.11.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-407"}]}],"references":[{"url":"https://github.com/Python-Markdown/markdown","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Python-Markdown/markdown/blob/b41e0aaf1181f1a8cb200cf5a815aad7c0020d23/markdown/inlinepatterns.py#L1155-L1172","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Python-Markdown/markdown/issues/1654","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Python-Markdown/markdown/issues/798","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/python-markdown-3.0-through-3.11.2-denial-of-service-via-link-bracket-parsing","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-113691","sourceIdentifier":"47237f96-ddbe-4467-a5ee-293a770beacd","published":"2026-10-29T14:17:44.473","lastModified":"2026-10-29T15:59:29.730","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers."}],"affected":[{"source":"47237f96-ddbe-4467-a5ee-293a770beacd","affectedData":[{"vendor":"BMC","product":"BMC IT Service Management Suite","defaultStatus":"unknown","modules":["SmartIT knowledge articles"],"versions":[{"version":"25.3.01","versionType":"custom","status":"affected"},{"version":"25.3.01 hotfix 10","versionType":"custom","status":"unaffected"},{"version":"25.4.01","versionType":"custom","status":"affected"},{"version":"25.4.01 hotfix 22","versionType":"custom","status":"unaffected"},{"version":"26.1.01","versionType":"custom","status":"affected"},{"version":"26.1.01 hotfix 12","versionType":"custom","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"47237f96-ddbe-4467-a5ee-293a770beacd","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:03:05.382503Z","id":"CVE-2026-113691","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"47237f96-ddbe-4467-a5ee-293a770beacd","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/","source":"47237f96-ddbe-4467-a5ee-293a770beacd"},{"url":"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/","source":"47237f96-ddbe-4467-a5ee-293a770beacd"},{"url":"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/","source":"47237f96-ddbe-4467-a5ee-293a770beacd"},{"url":"https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113691/advisory.md","source":"47237f96-ddbe-4467-a5ee-293a770beacd"}]}},{"cve":{"id":"CVE-2026-113692","sourceIdentifier":"47237f96-ddbe-4467-a5ee-293a770beacd","published":"2026-10-29T14:17:44.623","lastModified":"2026-10-29T15:59:29.730","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated administrators to read files outside the intended directory."}],"affected":[{"source":"47237f96-ddbe-4467-a5ee-293a770beacd","affectedData":[{"vendor":"BMC","product":"BMC IT Service Management Suite","defaultStatus":"unknown","modules":["SmartIT file management"],"versions":[{"version":"25.3.01","versionType":"custom","status":"affected"},{"version":"25.3.01 hotfix 10","versionType":"custom","status":"unaffected"},{"version":"25.4.01","versionType":"custom","status":"affected"},{"version":"25.4.01 hotfix 22","versionType":"custom","status":"unaffected"},{"version":"26.1.01","versionType":"custom","status":"affected"},{"version":"26.1.01 hotfix 12","versionType":"custom","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"47237f96-ddbe-4467-a5ee-293a770beacd","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T13:59:50.568370Z","id":"CVE-2026-113692","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"47237f96-ddbe-4467-a5ee-293a770beacd","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/","source":"47237f96-ddbe-4467-a5ee-293a770beacd"},{"url":"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/","source":"47237f96-ddbe-4467-a5ee-293a770beacd"},{"url":"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/","source":"47237f96-ddbe-4467-a5ee-293a770beacd"},{"url":"https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113692/advisory.md","source":"47237f96-ddbe-4467-a5ee-293a770beacd"}]}},{"cve":{"id":"CVE-2026-113693","sourceIdentifier":"47237f96-ddbe-4467-a5ee-293a770beacd","published":"2026-10-29T14:17:44.770","lastModified":"2026-10-29T15:59:29.730","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to retrieve a system username and encrypted password value."}],"affected":[{"source":"47237f96-ddbe-4467-a5ee-293a770beacd","affectedData":[{"vendor":"BMC","product":"BMC IT Service Management Suite","defaultStatus":"unknown","modules":["SmartIT system-account settings"],"versions":[{"version":"25.3.01","versionType":"custom","status":"affected"},{"version":"25.3.01 hotfix 10","versionType":"custom","status":"unaffected"},{"version":"25.4.01","versionType":"custom","status":"affected"},{"version":"25.4.01 hotfix 22","versionType":"custom","status":"unaffected"},{"version":"26.1.01","versionType":"custom","status":"affected"},{"version":"26.1.01 hotfix 12","versionType":"custom","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"47237f96-ddbe-4467-a5ee-293a770beacd","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T13:59:19.332307Z","id":"CVE-2026-113693","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"47237f96-ddbe-4467-a5ee-293a770beacd","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/","source":"47237f96-ddbe-4467-a5ee-293a770beacd"},{"url":"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/","source":"47237f96-ddbe-4467-a5ee-293a770beacd"},{"url":"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/","source":"47237f96-ddbe-4467-a5ee-293a770beacd"},{"url":"https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113693/advisory.md","source":"47237f96-ddbe-4467-a5ee-293a770beacd"}]}},{"cve":{"id":"CVE-2026-113694","sourceIdentifier":"47237f96-ddbe-4467-a5ee-293a770beacd","published":"2026-10-29T14:17:44.913","lastModified":"2026-10-29T15:59:29.730","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users."}],"affected":[{"source":"47237f96-ddbe-4467-a5ee-293a770beacd","affectedData":[{"vendor":"BMC","product":"BMC IT Service Management Suite","defaultStatus":"unknown","modules":["SmartIT user attachment feature"],"versions":[{"version":"25.3.01","versionType":"custom","status":"affected"},{"version":"25.3.01 hotfix 10","versionType":"custom","status":"unaffected"},{"version":"25.4.01","versionType":"custom","status":"affected"},{"version":"25.4.01 hotfix 22","versionType":"custom","status":"unaffected"},{"version":"26.1.01","versionType":"custom","status":"affected"},{"version":"26.1.01 hotfix 12","versionType":"custom","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"47237f96-ddbe-4467-a5ee-293a770beacd","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T13:50:57.458750Z","id":"CVE-2026-113694","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"47237f96-ddbe-4467-a5ee-293a770beacd","type":"Secondary","description":[{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/","source":"47237f96-ddbe-4467-a5ee-293a770beacd"},{"url":"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/","source":"47237f96-ddbe-4467-a5ee-293a770beacd"},{"url":"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/","source":"47237f96-ddbe-4467-a5ee-293a770beacd"},{"url":"https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113694/advisory.md","source":"47237f96-ddbe-4467-a5ee-293a770beacd"}]}},{"cve":{"id":"CVE-2026-113695","sourceIdentifier":"47237f96-ddbe-4467-a5ee-293a770beacd","published":"2026-10-29T14:17:45.060","lastModified":"2026-10-29T15:59:29.730","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user."}],"affected":[{"source":"47237f96-ddbe-4467-a5ee-293a770beacd","affectedData":[{"vendor":"BMC","product":"BMC IT Service Management Suite","defaultStatus":"unknown","modules":["SmartIT inline-image attachments"],"versions":[{"version":"25.3.01","versionType":"custom","status":"affected"},{"version":"25.3.01 hotfix 10","versionType":"custom","status":"unaffected"},{"version":"25.4.01","versionType":"custom","status":"affected"},{"version":"25.4.01 hotfix 22","versionType":"custom","status":"unaffected"},{"version":"26.1.01","versionType":"custom","status":"affected"},{"version":"26.1.01 hotfix 12","versionType":"custom","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"47237f96-ddbe-4467-a5ee-293a770beacd","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T13:50:18.034363Z","id":"CVE-2026-113695","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"47237f96-ddbe-4467-a5ee-293a770beacd","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/","source":"47237f96-ddbe-4467-a5ee-293a770beacd"},{"url":"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/","source":"47237f96-ddbe-4467-a5ee-293a770beacd"},{"url":"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/","source":"47237f96-ddbe-4467-a5ee-293a770beacd"},{"url":"https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113695/advisory.md","source":"47237f96-ddbe-4467-a5ee-293a770beacd"}]}},{"cve":{"id":"CVE-2026-113696","sourceIdentifier":"47237f96-ddbe-4467-a5ee-293a770beacd","published":"2026-10-29T14:17:45.233","lastModified":"2026-10-29T15:59:29.730","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions."}],"affected":[{"source":"47237f96-ddbe-4467-a5ee-293a770beacd","affectedData":[{"vendor":"BMC","product":"BMC IT Service Management Suite","defaultStatus":"unknown","modules":["SmartIT change approval feature"],"versions":[{"version":"25.3.01","versionType":"custom","status":"affected"},{"version":"25.3.01 hotfix 10","versionType":"custom","status":"unaffected"},{"version":"25.4.01","versionType":"custom","status":"affected"},{"version":"25.4.01 hotfix 22","versionType":"custom","status":"unaffected"},{"version":"26.1.01","versionType":"custom","status":"affected"},{"version":"26.1.01 hotfix 12","versionType":"custom","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"47237f96-ddbe-4467-a5ee-293a770beacd","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T13:49:45.547508Z","id":"CVE-2026-113696","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"47237f96-ddbe-4467-a5ee-293a770beacd","type":"Secondary","description":[{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/","source":"47237f96-ddbe-4467-a5ee-293a770beacd"},{"url":"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/","source":"47237f96-ddbe-4467-a5ee-293a770beacd"},{"url":"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/","source":"47237f96-ddbe-4467-a5ee-293a770beacd"},{"url":"https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113696/advisory.md","source":"47237f96-ddbe-4467-a5ee-293a770beacd"}]}},{"cve":{"id":"CVE-2026-113697","sourceIdentifier":"47237f96-ddbe-4467-a5ee-293a770beacd","published":"2026-10-29T14:17:45.673","lastModified":"2026-10-29T15:59:29.730","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Reflected cross-site scripting in the agent query feature of BMC Helix Operations Management 25.4.00 allows authenticated attackers to execute script in another user's browser after that user opens a crafted link."}],"affected":[{"source":"47237f96-ddbe-4467-a5ee-293a770beacd","affectedData":[{"vendor":"BMC","product":"BMC Helix Operations Management","defaultStatus":"unknown","modules":["Agent query feature"],"versions":[{"version":"25.4.00","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"47237f96-ddbe-4467-a5ee-293a770beacd","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T13:49:04.144619Z","id":"CVE-2026-113697","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"47237f96-ddbe-4467-a5ee-293a770beacd","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://docs.helixops.ai/bin/IT-Operations-Management/On-Premises-Deployment/BMC-Helix-IT-Operations-Management-Deployment/itomdeploy253/Release-notes-and-notices/Known-and-corrected-issues/","source":"47237f96-ddbe-4467-a5ee-293a770beacd"},{"url":"https://docs.helixops.ai/bin/IT-Operations-Management/On-Premises-Deployment/BMC-Helix-IT-Operations-Management-Deployment/itomdeploy254/Release-notes-and-notices/Known-and-corrected-issues/","source":"47237f96-ddbe-4467-a5ee-293a770beacd"},{"url":"https://docs.helixops.ai/bin/IT-Operations-Management/On-Premises-Deployment/BMC-Helix-IT-Operations-Management-Deployment/itomdeploy261/Release-notes-and-notices/Known-and-corrected-issues/","source":"47237f96-ddbe-4467-a5ee-293a770beacd"},{"url":"https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113697/advisory.md","source":"47237f96-ddbe-4467-a5ee-293a770beacd"}]}},{"cve":{"id":"CVE-2026-116399","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T14:17:50.260","lastModified":"2026-10-29T17:18:05.517","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Cross-Site Request Forgery (CSRF) vulnerability in InstaWP InstaWP Connect instawp-connect allows Cross Site Request Forgery.This issue affects InstaWP Connect: from n/a through 0.1.4.2."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"InstaWP","product":"InstaWP Connect","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"instawp-connect","versions":[{"version":"0","lessThanOrEqual":"0.1.4.2","versionType":"custom","status":"affected","changes":[{"at":"0.1.4.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:18:26.898338Z","id":"CVE-2026-116399","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/instawp-connect/vulnerability/wordpress-instawp-connect-plugin-0-1-4-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-116402","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T14:17:50.403","lastModified":"2026-10-29T17:18:05.617","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force SureForms sureforms allows Code Injection.This issue affects SureForms: from n/a through 2.12.9."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Brainstorm Force","product":"SureForms","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"sureforms","versions":[{"version":"0","lessThanOrEqual":"2.12.9","versionType":"custom","status":"affected","changes":[{"at":"2.13.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:17:56.322488Z","id":"CVE-2026-116402","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-80"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/sureforms/vulnerability/wordpress-sureforms-plugin-2-12-9-content-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-116857","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T14:17:50.767","lastModified":"2026-10-29T17:18:06.197","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.2."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Crocoblock","product":"JetSmartFilters","defaultStatus":"unaffected","collectionURL":"https://crocoblock.com","packageName":"jet-smart-filters","versions":[{"version":"0","lessThanOrEqual":"3.8.6.2","versionType":"custom","status":"affected","changes":[{"at":"3.8.6.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:18:20.336584Z","id":"CVE-2026-116857","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/jet-smart-filters/vulnerability/wordpress-jetsmartfilters-plugin-3-8-6-2-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-118425","sourceIdentifier":"secalert@redhat.com","published":"2026-10-29T14:17:51.360","lastModified":"2026-10-29T14:17:51.477","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occurs when the policy is configured to allow loopback addresses, as Keycloak resolves hostnames via DNS during validation. An attacker can bypass domain allowlist restrictions by using a hostname that resolves to a loopback address, potentially allowing the registration of unauthorized redirect URIs."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhbk/keycloak-rhel9","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Primary","description":[{"lang":"en","value":"CWE-601"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-118425","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-119048","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T14:17:51.650","lastModified":"2026-10-29T18:17:29.663","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"JeeSite 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability in the AI CMS chat module that allows authenticated users to access other users' conversations due to missing and reversed ownership checks. Attackers who know or derive a victim's conversation id can call /a/cms/chat/message, /a/cms/chat/delete, or /a/cms/chat/completions to read, delete, or append to the victim's AI chat transcripts."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"thinkgem","product":"JeeSite","defaultStatus":"unaffected","repo":"https://github.com/thinkgem/jeesite5","packageURL":"pkg:github/thinkgem/jeesite5","versions":[{"version":"5.11.0","lessThanOrEqual":"5.19.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":4.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T15:30:16.499790Z","id":"CVE-2026-119048","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/thinkgem/jeesite5","source":"disclosure@vulncheck.com"},{"url":"https://github.com/thinkgem/jeesite5/blob/5b5e2cf0adc45a1abe33d0f4ca149590d149b82d/modules/ai/ai-cms/src/main/java/com/jeesite/modules/ai/cms/service/AiCmsChatService.java#L111-L116","source":"disclosure@vulncheck.com"},{"url":"https://github.com/thinkgem/jeesite5/blob/5b5e2cf0adc45a1abe33d0f4ca149590d149b82d/modules/ai/ai-cms/src/main/java/com/jeesite/modules/ai/cms/service/CacheChatMemoryRepository.java#L59-L62","source":"disclosure@vulncheck.com"},{"url":"https://github.com/thinkgem/jeesite5/commit/cbc5ba7a37fd93f38c46ef656bd31442fe6f8015","source":"disclosure@vulncheck.com"},{"url":"https://github.com/thinkgem/jeesite5/issues/43","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@hieund/jeesite5-ai-cms-chat-conversation-idor","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/jeesite-5.11.0-through-5.19.1-idor-in-ai-cms-chat-module","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119049","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T14:17:51.827","lastModified":"2026-10-29T16:21:34.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToUser to read messages and verification codes, set forwarding, and delete mail."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"idinging","product":"FreeMail","defaultStatus":"unaffected","repo":"https://github.com/idinging/freemail","versions":[{"version":"0","lessThan":"5.3.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:02:16.305255Z","id":"CVE-2026-119049","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/idinging/freemail","source":"disclosure@vulncheck.com"},{"url":"https://github.com/idinging/freemail/blob/a95c1710e7eeb9f2c74a49ef962f4f43a36695b3/src/db/users.js#L137-L163","source":"disclosure@vulncheck.com"},{"url":"https://github.com/idinging/freemail/commit/62ed3afdbb4de90a135c12de928e586caf01b5a1","source":"disclosure@vulncheck.com"},{"url":"https://github.com/idinging/freemail/issues/73","source":"disclosure@vulncheck.com"},{"url":"https://github.com/idinging/freemail/releases/tag/v5.3.2","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/freemail-before-5.3.2-authorization-bypass-via-api-create-mailbox-claiming","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119050","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T14:17:51.990","lastModified":"2026-10-29T14:17:52.113","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). Attackers can use prompt injection to make the agent call pandas.read_pickle on attacker-controlled paths for code execution, or call other readers to read local files."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"agno-agi","product":"agno","defaultStatus":"unaffected","repo":"https://github.com/agno-agi/agno","packageURL":"pkg:pypi/agno","versions":[{"version":"0","lessThanOrEqual":"3.1.11","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-470"}]}],"references":[{"url":"https://github.com/agno-agi/agno","source":"disclosure@vulncheck.com"},{"url":"https://github.com/agno-agi/agno/blob/d9ab0a758286142e7d998ef313ee7504d7fd9453/libs/agno/agno/tools/pandas.py#L54","source":"disclosure@vulncheck.com"},{"url":"https://github.com/agno-agi/agno/blob/d9ab0a758286142e7d998ef313ee7504d7fd9453/libs/agno/agno/tools/pandas.py#L90","source":"disclosure@vulncheck.com"},{"url":"https://github.com/agno-agi/agno/issues/8699","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/agno-through-3.1.11-code-execution-via-pandastools-unsafe-reflection","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119051","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T14:17:52.157","lastModified":"2026-10-29T16:21:34.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the Node.js event loop."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"hughsk","product":"flat","defaultStatus":"unaffected","repo":"https://github.com/hughsk/flat","packageURL":"pkg:npm/flat","versions":[{"version":"0","lessThanOrEqual":"6.0.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":3.6}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://github.com/hughsk/flat","source":"disclosure@vulncheck.com"},{"url":"https://github.com/hughsk/flat/blob/1d68e1d06c0210cff31e5c61ac177f3e2d3fa564/index.js#L137-L142","source":"disclosure@vulncheck.com"},{"url":"https://github.com/hughsk/flat/blob/1d68e1d06c0210cff31e5c61ac177f3e2d3fa564/index.js#L65-L75","source":"disclosure@vulncheck.com"},{"url":"https://github.com/hughsk/flat/issues/195","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/flat-through-6.0.1-denial-of-service-via-unflatten-numeric-array-index-keys","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119052","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T14:17:52.310","lastModified":"2026-10-29T18:17:29.833","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc server that allows unauthenticated remote attackers to crash the rpc-server by sending oversized message lengths. After the HELLO handshake, attackers can send a command such as SET_TENSOR with a length above std::vector::max_size(), triggering an uncaught std::length_error that aborts the process and denies service to all clients."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"ggml-org","product":"llama.cpp","defaultStatus":"unaffected","repo":"https://github.com/ggml-org/llama.cpp","packageURL":"pkg:github/ggml-org/llama.cpp","versions":[{"version":"b2877","lessThan":"b11935","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T15:43:46.702942Z","id":"CVE-2026-119052","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-248"}]}],"references":[{"url":"https://github.com/ggml-org/llama.cpp","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ggml-org/llama.cpp/blob/8542e94350f0ade01644db6f1d1520da3814dafd/ggml/src/ggml-rpc/ggml-rpc.cpp#L344-L356","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ggml-org/llama.cpp/commit/7ecb57f7adbea2928aa468ad2aecf05b10725ad4","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ggml-org/llama.cpp/pull/31204","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ggml-org/llama.cpp/releases/tag/b11935","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/llama-cpp-b2877-before-b11935-ggml-rpc-server-dos-via-oversized-recv-msg-length","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119053","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T14:17:52.463","lastModified":"2026-10-29T16:21:34.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() that bounds copies by pbuf->len instead of remaining bytes. Remote unauthenticated attackers knowing the read community can send fragmented SNMP requests to receive adjacent receive-buffer or pool memory echoed in responses."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"lwIP","product":"lwIP","defaultStatus":"unaffected","collectionURL":"https://savannah.nongnu.org/projects/lwip/","repo":"https://git.savannah.nongnu.org/git/lwip.git","versions":[{"version":"2.0.0","lessThanOrEqual":"2.2.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:01:35.973034Z","id":"CVE-2026-119053","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/lwip-tcpip/lwip","source":"disclosure@vulncheck.com"},{"url":"https://github.com/lwip-tcpip/lwip/blob/77dcd25a72509eb83f72b033d219b1d40cd8eb95/src/apps/snmp/snmp_pbuf_stream.c#L111-L122","source":"disclosure@vulncheck.com"},{"url":"https://github.com/lwip-tcpip/lwip/commit/e98415014aca66ef0daefded8020763b9279a3b2","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/lwip-2.0.0-through-2.2.1-snmp-agent-out-of-bounds-read-via-snmp-pbuf-stream-writeto","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119054","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T14:17:52.667","lastModified":"2026-10-29T16:21:34.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the [mpg] and [mpg_match] shortcode base-url attribute. Attackers can store entity-encoded payloads that pass kses but are decoded by html_entity_decode() and rendered unescaped through {{mpg_url}}, executing script in administrators' browsers."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Themeisle","product":"Multiple Pages Generator by Themeisle","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","repo":"https://plugins.svn.wordpress.org/multiple-pages-generator-by-porthas/","versions":[{"version":"0","lessThan":"4.2.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.svn.wordpress.org/multiple-pages-generator-by-porthas/tags/4.2.4/controllers/display/Base_Display.php","source":"disclosure@vulncheck.com"},{"url":"https://plugins.svn.wordpress.org/multiple-pages-generator-by-porthas/tags/4.2.4/controllers/display/loop/Core.php","source":"disclosure@vulncheck.com"},{"url":"https://plugins.svn.wordpress.org/multiple-pages-generator-by-porthas/tags/4.2.4/models/CoreModel.php","source":"disclosure@vulncheck.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3742674/multiple-pages-generator-by-porthas","source":"disclosure@vulncheck.com"},{"url":"https://wordpress.org/plugins/multiple-pages-generator-by-porthas/","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/multiple-pages-generator-by-themeisle-before-4.2.5-stored-xss-via-shortcode-base-url","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-25467","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T14:17:54.277","lastModified":"2026-10-29T17:18:08.577","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ThemeGrill User Registration user-registration allows Code Injection.This issue affects User Registration: from n/a through 5.3.0."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemeGrill","product":"User Registration","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"user-registration","versions":[{"version":"0","lessThanOrEqual":"5.3.0","versionType":"custom","status":"affected","changes":[{"at":"5.3.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:18:32.115843Z","id":"CVE-2026-25467","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-80"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/user-registration/vulnerability/wordpress-user-registration-plugin-5-3-0-content-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39736","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T14:17:54.523","lastModified":"2026-10-29T17:18:08.807","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.1."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Crocoblock","product":"JetEngine","defaultStatus":"unaffected","collectionURL":"https://crocoblock.com","packageName":"jet-engine","versions":[{"version":"0","lessThanOrEqual":"3.9.0.1","versionType":"custom","status":"affected","changes":[{"at":"3.9.0.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:17:51.424823Z","id":"CVE-2026-39736","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-9-0-1-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39782","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T14:17:54.773","lastModified":"2026-10-29T17:18:08.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through 2.4.27."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Kaliforms","product":"Kali Forms","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"kali-forms","versions":[{"version":"0","lessThanOrEqual":"2.4.27","versionType":"custom","status":"affected","changes":[{"at":"2.4.28","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:18:11.962334Z","id":"CVE-2026-39782","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/kali-forms/vulnerability/wordpress-kali-forms-plugin-2-4-27-broken-access-control-vulnerability-2?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-42707","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T14:17:55.247","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through 1.1.4."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"HivePress","product":"HivePress Claim Listings","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"hivepress-claim-listings","versions":[{"version":"0","lessThanOrEqual":"1.1.4","versionType":"custom","status":"affected","changes":[{"at":"1.1.5","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T13:43:08.185757Z","id":"CVE-2026-42707","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/hivepress-claim-listings/vulnerability/wordpress-hivepress-claim-listings-plugin-1-1-4-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-48195","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T14:17:55.793","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster pdf-poster allows Stored XSS.This issue affects PDF Poster: from n/a through 2.6.1."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"bPlugins","product":"PDF Poster","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"pdf-poster","versions":[{"version":"0","lessThanOrEqual":"2.6.1","versionType":"custom","status":"affected","changes":[{"at":"2.6.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T13:38:13.766556Z","id":"CVE-2026-48195","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/pdf-poster/vulnerability/wordpress-pdf-poster-plugin-2-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-48202","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T14:17:56.040","lastModified":"2026-10-29T17:18:09.297","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brave Brave brave-popup-builder allows Code Injection.This issue affects Brave: from n/a through 0.8.8."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Brave","product":"Brave","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"brave-popup-builder","versions":[{"version":"0","lessThanOrEqual":"0.8.8","versionType":"custom","status":"affected","changes":[{"at":"0.8.9","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:18:04.902438Z","id":"CVE-2026-48202","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-80"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/brave-popup-builder/vulnerability/wordpress-brave-plugin-0-8-8-content-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-54862","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T14:17:56.403","lastModified":"2026-10-29T14:56:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codection Import and export users and customers import-users-from-csv-with-meta allows Stored XSS.This issue affects Import and export users and customers: from n/a through 2.5.9."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Codection","product":"Import and export users and customers","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"import-users-from-csv-with-meta","versions":[{"version":"0","lessThanOrEqual":"2.5.9","versionType":"custom","status":"affected","changes":[{"at":"2.5.10","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T13:38:09.374412Z","id":"CVE-2026-54862","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/import-users-from-csv-with-meta/vulnerability/wordpress-import-and-export-users-and-customers-plugin-2-5-9-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-79589","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T14:17:59.487","lastModified":"2026-10-29T16:21:34.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker to gain unauthenticated root shell. The vulnerability is caused by the exposure of the UART debugging interface having a lack of authentication, authorization and access control functionality. Once the interface is soldered and connected to the attacker, they gain root privilege to the system."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://github.com/milkinit/cve-disclosures/tree/main/IoT/CVE-2026-79589","source":"cve@mitre.org"},{"url":"https://www.u-speed.com.cn/en/product_details?production=N300&production_miaoshu=1%E6%89%9816%E4%B8%BB%E5%85%89%E7%8C%AB%2C%E4%BC%81%E4%B8%9A%E5%85%A8%E5%85%89%E4%B8%A4%E5%8D%83%E5%85%86%E6%8E%A5%E5%85%A5","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-93009","sourceIdentifier":"secalert@redhat.com","published":"2026-10-29T14:18:00.367","lastModified":"2026-10-30T08:17:00.737","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ceph Storage 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhceph/alloy-rhel10","cpes":["cpe:/a:redhat:ceph_storage:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift4/ose-baremetal-runtimecfg-rhel8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift4/ose-baremetal-runtimecfg-rhel9","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 5","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift5/ose-baremetal-runtimecfg-rhel9","cpes":["cpe:/a:redhat:openshift:5"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 5","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:5"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 13 (Queens)","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/a:redhat:openstack:13"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 18.0","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoso-operators/infra-rhel9-operator","cpes":["cpe:/a:redhat:openstack:18.0"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-93009","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2536083","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-93010","sourceIdentifier":"secalert@redhat.com","published":"2026-10-29T14:18:00.530","lastModified":"2026-10-30T08:17:01.083","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not check who sent the query. A host on the local network can request DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The feature is off unless an administrator turns it on."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ceph Storage 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhceph/alloy-rhel10","cpes":["cpe:/a:redhat:ceph_storage:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift4/ose-baremetal-runtimecfg-rhel8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift4/ose-baremetal-runtimecfg-rhel9","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 5","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift5/ose-baremetal-runtimecfg-rhel9","cpes":["cpe:/a:redhat:openshift:5"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 5","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:5"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 13 (Queens)","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dnsmasq","cpes":["cpe:/a:redhat:openstack:13"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 18.0","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoso-operators/infra-rhel9-operator","cpes":["cpe:/a:redhat:openstack:18.0"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-93010","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2536081","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-107014","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T15:17:15.077","lastModified":"2026-10-29T16:21:34.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user's' note database."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://f-droid.org/archive/bander.notepad_12.apk","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107014.md","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-107015","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T15:17:15.200","lastModified":"2026-10-29T20:17:24.567","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note database."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T19:51:28.197390Z","id":"CVE-2026-107015","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107015-CVE-2026-107016.md","source":"cve@mitre.org"},{"url":"https://github.com/SimpleMobileTools/Simple-Contacts","source":"cve@mitre.org"},{"url":"https://github.com/kanytu/Simple-Contacts/issues/628","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107015-CVE-2026-107016.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-107016","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T15:17:15.320","lastModified":"2026-10-29T16:21:34.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another user's stored contacts."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107015-CVE-2026-107016.md","source":"cve@mitre.org"},{"url":"https://github.com/FossifyOrg/Contacts","source":"cve@mitre.org"},{"url":"https://github.com/kanytu/Simple-Contacts/issues/628","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-107017","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T15:17:15.437","lastModified":"2026-10-30T19:18:01.653","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily trigger another user's configured automated actions."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:07:46.206268Z","id":"CVE-2026-107017","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://f-droid.org/packages/net.canvoki.vokibot/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107017.md","source":"cve@mitre.org"},{"url":"https://github.com/vokimon/vokibot","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107017.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-107018","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T15:17:15.550","lastModified":"2026-10-29T16:21:34.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files inside the commander's private storage."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://f-droid.org/packages/com.ghostsq.commander/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107018.md","source":"cve@mitre.org"},{"url":"https://sourceforge.net/p/ghostcommander","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-107019","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T15:17:15.667","lastModified":"2026-10-29T16:21:34.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to create forged holiday/work-time entries via crafted ICS imports."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://f-droid.org/packages/askanimus.arbeitszeiterfassung2/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107019.md","source":"cve@mitre.org"},{"url":"https://gitlab.com/Askanimus/arbeitszeitkonto","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-107020","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T15:17:15.780","lastModified":"2026-10-29T21:17:10.180","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader versionCode 116 allows attackers to force victim users into fetching a crafted URL."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T20:10:03.946663Z","id":"CVE-2026-107020","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-601"}]}],"references":[{"url":"https://f-droid.org/packages/ru.yanus171.feedexfork/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107020.md","source":"cve@mitre.org"},{"url":"https://github.com/yanus171/Handy-News-Reader/issues/941","source":"cve@mitre.org"},{"url":"https://github.com/yanus171/Handy-News-Reader/issues/952","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107020.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-107021","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T15:17:15.903","lastModified":"2026-10-29T16:21:34.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across the user's entire memorization database."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://f-droid.org/packages/org.liberty.android.fantastischmemo/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107021.md","source":"cve@mitre.org"},{"url":"https://github.com/helloworld1/AnyMemo","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-107023","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T15:17:16.023","lastModified":"2026-10-30T19:18:01.823","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allows unauthorized attackers to arbitrarily read another user's private notes/tasks/diary content."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:06:36.060186Z","id":"CVE-2026-107023","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-732"}]}],"references":[{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107023.md","source":"cve@mitre.org"},{"url":"https://github.com/mhss1/MyBrain","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107023.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-107024","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T15:17:16.133","lastModified":"2026-10-29T16:21:34.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in Share 2 Archive Today versionCode 61 allows unauthorized attackers to arbitrarily overwrite another user's clipboard content via supplying a crafted URL."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://f-droid.org/packages/org.gnosco.share2archivetoday/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107024.md","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-110881","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T15:17:16.250","lastModified":"2026-10-29T17:18:01.013","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureDash suredash allows Stored XSS.This issue affects SureDash: from n/a through 1.12.3."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Brainstorm Force","product":"SureDash","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"suredash","versions":[{"version":"0","lessThanOrEqual":"1.12.3","versionType":"custom","status":"affected","changes":[{"at":"1.12.4","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:34:53.533973Z","id":"CVE-2026-110881","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/suredash/vulnerability/wordpress-suredash-plugin-1-12-3-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-114181","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T15:17:16.543","lastModified":"2026-10-29T17:18:01.197","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.6."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Magepeople inc.","product":"Taxi Booking Manager for WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"ecab-taxi-booking-manager","versions":[{"version":"0","lessThanOrEqual":"2.1.6","versionType":"custom","status":"affected","changes":[{"at":"2.1.7","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:34:40.516258Z","id":"CVE-2026-114181","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/ecab-taxi-booking-manager/vulnerability/wordpress-taxi-booking-manager-for-woocommerce-plugin-2-1-6-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-114706","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T15:17:16.807","lastModified":"2026-10-30T19:18:11.877","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.15."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WP Chill","product":"Strong Testimonials","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"strong-testimonials","versions":[{"version":"0","lessThanOrEqual":"3.3.15","versionType":"custom","status":"affected","changes":[{"at":"3.3.16","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:32:29.411982Z","id":"CVE-2026-114706","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/strong-testimonials/vulnerability/wordpress-strong-testimonials-plugin-3-3-15-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-115601","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T15:17:17.080","lastModified":"2026-10-30T19:18:12.597","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in WP Desk Custom Price for WooCommerce custom-price-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Price for WooCommerce: from n/a through 1.1.29."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WP Desk","product":"Custom Price for WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"custom-price-for-woocommerce","versions":[{"version":"0","lessThanOrEqual":"1.1.29","versionType":"custom","status":"affected","changes":[{"at":"1.1.30","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:39:42.979095Z","id":"CVE-2026-115601","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/custom-price-for-woocommerce/vulnerability/wordpress-custom-price-for-woocommerce-plugin-1-1-29-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-115605","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T15:17:17.213","lastModified":"2026-10-29T17:18:01.360","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.3."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Brainstorm Force","product":"SureDash","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"suredash","versions":[{"version":"0","lessThanOrEqual":"1.12.3","versionType":"custom","status":"affected","changes":[{"at":"1.12.4","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:34:17.135119Z","id":"CVE-2026-115605","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/suredash/vulnerability/wordpress-suredash-plugin-1-12-3-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-115610","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T15:17:17.353","lastModified":"2026-10-30T19:18:12.833","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Authors publishpress-authors allows Stored XSS.This issue affects PublishPress Authors: from n/a through 4.17.0."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"PublishPress","product":"PublishPress Authors","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"publishpress-authors","versions":[{"version":"0","lessThanOrEqual":"4.17.0","versionType":"custom","status":"affected","changes":[{"at":"4.18.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:32:32.359930Z","id":"CVE-2026-115610","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/publishpress-authors/vulnerability/wordpress-publishpress-authors-plugin-4-17-0-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-115706","sourceIdentifier":"security@elastic.co","published":"2026-10-29T15:17:17.707","lastModified":"2026-10-30T18:17:22.483","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who controls any host in an ECE installation can obtain credentials that are reserved for other platform roles. These credentials can give the attacker full control of the ECE control plane and of the deployments that it manages."}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Elastic Cloud Enterprise","defaultStatus":"unaffected","versions":[{"version":"1.0.0","lessThanOrEqual":"3.8.5","versionType":"semver","status":"affected"},{"version":"4.0.0","lessThanOrEqual":"4.2.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:15.368437Z","id":"CVE-2026-115706","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elastic_cloud_enterprise:*:*:*:*:*:*:*:*","versionEndExcluding":"3.8.6","matchCriteriaId":"38A8371F-9A76-4222-BD14-A6C6B69D2DCA"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elastic_cloud_enterprise:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.2.1","matchCriteriaId":"94909A60-2364-4A02-80C1-87EB8097C332"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-211/391260","source":"security@elastic.co","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-115707","sourceIdentifier":"security@elastic.co","published":"2026-10-29T15:17:17.850","lastModified":"2026-10-30T18:17:22.607","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Retrieve Embedded Sensitive Data (CAPEC-37). After the ECE certificate rotation procedure runs, data that it retains contains platform credentials and certificate authority private keys, and lower-privileged platform components can read this data. An attacker who controls any host in the installation can use this data to get full control of the ECE control plane and of the deployments that it manages."}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Elastic Cloud Enterprise","defaultStatus":"unaffected","versions":[{"version":"2.6.0","lessThanOrEqual":"3.8.5","versionType":"semver","status":"affected"},{"version":"4.0.0","lessThanOrEqual":"4.2.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.5,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:16.136598Z","id":"CVE-2026-115707","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-538"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elastic_cloud_enterprise:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.0","versionEndExcluding":"3.8.6","matchCriteriaId":"2B8E725E-54E3-40CD-ADED-CB7B73D9E21A"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elastic_cloud_enterprise:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.2.1","matchCriteriaId":"94909A60-2364-4A02-80C1-87EB8097C332"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-212/391261","source":"security@elastic.co","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-115708","sourceIdentifier":"security@elastic.co","published":"2026-10-29T15:17:17.977","lastModified":"2026-10-30T18:17:22.733","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host via Symlink Attack (CAPEC-132)."}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Elastic Cloud Enterprise","defaultStatus":"unaffected","versions":[{"version":"1.0.0","lessThanOrEqual":"3.8.5","versionType":"semver","status":"affected"},{"version":"4.0.0","lessThanOrEqual":"4.2.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":0.8,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:16.887825Z","id":"CVE-2026-115708","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-59"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elastic_cloud_enterprise:*:*:*:*:*:*:*:*","versionEndExcluding":"3.8.6","matchCriteriaId":"38A8371F-9A76-4222-BD14-A6C6B69D2DCA"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elastic_cloud_enterprise:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.2.1","matchCriteriaId":"94909A60-2364-4A02-80C1-87EB8097C332"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-215/391262","source":"security@elastic.co","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-115709","sourceIdentifier":"security@elastic.co","published":"2026-10-29T15:17:18.100","lastModified":"2026-10-30T18:17:22.847","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized disclosure and loss of data belonging to other deployments on the same host via Symlink Attack (CAPEC-132)."}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Elastic Cloud Enterprise","defaultStatus":"unaffected","versions":[{"version":"2.6.0","lessThanOrEqual":"3.8.5","versionType":"semver","status":"affected"},{"version":"4.0.0","lessThanOrEqual":"4.2.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:13.037915Z","id":"CVE-2026-115709","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-59"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elastic_cloud_enterprise:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.0","versionEndExcluding":"3.8.6","matchCriteriaId":"2B8E725E-54E3-40CD-ADED-CB7B73D9E21A"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elastic_cloud_enterprise:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.2.1","matchCriteriaId":"94909A60-2364-4A02-80C1-87EB8097C332"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-216/391263","source":"security@elastic.co","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-115711","sourceIdentifier":"security@elastic.co","published":"2026-10-29T15:17:18.220","lastModified":"2026-10-30T18:17:22.977","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to credential disclosure via Retrieve Embedded Sensitive Data (CAPEC-37). ECE stores runtime information about platform service containers in a location that lower-privileged platform components can read, and this information includes secrets from the container configuration. An attacker with access to the internal ECE platform services can obtain these secrets, which include role tokens. A role token can let the attacker add an unauthorized host to the installation with the roles of that token."}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Elastic Cloud Enterprise","defaultStatus":"unaffected","versions":[{"version":"1.0.0","lessThanOrEqual":"3.8.5","versionType":"semver","status":"affected"},{"version":"4.0.0","lessThanOrEqual":"4.2.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.5,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:13.783802Z","id":"CVE-2026-115711","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-538"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elastic_cloud_enterprise:*:*:*:*:*:*:*:*","versionEndExcluding":"3.8.6","matchCriteriaId":"38A8371F-9A76-4222-BD14-A6C6B69D2DCA"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elastic_cloud_enterprise:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.2.1","matchCriteriaId":"94909A60-2364-4A02-80C1-87EB8097C332"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-218/391264","source":"security@elastic.co","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-115712","sourceIdentifier":"security@elastic.co","published":"2026-10-29T15:17:18.337","lastModified":"2026-10-30T15:08:16.533","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of platform-level settings via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read-only access to the platform can change an installation-wide account setting that only platform administrators are permitted to change."}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Elastic Cloud Enterprise","defaultStatus":"unaffected","versions":[{"version":"3.8.0","lessThanOrEqual":"3.8.5","versionType":"semver","status":"affected"},{"version":"4.0.0","lessThanOrEqual":"4.2.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:38:05.538290Z","id":"CVE-2026-115712","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elastic_cloud_enterprise:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8.0","versionEndExcluding":"3.8.6","matchCriteriaId":"0BE13221-263E-4D54-9608-154D4E5B9ACE"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elastic_cloud_enterprise:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.2.1","matchCriteriaId":"94909A60-2364-4A02-80C1-87EB8097C332"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-221/391265","source":"security@elastic.co","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-115713","sourceIdentifier":"security@elastic.co","published":"2026-10-29T15:17:18.460","lastModified":"2026-10-30T15:07:50.060","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized read and write access to data of other deployments on the same host via Symlink Attack (CAPEC-132)."}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Elastic Cloud Enterprise","defaultStatus":"unaffected","versions":[{"version":"4.1.0","lessThanOrEqual":"4.2.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T00:00:00+00:00","id":"CVE-2026-115713","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-59"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elastic_cloud_enterprise:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.2.1","matchCriteriaId":"1B7C22ED-DAEC-460C-BD56-59DED06D56C1"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-4-2-1-security-update-esa-2026-222/391266","source":"security@elastic.co","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-116387","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T15:17:19.773","lastModified":"2026-10-30T19:18:13.790","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.12.9."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Brainstorm Force","product":"SureForms","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"sureforms","versions":[{"version":"0","lessThanOrEqual":"2.12.9","versionType":"custom","status":"affected","changes":[{"at":"2.13.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:39:30.437920Z","id":"CVE-2026-116387","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/sureforms/vulnerability/wordpress-sureforms-plugin-2-12-9-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-116406","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T15:17:19.910","lastModified":"2026-10-29T17:18:05.713","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.4."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Webba Plugins","product":"Webba Booking","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"webba-booking-lite","versions":[{"version":"0","lessThanOrEqual":"6.5.4","versionType":"custom","status":"affected","changes":[{"at":"6.5.5","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:35:03.974060Z","id":"CVE-2026-116406","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/webba-booking-lite/vulnerability/wordpress-webba-booking-plugin-6-5-4-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-116846","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T15:17:20.050","lastModified":"2026-10-29T17:18:05.807","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.26."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WP User Manager","product":"WP User Manager","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-user-manager","versions":[{"version":"0","lessThanOrEqual":"2.9.26","versionType":"custom","status":"affected","changes":[{"at":"2.10.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:35:15.209318Z","id":"CVE-2026-116846","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-user-manager/vulnerability/wordpress-wp-user-manager-plugin-2-9-26-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-116849","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T15:17:20.180","lastModified":"2026-10-29T17:18:05.907","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins StreamCast streamcast allows Stored XSS.This issue affects StreamCast: from n/a through 2.4.6."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"bPlugins","product":"StreamCast","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"streamcast","versions":[{"version":"0","lessThanOrEqual":"2.4.6","versionType":"custom","status":"affected","changes":[{"at":"2.4.7","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:34:49.570031Z","id":"CVE-2026-116849","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/streamcast/vulnerability/wordpress-streamcast-plugin-2-4-6-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-116850","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T15:17:20.303","lastModified":"2026-10-29T17:18:06.007","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.50.1."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"weDevs","product":"Happy Addons for Elementor","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"happy-elementor-addons","versions":[{"version":"0","lessThanOrEqual":"3.50.1","versionType":"custom","status":"affected","changes":[{"at":"3.51.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:34:34.443015Z","id":"CVE-2026-116850","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/happy-elementor-addons/vulnerability/wordpress-happy-addons-for-elementor-plugin-3-50-1-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-116856","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T15:17:20.433","lastModified":"2026-10-29T17:18:06.103","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.24."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WP Desk","product":"Flexible Quantity – Measurement Price Calculator for WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"flexible-quantity-measurement-price-calculator-for-woocommerce","versions":[{"version":"0","lessThanOrEqual":"2.3.24","versionType":"custom","status":"affected","changes":[{"at":"2.3.25","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:34:57.861744Z","id":"CVE-2026-116856","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/flexible-quantity-measurement-price-calculator-for-woocommerce/vulnerability/wordpress-flexible-quantity-measurement-price-calculator-for-woocommerce-plugin-2-3-24-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-118088","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T15:17:20.803","lastModified":"2026-10-29T17:18:06.297","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through 3.13.5."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WPFunnels Team","product":"WPFunnels","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wpfunnels","versions":[{"version":"0","lessThanOrEqual":"3.13.5","versionType":"custom","status":"affected","changes":[{"at":"3.13.6","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:34:46.298422Z","id":"CVE-2026-118088","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wpfunnels/vulnerability/wordpress-wpfunnels-plugin-3-13-5-broken-access-control-vulnerability-2?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-118091","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T15:17:20.933","lastModified":"2026-10-30T19:18:17.673","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through 3.13.5."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WPFunnels Team","product":"WPFunnels","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wpfunnels","versions":[{"version":"0","lessThanOrEqual":"3.13.5","versionType":"custom","status":"affected","changes":[{"at":"3.13.6","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:39:36.994802Z","id":"CVE-2026-118091","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wpfunnels/vulnerability/wordpress-wpfunnels-plugin-3-13-5-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-118092","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T15:17:21.057","lastModified":"2026-10-29T18:17:25.330","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through 3.7.55."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"StylemixThemes","product":"MasterStudy LMS","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"masterstudy-lms-learning-management-system","versions":[{"version":"0","lessThanOrEqual":"3.7.55","versionType":"custom","status":"affected","changes":[{"at":"3.7.56","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T15:30:25.579703Z","id":"CVE-2026-118092","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/masterstudy-lms-learning-management-system/vulnerability/wordpress-masterstudy-lms-plugin-3-7-55-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-118095","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T15:17:21.190","lastModified":"2026-10-29T17:18:06.390","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows DOM-Based XSS.This issue affects Media LIbrary Assistant: from n/a through 3.42."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"David Lingren","product":"Media LIbrary Assistant","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"media-library-assistant","versions":[{"version":"0","lessThanOrEqual":"3.42","versionType":"custom","status":"affected","changes":[{"at":"3.43","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:34:20.555825Z","id":"CVE-2026-118095","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/media-library-assistant/vulnerability/wordpress-media-library-assistant-plugin-3-42-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-118097","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T15:17:21.320","lastModified":"2026-10-29T20:17:29.400","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash & HTML5 Video html5-video-player allows Stored XSS.This issue affects Flash & HTML5 Video: from n/a through 2.14.0."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"bPlugins","product":"Flash & HTML5 Video","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"html5-video-player","versions":[{"version":"0","lessThanOrEqual":"2.14.0","versionType":"custom","status":"affected","changes":[{"at":"2.14.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T19:33:51.493751Z","id":"CVE-2026-118097","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/html5-video-player/vulnerability/wordpress-flash-html5-video-plugin-2-14-0-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-25448","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T15:17:22.147","lastModified":"2026-10-29T20:17:31.243","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through 1.17.10."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"weDevs","product":"WP ERP","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"erp","versions":[{"version":"0","lessThanOrEqual":"1.17.10","versionType":"custom","status":"affected","changes":[{"at":"1.17.11","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T19:34:21.781995Z","id":"CVE-2026-25448","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/erp/vulnerability/wordpress-wp-erp-plugin-1-17-10-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-25450","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T15:17:22.277","lastModified":"2026-10-29T17:18:08.463","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.3.0."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemeGrill","product":"User Registration","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"user-registration","versions":[{"version":"0","lessThanOrEqual":"5.3.0","versionType":"custom","status":"affected","changes":[{"at":"5.3.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:34:30.886649Z","id":"CVE-2026-25450","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/user-registration/vulnerability/wordpress-user-registration-plugin-5-3-0-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-27062","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T15:17:22.407","lastModified":"2026-10-30T19:18:23.553","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Cross-Site Request Forgery (CSRF) vulnerability in WPFunnels Team WPFunnels wpfunnels allows Cross Site Request Forgery.This issue affects WPFunnels: from n/a through 3.13.5."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WPFunnels Team","product":"WPFunnels","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wpfunnels","versions":[{"version":"0","lessThanOrEqual":"3.13.5","versionType":"custom","status":"affected","changes":[{"at":"3.13.6","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:42:14.808162Z","id":"CVE-2026-27062","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wpfunnels/vulnerability/wordpress-wpfunnels-plugin-3-13-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-27063","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T15:17:22.560","lastModified":"2026-10-30T19:18:23.653","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.7."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Kit","product":"Kit (formerly ConvertKit)","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"convertkit","versions":[{"version":"0","lessThanOrEqual":"3.4.7","versionType":"custom","status":"affected","changes":[{"at":"3.4.8","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:39:49.070620Z","id":"CVE-2026-27063","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/convertkit/vulnerability/wordpress-kit-formerly-convertkit-plugin-3-4-7-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39737","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T15:17:22.750","lastModified":"2026-10-29T18:17:31.547","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.6."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Crocoblock","product":"JetElements For Elementor","defaultStatus":"unaffected","collectionURL":"https://crocoblock.com","packageName":"jet-elements","versions":[{"version":"0","lessThanOrEqual":"2.9.2.6","versionType":"custom","status":"affected","changes":[{"at":"2.9.2.7","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T15:30:33.334452Z","id":"CVE-2026-39737","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/jet-elements/vulnerability/wordpress-jetelements-for-elementor-plugin-2-9-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-39742","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T15:17:22.880","lastModified":"2026-10-29T15:18:54.943","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.8.0.2."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Liquid Web / StellarWP","product":"Gutenberg Blocks by Kadence Blocks","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"kadence-blocks","versions":[{"version":"0","lessThanOrEqual":"3.8.0.2","versionType":"custom","status":"affected","changes":[{"at":"3.8.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:37:05.835260Z","id":"CVE-2026-39742","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/kadence-blocks/vulnerability/wordpress-gutenberg-blocks-by-kadence-blocks-plugin-3-8-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-42691","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T15:17:23.020","lastModified":"2026-10-30T19:18:24.877","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Authorization Bypass Through User-Controlled Key vulnerability in EventPrime EventPrime eventprime-event-calendar-management allows Privilege Abuse.This issue affects EventPrime: from n/a through 4.3.6.0."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"EventPrime","product":"EventPrime","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"eventprime-event-calendar-management","versions":[{"version":"0","lessThanOrEqual":"4.3.6.0","versionType":"custom","status":"affected","changes":[{"at":"4.3.6.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:41:53.849230Z","id":"CVE-2026-42691","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/eventprime-event-calendar-management/vulnerability/wordpress-eventprime-plugin-4-3-6-0-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-48884","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T15:17:23.153","lastModified":"2026-10-29T17:18:09.400","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 4.3.13."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"weDevs","product":"WP User Frontend","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-user-frontend","versions":[{"version":"0","lessThanOrEqual":"4.3.13","versionType":"custom","status":"affected","changes":[{"at":"4.3.14","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:35:19.391063Z","id":"CVE-2026-48884","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-user-frontend/vulnerability/wordpress-wp-user-frontend-plugin-4-3-13-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-52708","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T15:17:23.290","lastModified":"2026-10-29T17:18:09.720","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 4.3.13."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"weDevs","product":"WP User Frontend","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-user-frontend","versions":[{"version":"0","lessThanOrEqual":"4.3.13","versionType":"custom","status":"affected","changes":[{"at":"4.3.14","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:35:10.138263Z","id":"CVE-2026-52708","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-user-frontend/vulnerability/wordpress-wp-user-frontend-plugin-4-3-13-broken-access-control-vulnerability-2?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-54852","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T15:17:23.540","lastModified":"2026-10-30T19:18:26.000","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress (WP): from n/a through 1.6.1."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"miniOrange","product":"Page Restriction WordPress (WP)","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"page-and-post-restriction","versions":[{"version":"0","lessThanOrEqual":"1.6.1","versionType":"custom","status":"affected","changes":[{"at":"1.6.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:42:00.846771Z","id":"CVE-2026-54852","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/page-and-post-restriction/vulnerability/wordpress-page-restriction-wordpress-wp-plugin-1-6-1-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-54853","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T15:17:23.673","lastModified":"2026-10-29T18:17:33.013","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Profile Builder: from n/a through 4.0.5."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Cozmoslabs","product":"Profile Builder","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"profile-builder","versions":[{"version":"0","lessThanOrEqual":"4.0.5","versionType":"custom","status":"affected","changes":[{"at":"4.0.6","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T15:43:48.865889Z","id":"CVE-2026-54853","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/profile-builder/vulnerability/wordpress-profile-builder-plugin-4-0-5-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-54871","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T15:17:23.807","lastModified":"2026-10-29T17:18:09.823","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through 3.4.2."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Mamunur Rashid","product":"ShopBuilder – Elementor WooCommerce Builder Addons","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"shopbuilder","versions":[{"version":"0","lessThanOrEqual":"3.4.2","versionType":"custom","status":"affected","changes":[{"at":"3.4.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:34:25.941107Z","id":"CVE-2026-54871","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/shopbuilder/vulnerability/wordpress-shopbuilder-elementor-woocommerce-builder-addons-plugin-3-4-2-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-80067","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T15:17:24.380","lastModified":"2026-10-29T17:18:10.653","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stm_lms_step parameter passed to the stm_lms_import_sample_data AJAX action, which lacks capability checks and nonce verification. Attackers can traverse the file system to reference a reachable WXR file and have the handler publish its contained posts under their identity, enabling publication of attacker-chosen post type, title, content, and metadata."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Stylemix","product":"MasterStudy LMS WordPress Plugin","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.7.50","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:37:50.894489Z","id":"CVE-2026-80067","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://docs.stylemixthemes.com/masterstudy-lms/changelog-free-version","source":"disclosure@vulncheck.com"},{"url":"https://wordpress.org/plugins/masterstudy-lms-learning-management-system","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/masterstudy-lms-wordpress-plugin-path-traversal-via-stm-lms-step-parameter","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-80069","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T15:17:24.947","lastModified":"2026-10-29T17:18:10.780","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stm_lms_send_test_email_ajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via cross-site request forgery to cause an uncaught PHP fatal error that, when display_errors is enabled, discloses the absolute filesystem path of the plugin."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Stylemix","product":"MasterStudy LMS WordPress Plugin","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.7.50","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T14:35:27.438888Z","id":"CVE-2026-80069","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://docs.stylemixthemes.com/masterstudy-lms/changelog-free-version","source":"disclosure@vulncheck.com"},{"url":"https://wordpress.org/plugins/masterstudy-lms-learning-management-system","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/masterstudy-lms-wordpress-plugin-missing-authorization-via-stm-lms-send-test-email-ajax","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-97073","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T15:17:25.573","lastModified":"2026-10-29T18:17:39.730","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"myCred","product":"myCred","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"mycred","versions":[{"version":"0","lessThanOrEqual":"4.0.2","versionType":"custom","status":"affected","changes":[{"at":"4.0.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T15:43:50.948249Z","id":"CVE-2026-97073","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/mycred/vulnerability/wordpress-mycred-plugin-4-0-2-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2025-13050","sourceIdentifier":"bd4443e6-1eef-43f3-9886-25fc9ceeaae7","published":"2026-10-29T16:17:32.127","lastModified":"2026-10-30T18:17:13.587","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Broken Function Level Authorization allows execution of poller post-restart commands by authenticated user"}],"affected":[{"source":"bd4443e6-1eef-43f3-9886-25fc9ceeaae7","affectedData":[{"vendor":"Centreon","product":"Centreon","defaultStatus":"unaffected","packageName":"https://central.platform/centreon","versions":[{"version":"25.10","lessThan":"centreon-web-25.10.9","versionType":"custom","status":"affected"},{"version":"24.10","lessThan":"centreon-web-24.10.21","versionType":"custom","status":"affected"},{"version":"24.04","lessThan":"centreon-web-24.04.25","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"bd4443e6-1eef-43f3-9886-25fc9ceeaae7","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:23:12.106820Z","id":"CVE-2025-13050","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"bd4443e6-1eef-43f3-9886-25fc9ceeaae7","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/centreon/centreon/releases","source":"bd4443e6-1eef-43f3-9886-25fc9ceeaae7"},{"url":"https://thewatch.centreon.comundefined","source":"bd4443e6-1eef-43f3-9886-25fc9ceeaae7"}]}},{"cve":{"id":"CVE-2026-101288","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:17:35.203","lastModified":"2026-10-30T18:17:14.300","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.3:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:30.294890Z","id":"CVE-2026-101288","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.12.4","matchCriteriaId":"7DD7A51A-E98C-4322-8E25-D5DBC2AC55BA"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293015","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102590","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:17:39.683","lastModified":"2026-10-30T13:33:53.350","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.3:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","baseScore":5.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Primary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.12.4","matchCriteriaId":"7DD7A51A-E98C-4322-8E25-D5DBC2AC55BA"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293015","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-103092","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:17:41.547","lastModified":"2026-10-30T13:33:37.257","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper access control."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.3:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":4.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T16:15:46.513797Z","id":"CVE-2026-103092","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.12.4","matchCriteriaId":"7DD7A51A-E98C-4322-8E25-D5DBC2AC55BA"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293015","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-104308","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:17:43.020","lastModified":"2026-10-30T13:33:02.020","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an OS command."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.3:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":1.4}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.12.4","matchCriteriaId":"7DD7A51A-E98C-4322-8E25-D5DBC2AC55BA"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293015","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-104309","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:17:43.153","lastModified":"2026-10-30T13:32:48.193","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.3:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T19:37:09.999017Z","id":"CVE-2026-104309","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.12.4","matchCriteriaId":"7DD7A51A-E98C-4322-8E25-D5DBC2AC55BA"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293015","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-104310","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:17:43.277","lastModified":"2026-10-30T13:32:40.460","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery (SSRF) vulnerability."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.3:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Primary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.12.4","matchCriteriaId":"7DD7A51A-E98C-4322-8E25-D5DBC2AC55BA"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293015","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-104312","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:17:43.400","lastModified":"2026-10-30T13:32:25.910","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to produce a server-generated ZIP archive containing entry paths that traverse outside the intended extraction directory. Extraction of the archive by a victim using a non-sanitizing tool could result in arbitrary file write on the victim's host."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.3:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":4.0}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.12.4","matchCriteriaId":"7DD7A51A-E98C-4322-8E25-D5DBC2AC55BA"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293015","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-104314","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:17:43.527","lastModified":"2026-10-30T13:31:37.413","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker with a read or share grant on a target flow to retrieve the flow owner's stored third-party credentials in cleartext from the API response."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.3:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T16:15:44.172450Z","id":"CVE-2026-104314","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-522"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.12.4","matchCriteriaId":"7DD7A51A-E98C-4322-8E25-D5DBC2AC55BA"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293015","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-104315","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:17:43.653","lastModified":"2026-10-30T13:31:19.470","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.3:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Primary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.12.4","matchCriteriaId":"7DD7A51A-E98C-4322-8E25-D5DBC2AC55BA"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293015","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-104316","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:17:43.783","lastModified":"2026-10-30T13:31:03.840","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to cancel any victim's running background workflow job by sending a single HTTP request, resulting in loss of in-progress compute work with no flow-level permission check."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.3:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T19:36:35.598770Z","id":"CVE-2026-104316","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.12.4","matchCriteriaId":"7DD7A51A-E98C-4322-8E25-D5DBC2AC55BA"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293015","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-104317","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:17:43.907","lastModified":"2026-10-30T18:17:15.127","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.3:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:29.419294Z","id":"CVE-2026-104317","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.12.4","matchCriteriaId":"7DD7A51A-E98C-4322-8E25-D5DBC2AC55BA"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293015","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-104324","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:17:44.033","lastModified":"2026-10-30T18:17:15.247","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrusted data."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.3:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:28.661618Z","id":"CVE-2026-104324","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.12.4","matchCriteriaId":"7DD7A51A-E98C-4322-8E25-D5DBC2AC55BA"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293015","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-104328","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:17:44.153","lastModified":"2026-10-30T13:29:55.707","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.3:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T00:00:00+00:00","id":"CVE-2026-104328","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.12.4","matchCriteriaId":"7DD7A51A-E98C-4322-8E25-D5DBC2AC55BA"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293015","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-104331","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:17:44.280","lastModified":"2026-10-30T13:29:24.130","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.3:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Primary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.12.4","matchCriteriaId":"7DD7A51A-E98C-4322-8E25-D5DBC2AC55BA"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293015","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-104339","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:17:44.403","lastModified":"2026-10-30T13:29:15.737","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.3:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T00:00:00+00:00","id":"CVE-2026-104339","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.12.4","matchCriteriaId":"7DD7A51A-E98C-4322-8E25-D5DBC2AC55BA"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293015","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-106036","sourceIdentifier":"cvd@cert.pl","published":"2026-10-29T16:17:47.653","lastModified":"2026-10-29T16:30:07.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their server.\n\n\n\nThis issue was fixed in version 2.0 build 708."}],"affected":[{"source":"cvd@cert.pl","affectedData":[{"vendor":"Krajowa Izba Rozliczeniowa","product":"Szafir","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.0","versionType":"custom","status":"affected","changes":[{"at":"build 708","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"cvd@cert.pl","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"cvd@cert.pl","type":"Primary","description":[{"lang":"en","value":"CWE-295"}]}],"references":[{"url":"https://cert.pl/posts/2026/10/CVE-2026-93570","source":"cvd@cert.pl"},{"url":"https://www.elektronicznypodpis.pl/","source":"cvd@cert.pl"}]}},{"cve":{"id":"CVE-2026-107025","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T16:17:48.277","lastModified":"2026-10-29T16:30:07.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's data."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://f-droid.org/archive/de.mbutscher.wikiandpad.alphabeta_200300.apk","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107025.md","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-107026","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T16:17:48.383","lastModified":"2026-10-29T21:17:10.340","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in Share to Clipboard v1.14.1 (versionCode 32) allows unauthorized attackers to arbitrarily overwrite another user's clipboard content."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T20:07:09.527298Z","id":"CVE-2026-107026","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-732"}]}],"references":[{"url":"https://f-droid.org/packages/com.tengu.sharetoclipboard/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107026.md","source":"cve@mitre.org"},{"url":"https://github.com/tengusw/share_to_clipboard","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107026.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-107027","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T16:17:48.503","lastModified":"2026-10-29T16:30:07.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://f-droid.org/packages/cn.ac.lz233.tarnhelm/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107027.md","source":"cve@mitre.org"},{"url":"https://github.com/lz233/Tarnhelm","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-107028","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T16:17:48.613","lastModified":"2026-10-30T19:18:01.993","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an exported component, leading to manipulation of the shopping-list data."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:05:22.139965Z","id":"CVE-2026-107028","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://f-droid.org/packages/com.wbpxre150.shoppinglist/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107028.md","source":"cve@mitre.org"},{"url":"https://github.com/wbpxre150/android-shoppinglist","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107028.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-107029","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T16:17:48.723","lastModified":"2026-10-29T16:30:07.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://f-droid.org/packages/es.pile/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107029.md","source":"cve@mitre.org"},{"url":"https://github.com/rubenalfon/Pile","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-107030","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T16:17:48.833","lastModified":"2026-10-29T16:30:07.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) allows unauthorized attackers to trigger the OTP-clipboard (One-Time Password) mechanism, causing a desynchronization of the timing."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://f-droid.org/packages/com.craftxbox.yubiclip.xor/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107030.md","source":"cve@mitre.org"},{"url":"https://github.com/craftxbox/yubiclip-xor","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-107032","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T16:17:48.943","lastModified":"2026-10-29T21:17:10.497","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T20:05:15.916822Z","id":"CVE-2026-107032","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-926"}]}],"references":[{"url":"https://f-droid.org/packages/me.alexghr.bulkshare.android.app2/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107032.md","source":"cve@mitre.org"},{"url":"https://github.com/alexghr/bulkshare","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107032.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-107033","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T16:17:49.053","lastModified":"2026-10-29T16:30:07.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 (versionCode 60) allows unauthorized attackers to arbitrarily read and modify another user's task database."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107033.md","source":"cve@mitre.org"},{"url":"https://github.com/MirakelX/mirakel-android","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-107034","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T16:17:49.160","lastModified":"2026-10-30T19:18:02.163","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers to arbitrarily read another user's note data."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:03:00.504986Z","id":"CVE-2026-107034","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://f-droid.org/packages/com.git.amarradi.leafpad/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107034.md","source":"cve@mitre.org"},{"url":"https://github.com/amarradi/leafpad_Android","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107034.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-107035","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T16:17:49.267","lastModified":"2026-10-29T16:30:07.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in the object/Page.java component of MBasov OMN Outline notes Markdown versionCode 3400 allows unauthorized attackers to arbitrarily write content into another user's private storage via a crafted payload."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://f-droid.org/packages/net.basov.omn.fdroid/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107035.md","source":"cve@mitre.org"},{"url":"https://github.com/mvbasov/OMN","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-107036","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T16:17:49.383","lastModified":"2026-10-29T16:30:07.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in Mission Control / AIMSICD versionCode 2026080501 allows unauthorized attackers to invoke an exported component, impacting the tracker blocker mechanism of the application."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://f-droid.org/packages/net.kollnig.missioncontrol.fdroid/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107036.md","source":"cve@mitre.org"},{"url":"https://github.com/tobiaskollnig/MissionControl","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-107037","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T16:17:49.490","lastModified":"2026-10-29T21:17:10.660","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in the NotificationHelper component of NoNonsense Notes versionCode 72600 allows unauthorized attackers to write in another user's notes via supplying a note id."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T20:03:27.906505Z","id":"CVE-2026-107037","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://f-droid.org/packages/com.nononsenseapps.notepad/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107037.md","source":"cve@mitre.org"},{"url":"https://github.com/spacecowboy/NotePad","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107037.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-107038","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T16:17:49.603","lastModified":"2026-10-29T16:30:07.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://f-droid.org/packages/de.yaacc/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107038.md","source":"cve@mitre.org"},{"url":"https://github.com/cbejr/yaacc","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-107039","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T16:17:49.713","lastModified":"2026-10-30T19:18:02.330","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in the ActivityMain component of M66B/Marcel Bokhorst NetGuard no-root firewall versionCode 2026080101/versionName 2.337 allows unauthorized attackers to arbitrarily force a device reset or Denial of Service (DoS)."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:01:58.732669Z","id":"CVE-2026-107039","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-732"}]}],"references":[{"url":"https://f-droid.org/packages/eu.faircode.netguard/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107039.md","source":"cve@mitre.org"},{"url":"https://github.com/M66B/NetGuard","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107039.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-107040","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T16:17:49.827","lastModified":"2026-10-29T16:30:07.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://f-droid.org/packages/net.basov.omngo.fdroid/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107040.md","source":"cve@mitre.org"},{"url":"https://github.com/mvbasov/OMN-Go","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-107041","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T16:17:49.937","lastModified":"2026-10-29T16:30:07.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized attackers to arbitrarily force a freeze in the device, leading to a Denial of Service (DoS)."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://f-droid.org/packages/com.oasisfeng.island.fdroid/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107041.md","source":"cve@mitre.org"},{"url":"https://github.com/oasisfeng/island","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-107042","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T16:17:50.050","lastModified":"2026-10-29T20:17:24.737","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 allows unauthorized attackers to move or overwrite files in another user's private storage via supplying a crafted content URI."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T20:01:24.975013Z","id":"CVE-2026-107042","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-732"}]}],"references":[{"url":"https://f-droid.org/packages/app.usp/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107042.md","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107042.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-107326","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:17:50.160","lastModified":"2026-10-30T18:17:18.360","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.4:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:26.389689Z","id":"CVE-2026-107326","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.12.5","matchCriteriaId":"E87E255E-36D3-4111-86DC-F5632C97BD70"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293016","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-107327","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:17:50.330","lastModified":"2026-10-30T18:17:18.517","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.4:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:25.583962Z","id":"CVE-2026-107327","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.12.5","matchCriteriaId":"E87E255E-36D3-4111-86DC-F5632C97BD70"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293016","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-107328","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:17:50.480","lastModified":"2026-10-30T13:28:42.137","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.4:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T00:00:00+00:00","id":"CVE-2026-107328","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.12.5","matchCriteriaId":"E87E255E-36D3-4111-86DC-F5632C97BD70"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293016","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-107329","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:17:50.633","lastModified":"2026-10-30T18:17:18.667","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.4:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:24.082407Z","id":"CVE-2026-107329","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.12.5","matchCriteriaId":"E87E255E-36D3-4111-86DC-F5632C97BD70"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293016","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-108494","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:17:55.277","lastModified":"2026-10-29T20:17:25.373","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Chained Quiz <= 1.4.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Bob","product":"Chained Quiz","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"chained-quiz","versions":[{"version":"n/a","lessThanOrEqual":"1.4.1","versionType":"custom","status":"affected","changes":[{"at":"1.4.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T19:46:41.071002Z","id":"CVE-2026-108494","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/chained-quiz/vulnerability/wordpress-chained-quiz-plugin-1-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-109891","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:17:55.650","lastModified":"2026-10-30T19:18:08.080","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through 3.50.1."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"weDevs","product":"Happy Addons for Elementor","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"happy-elementor-addons","versions":[{"version":"0","lessThanOrEqual":"3.50.1","versionType":"custom","status":"affected","changes":[{"at":"3.51.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:39:54.369615Z","id":"CVE-2026-109891","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/happy-elementor-addons/vulnerability/wordpress-happy-addons-for-elementor-plugin-3-50-1-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-110186","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:17:55.837","lastModified":"2026-10-30T18:17:19.793","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.8:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:23.321770Z","id":"CVE-2026-110186","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.13.0","matchCriteriaId":"C3DBF545-D19A-4FFA-87D2-E137B95D4A55"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7294467","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-110190","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:17:55.967","lastModified":"2026-10-30T13:26:13.943","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request to view arbitrary files on the system."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.4:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T16:15:07.742328Z","id":"CVE-2026-110190","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.12.5","matchCriteriaId":"E87E255E-36D3-4111-86DC-F5632C97BD70"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293016","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-110192","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:17:56.127","lastModified":"2026-10-30T13:26:03.463","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.8:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Primary","description":[{"lang":"en","value":"CWE-522"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.13.0","matchCriteriaId":"C3DBF545-D19A-4FFA-87D2-E137B95D4A55"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7294467","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-110193","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:17:56.253","lastModified":"2026-10-30T13:25:44.260","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting in arbitrary operating system command execution on the server."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.8:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T00:00:00+00:00","id":"CVE-2026-110193","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.13.0","matchCriteriaId":"C3DBF545-D19A-4FFA-87D2-E137B95D4A55"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7294467","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-110196","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:17:56.380","lastModified":"2026-10-30T18:17:19.913","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-privileged authenticated account to bypass the administrator-only restriction and execute arbitrary code on the server by configuring a built-in code-execution component with attacker-supplied inputs."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.4:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:21.835450Z","id":"CVE-2026-110196","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.12.5","matchCriteriaId":"E87E255E-36D3-4111-86DC-F5632C97BD70"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293016","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-110200","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:17:56.530","lastModified":"2026-10-30T13:25:10.213","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to cleartext storage of sensitive information."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.4:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Primary","description":[{"lang":"en","value":"CWE-312"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.12.5","matchCriteriaId":"E87E255E-36D3-4111-86DC-F5632C97BD70"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293016","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-110244","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:17:56.693","lastModified":"2026-10-30T13:24:56.787","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.4:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T16:28:43.532537Z","id":"CVE-2026-110244","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.12.5","matchCriteriaId":"E87E255E-36D3-4111-86DC-F5632C97BD70"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293016","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-110245","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:17:56.860","lastModified":"2026-10-30T13:24:46.960","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain sensitive information due to improper authentication."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.4:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Primary","description":[{"lang":"en","value":"CWE-287"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.12.5","matchCriteriaId":"E87E255E-36D3-4111-86DC-F5632C97BD70"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293016","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-110309","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:17:57.033","lastModified":"2026-10-30T13:24:29.523","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper control of code generation."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.4:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T00:00:00+00:00","id":"CVE-2026-110309","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.12.5","matchCriteriaId":"E87E255E-36D3-4111-86DC-F5632C97BD70"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293016","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-111730","sourceIdentifier":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","published":"2026-10-29T16:17:57.210","lastModified":"2026-10-29T16:26:37.430","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"P-Net before 1.0.3 does not validate the LengthPeerStationName field of a CheckPeers block in get_check_peer(). The received length (up to 255) was used to copy data into the 241-byte peer station name buffer and to place the terminating NUL byte, so a crafted block writes up to 15 bytes past the end of the buffer. This can lead to a crash (denial of service) or potentially arbitrary code execution.\n\n\n\nRequires establishment of session that needs ADJACENT network access."}],"affected":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","affectedData":[{"vendor":"RT-Labs","product":"P-Net","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.0.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://rt-labs.com/wp-content/uploads/2026/10/RRTL-261019-01.pdf","source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee"}]}},{"cve":{"id":"CVE-2026-111731","sourceIdentifier":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","published":"2026-10-29T16:17:57.343","lastModified":"2026-10-29T16:26:37.430","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"P-Net before 1.0.3 enters an infinite loop when handling a read request for the PDPortDataCheck record with subslot 0 (whole module). The loop over the ports never advanced to the next port, so the request never completes and the device stops responding. A remote unauthenticated attacker can use this to cause a denial of service."}],"affected":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","affectedData":[{"vendor":"RT-Labs","product":"P-Net","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.0.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary","description":[{"lang":"en","value":"CWE-835"}]}],"references":[{"url":"https://rt-labs.com/wp-content/uploads/2026/10/RRTL-261019-01.pdf","source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee"}]}},{"cve":{"id":"CVE-2026-111732","sourceIdentifier":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","published":"2026-10-29T16:17:57.480","lastModified":"2026-10-29T16:26:37.430","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the number of bytes to copy into a fixed-size buffer, without comparing it with the buffer size or the block length. A crafted Connect request causes an out-of-bounds write. This can lead to a crash (denial of service) or potentially arbitrary code execution.\n\n\n\nThis option is disabled by default."}],"affected":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","affectedData":[{"vendor":"RT-Labs","product":"P-Net","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.0.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://rt-labs.com/wp-content/uploads/2026/10/RRTL-261019-01.pdf","source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee"}]}},{"cve":{"id":"CVE-2026-111733","sourceIdentifier":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","published":"2026-10-29T16:17:57.600","lastModified":"2026-10-29T16:26:37.430","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"P-Net before 1.0.3 dereferences a NULL AR pointer when handling an implicit read request without a valid target AR UUID for a record index that requires an AR (AR specific indices 0xE000-0xEFFF, and the expected identification data of a slot or subslot). A remote unauthenticated attacker can send such a request to crash the device (denial of service)."}],"affected":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","affectedData":[{"vendor":"RT-Labs","product":"P-Net","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.0.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary","description":[{"lang":"en","value":"CWE-476"}]}],"references":[{"url":"https://rt-labs.com/wp-content/uploads/2026/10/RRTL-261019-01.pdf","source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee"}]}},{"cve":{"id":"CVE-2026-111734","sourceIdentifier":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","published":"2026-10-29T16:17:57.717","lastModified":"2026-10-29T16:26:37.430","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"P-Net before 1.0.3 does not validate the length of a received Ethernet frame in pf_eth_recv() before reading the EtherType, any VLAN tags and the PROFINET FrameID. The VLAN tag loop had no upper bound, so a truncated frame, or a frame consisting only of VLAN tags, makes the function read past the end of the receive buffer. This can cause a crash (denial of service) or disclose memory content."}],"affected":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","affectedData":[{"vendor":"RT-Labs","product":"P-Net","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.0.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://rt-labs.com/wp-content/uploads/2026/10/RRTL-261019-01.pdf","source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee"}]}},{"cve":{"id":"CVE-2026-111735","sourceIdentifier":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","published":"2026-10-29T16:17:57.833","lastModified":"2026-10-29T16:26:37.430","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind(). When handling a received cyclic data frame while the consumer is in the FRUN or RUN state, the offset of the APDU status was computed as the frame length minus 4 using 16-bit arithmetic, without checking that the frame is long enough. A crafted short frame makes the offset wrap around, so the function reads outside the receive buffer. This can cause a crash (denial of service) or disclose memory content."}],"affected":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","affectedData":[{"vendor":"RT-Labs","product":"P-Net","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.0.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary","description":[{"lang":"en","value":"CWE-125"},{"lang":"en","value":"CWE-191"}]}],"references":[{"url":"https://rt-labs.com/wp-content/uploads/2026/10/RRTL-261019-01.pdf","source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee"}]}},{"cve":{"id":"CVE-2026-111736","sourceIdentifier":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","published":"2026-10-29T16:17:57.950","lastModified":"2026-10-29T16:26:37.430","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"P-Net before 1.0.3 dereferences a NULL AR pointer in pf_fspm_cm_read_ind() when handling an implicit read request without a valid target AR UUID for a user specific record index, if the application has registered a read callback. A remote unauthenticated attacker can send such a request to crash the device (denial of service)."}],"affected":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","affectedData":[{"vendor":"RT-Labs","product":"P-Net","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.0.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary","description":[{"lang":"en","value":"CWE-476"}]}],"references":[{"url":"https://rt-labs.com/wp-content/uploads/2026/10/RRTL-261019-01.pdf","source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee"}]}},{"cve":{"id":"CVE-2026-112200","sourceIdentifier":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","published":"2026-10-29T16:17:58.067","lastModified":"2026-10-29T16:26:37.430","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"P-Net before 1.0.3 does not release the Application Relationship (AR) and the RPC session when an RPC request is rejected because its data representation has incorrect endianness. The session and its AR remain allocated, so repeated requests exhaust the available sessions. Once they are exhausted the device no longer answers new RPC requests, including Connect, until it is restarted. A remote unauthenticated attacker can use this to cause a denial of service."}],"affected":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","affectedData":[{"vendor":"RT-Labs","product":"P-Net","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.0.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary","description":[{"lang":"en","value":"CWE-772"}]}],"references":[{"url":"https://rt-labs.com/wp-content/uploads/2026/10/RRTL-261019-01.pdf","source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee"}]}},{"cve":{"id":"CVE-2026-112255","sourceIdentifier":"security@opentext.com","published":"2026-10-29T16:17:58.190","lastModified":"2026-10-29T16:29:56.553","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation.\n\nThis issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 through 6.5.0.x, and from 6.6.0.0 through 6.6.1.0.\n\n\n\nThe fix for this is issue is to create a secure configuration.  The 6.6.2.0 release has a best practice entry if the configuration is unsecure.\n\n\n\nA secure configuration is to NOT allow creation/recreation of Unauthenticated Endpoints.  If creation/recreation of Unauthenticated Endpoints is required, you should only allow it from trusted networks.  \n\n\n\nTo remedy this issue, change your configuration to NOT allow creation/recreation of Unauthenticated Endpoints. If you require Unauthenticated Endpoints, you MUST change your configuration to use a non-empty whitelist to specify the trusted networks.  An empty whitelist will allow all networks to create/recreate endpoints."}],"affected":[{"source":"security@opentext.com","affectedData":[{"vendor":"OpenText","product":"Advanced Authentication Server","defaultStatus":"unaffected","versions":[{"version":"6.4.0.0","lessThanOrEqual":"6.4.3.x","versionType":"semver","status":"affected","changes":[{"at":"6.6.2.0","status":"unaffected"}]},{"version":"6.5.0.0","lessThanOrEqual":"6.5.0.x","versionType":"semver","status":"affected","changes":[{"at":"6.6.2.0","status":"unaffected"}]},{"version":"6.6.0.0","lessThanOrEqual":"6.6.1.0","versionType":"semver","status":"affected","changes":[{"at":"6.6.2.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@opentext.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:D/RE:L/U:Amber","baseScore":2.9,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"AUTOMATIC","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"LOW","providerUrgency":"AMBER"}}]},"weaknesses":[{"source":"security@opentext.com","type":"Primary","description":[{"lang":"en","value":"CWE-1188"}]}],"references":[{"url":"https://docs.microfocus.com/doc/2582/26.3.1/security-improvements-662","source":"security@opentext.com"},{"url":"https://docs.microfocus.com/doc/42/26.3.1/security-improvements-662","source":"security@opentext.com"},{"url":"https://docs.microfocus.com/doc/42/6.4.3.9/security-improvements-6439","source":"security@opentext.com"},{"url":"https://docs.microfocus.com/doc/42/6.5.0.11/security-improvements-65011","source":"security@opentext.com"}]}},{"cve":{"id":"CVE-2026-112256","sourceIdentifier":"security@opentext.com","published":"2026-10-29T16:17:58.390","lastModified":"2026-10-29T16:29:56.553","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.8, from 6.5.0.0 through 6.5.0.10, and from 6.6.0.0 through 6.6.1.0."}],"affected":[{"source":"security@opentext.com","affectedData":[{"vendor":"OpenText","product":"Advanced Authentication Server","defaultStatus":"unaffected","versions":[{"version":"6.4.0.0","lessThanOrEqual":"6.4.3.8","versionType":"semver","status":"affected","changes":[{"at":"6.4.3.9","status":"unaffected"}]},{"version":"6.5.0.0","lessThanOrEqual":"6.5.0.10","versionType":"semver","status":"affected","changes":[{"at":"6.5.0.11","status":"unaffected"}]},{"version":"6.6.0.0","lessThanOrEqual":"6.6.1.0","versionType":"semver","status":"affected","changes":[{"at":"6.6.2.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@opentext.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:M/U:Red","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"NOT_DEFINED","valueDensity":"CONCENTRATED","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"RED"}}]},"weaknesses":[{"source":"security@opentext.com","type":"Primary","description":[{"lang":"en","value":"CWE-349"}]}],"references":[{"url":"https://docs.microfocus.com/doc/2582/26.3.1/security-improvements-662","source":"security@opentext.com"},{"url":"https://docs.microfocus.com/doc/42/26.3.1/security-improvements-662","source":"security@opentext.com"},{"url":"https://docs.microfocus.com/doc/42/6.4.3.9/security-improvements-6439","source":"security@opentext.com"},{"url":"https://docs.microfocus.com/doc/42/6.5.0.11/security-improvements-65011","source":"security@opentext.com"}]}},{"cve":{"id":"CVE-2026-113576","sourceIdentifier":"psirt@adobe.com","published":"2026-10-29T16:17:58.550","lastModified":"2026-10-29T18:17:23.207","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Digital Editions is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."}],"affected":[{"source":"psirt@adobe.com","affectedData":[{"vendor":"Adobe","product":"Adobe Digital Editions","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.1 (4609)","versionType":"custom","status":"affected"},{"version":"1.2 (4613)","versionType":"custom","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@adobe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T16:15:16.868333Z","id":"CVE-2026-113576","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@adobe.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://www.adobe.com/solutions/ebook/digital-editions/release-notes.html","source":"psirt@adobe.com"}]}},{"cve":{"id":"CVE-2026-114148","sourceIdentifier":"secure@microsoft.com","published":"2026-10-29T16:17:58.693","lastModified":"2026-10-30T14:16:38.440","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally."}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft","product":".NET 10.0 installed on Linux","versions":[{"version":"10.0.0","lessThan":"10.0.403","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":".NET 10.0 installed on Mac OS","versions":[{"version":"10.0.0","lessThan":"10.0.403","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":".NET 10.0 installed on Windows","versions":[{"version":"10.0.0","lessThan":"10.0.403","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":".NET 11.0 installed on Linux","versions":[{"version":"11.0.0-preview.1","lessThan":"11.0.100-rc.3","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":".NET 11.0 installed on Mac OS","versions":[{"version":"11.0.0-preview.1","lessThan":"11.0.100-rc.3","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":".NET 11.0 installed on Windows","versions":[{"version":"11.0.0-preview.1","lessThan":"11.0.100-rc.3","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":".NET 8.0 installed on Linux","versions":[{"version":"8.0.0","lessThan":"8.0.427","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":".NET 8.0 installed on Mac OS","versions":[{"version":"8.0.0","lessThan":"8.0.427","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":".NET 8.0 installed on Windows","versions":[{"version":"8.0.0","lessThan":"8.0.427","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":".NET 9.0 installed on Linux","versions":[{"version":"9.0.0","lessThan":"9.0.320","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":".NET 9.0 installed on Mac OS","versions":[{"version":"9.0.0","lessThan":"9.0.320","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":".NET 9.0 installed on Windows","versions":[{"version":"9.0.0","lessThan":"9.0.320","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":".NET source-build Linux tarballs (all archive types)","versions":[{"version":"8.0.100","lessThan":"10.0.403-servicing.26523.112","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":"ASP.NET Core runtime and targeting-pack Linux tarballs (Microsoft-published)","versions":[{"version":"8.0.0","lessThan":"9.0.22","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secure@microsoft.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T13:38:21.442156Z","id":"CVE-2026-114148","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secure@microsoft.com","type":"Secondary","description":[{"lang":"en","value":"CWE-276"}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114148","source":"secure@microsoft.com"}]}},{"cve":{"id":"CVE-2026-115793","sourceIdentifier":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","published":"2026-10-29T16:17:58.870","lastModified":"2026-10-29T16:26:50.750","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"P-Net before 1.0.3 does not release the RPC session allocated for an RPC request that names an unknown interface or object UUID, and does not start a timeout for it. Repeated requests with different activity UUIDs exhaust the available sessions. Once they are exhausted the device no longer answers new RPC requests, including Endpoint Mapper Lookup and Connect, until it is restarted. A remote unauthenticated attacker can use this to cause a denial of service."}],"affected":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","affectedData":[{"vendor":"RT-Labs","product":"P-Net","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.0.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary","description":[{"lang":"en","value":"CWE-772"}]}],"references":[{"url":"https://rt-labs.com/wp-content/uploads/2026/10/RRTL-261019-01.pdf","source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee"}]}},{"cve":{"id":"CVE-2026-115794","sourceIdentifier":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","published":"2026-10-29T16:17:58.987","lastModified":"2026-10-29T16:26:50.750","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"P-Net before 1.0.3 passes the application alarm callback a data length derived from the variable part length field of a received RTA alarm frame without checking it against the length of the received frame. A short frame can make the callback receive a length of up to 65507 bytes. An application that copies the reported number of bytes reads past the end of the receive buffer. The attacker must have established an Application Relationship and requires ADJACENT network access. Applications that do not use the alarm data are not affected."}],"affected":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","affectedData":[{"vendor":"RT-Labs","product":"P-Net","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.0.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary","description":[{"lang":"en","value":"CWE-130"}]}],"references":[{"url":"https://rt-labs.com/wp-content/uploads/2026/10/RRTL-261019-01.pdf","source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee"}]}},{"cve":{"id":"CVE-2026-115795","sourceIdentifier":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","published":"2026-10-29T16:17:59.113","lastModified":"2026-10-29T16:26:50.750","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"P-Net before 1.0.3 does not check that a complete block header is present in the received data before reading the next block in DCP Set and Identify requests. If the last block ends at the end of the receive buffer, the block length of the following block is read past the end of the buffer. In addition, a DCP Set block with a length smaller than the two-byte block qualifier makes the length underflow, so the block is processed with a length of 65534 bytes. This can cause a crash (denial of service) or disclose a small amount of memory content. Requires ADJACENT network access."}],"affected":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","affectedData":[{"vendor":"RT-Labs","product":"P-Net","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.0.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://rt-labs.com/wp-content/uploads/2026/10/RRTL-261019-01.pdf","source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee"}]}},{"cve":{"id":"CVE-2026-116848","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:00.970","lastModified":"2026-10-30T19:18:14.763","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Innovations The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Stored XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through 6.5.3."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"POSIMYTH Innovations","product":"The Plus Addons for Elementor Page Builder Lite","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"the-plus-addons-for-elementor-page-builder","versions":[{"version":"0","lessThanOrEqual":"6.5.3","versionType":"custom","status":"affected","changes":[{"at":"6.6.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:32:27.224861Z","id":"CVE-2026-116848","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/the-plus-addons-for-elementor-page-builder/vulnerability/wordpress-the-plus-addons-for-elementor-page-builder-lite-plugin-6-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-116864","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:01.090","lastModified":"2026-10-30T19:18:15.717","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Arni Cinco","product":"WPCargo Track & Trace","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wpcargo","versions":[{"version":"n/a","lessThanOrEqual":"8.0.5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:36:57.484057Z","id":"CVE-2026-116864","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wpcargo/vulnerability/wordpress-wpcargo-track-trace-plugin-8-0-5-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-116865","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:01.213","lastModified":"2026-10-30T19:18:15.827","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Editor PHP Object Injection in Zippy <= 1.7.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Gesundheit Bewegt GmbH","product":"Zippy","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"zippy","versions":[{"version":"n/a","lessThanOrEqual":"1.7.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:36:27.937490Z","id":"CVE-2026-116865","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/zippy/vulnerability/wordpress-zippy-plugin-1-7-0-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-116866","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:01.350","lastModified":"2026-10-30T19:18:15.937","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Dotstore","product":"Extra Fees Plugin for WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"woo-conditional-product-fees-for-checkout","versions":[{"version":"n/a","lessThanOrEqual":"4.4.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:36:17.838768Z","id":"CVE-2026-116866","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/woo-conditional-product-fees-for-checkout/vulnerability/wordpress-extra-fees-plugin-for-woocommerce-plugin-4-4-0-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-116867","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:01.507","lastModified":"2026-10-29T18:17:24.820","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor PHP Object Injection in Dynamic QR Code &#8211; generator <= 1.0.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"sosidee","product":"Dynamic QR Code &#8211; generator","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"dynamic-qr-code","versions":[{"version":"n/a","lessThanOrEqual":"1.0.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T16:28:57.524219Z","id":"CVE-2026-116867","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/dynamic-qr-code/vulnerability/wordpress-dynamic-qr-code-generator-plugin-1-0-1-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-116868","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:01.667","lastModified":"2026-10-29T20:17:29.027","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"BuddyDev","product":"BuddyPress Xprofile Custom Field Types","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"bp-xprofile-custom-field-types","versions":[{"version":"n/a","lessThanOrEqual":"1.3.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T19:45:23.152988Z","id":"CVE-2026-116868","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/bp-xprofile-custom-field-types/vulnerability/wordpress-buddypress-xprofile-custom-field-types-plugin-1-3-1-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-116869","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:01.800","lastModified":"2026-10-30T19:18:16.053","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"myPOS Payments","product":"myPOS Checkout","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"mypos-virtual-for-woocommerce","versions":[{"version":"n/a","lessThanOrEqual":"1.4.5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:36:35.605708Z","id":"CVE-2026-116869","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/mypos-virtual-for-woocommerce/vulnerability/wordpress-mypos-checkout-plugin-1-4-5-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-118073","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:01.937","lastModified":"2026-10-30T19:18:16.153","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"blazethemes","product":"News Kit Elementor Addons","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"news-kit-elementor-addons","versions":[{"version":"n/a","lessThanOrEqual":"1.5.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:33:55.637528Z","id":"CVE-2026-118073","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/news-kit-elementor-addons/vulnerability/wordpress-news-kit-elementor-addons-plugin-1-5-0-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-118074","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:02.053","lastModified":"2026-10-30T19:18:16.267","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Daman Jeet","product":"Finale Lite","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"finale-woocommerce-sales-countdown-timer-discount","versions":[{"version":"n/a","lessThanOrEqual":"2.21.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:36:08.628494Z","id":"CVE-2026-118074","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/finale-woocommerce-sales-countdown-timer-discount/vulnerability/wordpress-finale-lite-plugin-2-21-0-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-118075","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:02.177","lastModified":"2026-10-29T18:17:25.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"dbarrere","product":"WP Media folders","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-media-folders","versions":[{"version":"n/a","lessThanOrEqual":"1.1.10","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T16:28:59.503571Z","id":"CVE-2026-118075","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-media-folders/vulnerability/wordpress-wp-media-folders-plugin-1-1-10-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-118076","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:02.297","lastModified":"2026-10-29T20:17:29.163","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Frisbii","product":"Frisbii Pay","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"reepay-checkout-gateway","versions":[{"version":"n/a","lessThanOrEqual":"1.8.19","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T19:44:37.736348Z","id":"CVE-2026-118076","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/reepay-checkout-gateway/vulnerability/wordpress-frisbii-pay-plugin-1-8-19-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-118077","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:02.423","lastModified":"2026-10-30T19:18:16.367","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Fast Themes","product":"Sastra Essential Addons for Elementor","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"sastra-essential-addons-for-elementor","versions":[{"version":"n/a","lessThanOrEqual":"1.2.3","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:35:36.366787Z","id":"CVE-2026-118077","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/sastra-essential-addons-for-elementor/vulnerability/wordpress-sastra-essential-addons-for-elementor-plugin-1-2-3-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-118078","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:02.550","lastModified":"2026-10-30T19:18:16.493","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"PixelYourSite","product":"Product Catalog Feed by PixelYourSite","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"product-catalog-feed","versions":[{"version":"n/a","lessThanOrEqual":"3.1.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:35:27.423030Z","id":"CVE-2026-118078","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/product-catalog-feed/vulnerability/wordpress-product-catalog-feed-by-pixelyoursite-plugin-3-1-4-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-118079","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:02.673","lastModified":"2026-10-30T19:18:16.663","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Shop manager PHP Object Injection in FV Flowplayer Video Player <= 8.3.4 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"FolioVision","product":"FV Flowplayer Video Player","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"fv-wordpress-flowplayer","versions":[{"version":"n/a","lessThanOrEqual":"8.3.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:35:19.750734Z","id":"CVE-2026-118079","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/fv-wordpress-flowplayer/vulnerability/wordpress-fv-flowplayer-video-player-plugin-8-3-4-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-118080","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:02.790","lastModified":"2026-10-29T18:17:25.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor PHP Object Injection in Social Snap <= 1.5.4 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Social Snap","product":"Social Snap","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"socialsnap","versions":[{"version":"n/a","lessThanOrEqual":"1.5.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T16:29:02.886801Z","id":"CVE-2026-118080","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/socialsnap/vulnerability/wordpress-social-snap-plugin-1-5-4-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-118081","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:02.917","lastModified":"2026-10-29T20:17:29.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"10Web","product":"10Web Social Photo Feed","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wd-instagram-feed","versions":[{"version":"n/a","lessThanOrEqual":"1.5.6","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T19:43:38.977573Z","id":"CVE-2026-118081","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wd-instagram-feed/vulnerability/wordpress-10web-social-photo-feed-plugin-1-5-6-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-118082","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:03.193","lastModified":"2026-10-30T19:18:16.797","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"BuddyBoss","product":"Buddyboss Platform","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"3.5.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:33:50.510803Z","id":"CVE-2026-118082","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/buddyboss-platform/vulnerability/wordpress-buddyboss-platform-plugin-3-5-0-privilege-escalation-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-118083","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:03.323","lastModified":"2026-10-30T19:18:16.913","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Themeum","product":"WP Crowdfunding","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-crowdfunding","versions":[{"version":"n/a","lessThanOrEqual":"2.2.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:35:12.796477Z","id":"CVE-2026-118083","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-201"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-crowdfunding/vulnerability/wordpress-wp-crowdfunding-plugin-2-2-2-sensitive-data-exposure-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-118084","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:03.450","lastModified":"2026-10-30T19:18:17.033","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"nicdark","product":"Hotel Booking","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"nd-booking","versions":[{"version":"n/a","lessThanOrEqual":"3.8","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:33:48.360356Z","id":"CVE-2026-118084","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/nd-booking/vulnerability/wordpress-hotel-booking-plugin-3-8-insecure-direct-object-references-idor-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-118085","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:03.577","lastModified":"2026-10-30T19:18:17.143","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce <= 1.23.3 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Global Payments","product":"GlobalPayments WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"global-payments-woocommerce","versions":[{"version":"n/a","lessThanOrEqual":"1.23.3","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:39:20.694756Z","id":"CVE-2026-118085","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/global-payments-woocommerce/vulnerability/wordpress-globalpayments-woocommerce-plugin-1-23-3-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-118673","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T16:18:03.873","lastModified":"2026-10-29T16:29:56.553","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. From 2.3.0 until 2.8.0, KeePassXC browser integration encrypts authorized responses in src/browser/BrowserMessageBuilder.cpp using a fixed 1 MiB output vector even though Botan::Sodium::crypto_box_easy() writes the plaintext length plus crypto_box_MACBYTES. A browser-protocol client that can access the per-user IPC endpoint, has a valid database association, and causes an unlocked database to generate and encrypt a sufficiently large authorized response can trigger a sequential out-of-bounds write before any response is delivered. This issue is fixed in version 2.8.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"keepassxreboot","product":"keepassxc","versions":[{"version":">= 2.3.0, < 2.8.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/keepassxreboot/keepassxc/commit/80e68bb4e8b89e383dd96b1bf5de169ca61367aa","source":"security-advisories@github.com"},{"url":"https://github.com/keepassxreboot/keepassxc/pull/13679","source":"security-advisories@github.com"},{"url":"https://github.com/keepassxreboot/keepassxc/releases/tag/2.8.0","source":"security-advisories@github.com"},{"url":"https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-3448-gh8j-3227","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119118","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T16:18:04.027","lastModified":"2026-10-29T21:17:17.480","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers to intercept crawls because Chromium always launches with --ignore-certificate-errors. Man-in-the-middle or DNS-controlling attackers can serve forged content to the crawler and read cookies and headers sent, while hard-coded --no-sandbox also overrides CRAWL4AI_CHROMIUM_SANDBOX."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"unclecode","product":"crawl4ai","defaultStatus":"unaffected","packageURL":"pkg:pypi/crawl4ai","versions":[{"version":"0","lessThan":"0.9.5","versionType":"semver","status":"affected"},{"version":"0.9.5","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T20:11:57.775312Z","id":"CVE-2026-119118","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-295"}]}],"references":[{"url":"https://github.com/unclecode/crawl4ai/security/advisories/GHSA-j2qh-f73r-mg3q","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/crawl4ai-before-0.9.5-improper-certificate-validation-via-hard-coded-chromium-flags","source":"disclosure@vulncheck.com"},{"url":"https://github.com/unclecode/crawl4ai/security/advisories/GHSA-j2qh-f73r-mg3q","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-119119","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T16:18:04.207","lastModified":"2026-10-29T16:18:04.327","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails to cap the delay_before_return_html, mean_delay, and max_range fields of untrusted CrawlerRunConfig bodies. Unauthenticated attackers can send huge values to /crawl or /crawl/stream to hold browser pages or stall the rate limiter, exhausting the page pool and blocking other crawls."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"unclecode","product":"crawl4ai","defaultStatus":"unaffected","packageURL":"pkg:pypi/crawl4ai","versions":[{"version":"0","lessThan":"0.9.5","versionType":"semver","status":"affected"},{"version":"0.9.5","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://github.com/unclecode/crawl4ai/security/advisories/GHSA-rhjm-7hj7-75fx","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/crawl4ai-before-0.9.5-denial-of-service-via-unbounded-crawlerrunconfig-delay-fields","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119120","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T16:18:04.370","lastModified":"2026-10-29T16:18:04.477","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malicious repository with a pickle weight file to execute Python code under PyTorch below 2.6, or exhaust disk and memory."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"unclecode","product":"crawl4ai","defaultStatus":"unaffected","packageURL":"pkg:pypi/crawl4ai","versions":[{"version":"0.9.0","lessThan":"0.9.5","versionType":"semver","status":"affected"},{"version":"0.9.5","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://github.com/unclecode/crawl4ai/security/advisories/GHSA-f856-7xp9-w3cc","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/crawl4ai-0.9.0-before-0.9.5-untrusted-model-loading-via-cosinestrategy-model-name","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119121","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T16:18:04.530","lastModified":"2026-10-29T18:17:30.010","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted css_selector and wait_for fields. Attackers can inject quotes into css_selector or supply js: conditions in wait_for, bypassing the js_code block to alter page state and returned crawl content."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"unclecode","product":"crawl4ai","defaultStatus":"unaffected","packageURL":"pkg:pypi/crawl4ai","versions":[{"version":"0.9.0","lessThan":"0.9.5","versionType":"semver","status":"affected"},{"version":"0.9.5","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T16:16:09.064813Z","id":"CVE-2026-119121","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-95"}]}],"references":[{"url":"https://github.com/unclecode/crawl4ai/security/advisories/GHSA-qj46-wp7m-rgj8","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/crawl4ai-0.9.0-before-0.9.5-javascript-injection-via-css-selector-and-wait-for","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119122","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T16:18:04.683","lastModified":"2026-10-29T21:17:17.590","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API clients to bypass the egress proxy by enabling check_cache_freshness. Attackers can cache a controlled URL, then trigger CacheValidator to follow 302 redirects or DNS rebinding to internal and cloud-metadata addresses for port and service discovery."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"unclecode","product":"crawl4ai","defaultStatus":"unaffected","packageURL":"pkg:pypi/crawl4ai","versions":[{"version":"0","lessThan":"0.9.5","versionType":"semver","status":"affected"},{"version":"0.9.5","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T20:15:52.358200Z","id":"CVE-2026-119122","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/unclecode/crawl4ai/security/advisories/GHSA-w4xc-px5p-c32w","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/crawl4ai-before-0.9.5-blind-ssrf-via-cachevalidator-freshness-check","source":"disclosure@vulncheck.com"},{"url":"https://github.com/unclecode/crawl4ai/security/advisories/GHSA-w4xc-px5p-c32w","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-119123","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T16:18:04.847","lastModified":"2026-10-29T16:18:04.963","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the DNG decoder is disabled. Attackers can supply a crafted image file for processing to trigger the stack overflow and crash the application, causing denial of service."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"ImageMagick","product":"ImageMagick","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"7.1.2-34","versionType":"semver","status":"affected"},{"version":"7.1.2-34","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":1.4}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-674"}]}],"references":[{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g5j8-ff59-wp88","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-34-stack-overflow-in-tiff-decoder","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119124","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T16:18:05.010","lastModified":"2026-10-29T16:18:05.127","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can supply a crafted image that, when processed by a user with the -morph option, corrupts heap memory and crashes the application."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"ImageMagick","product":"ImageMagick","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"7.1.2-34","versionType":"semver","status":"affected"},{"version":"7.1.2-34","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":1.4}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-122"}]}],"references":[{"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x48p-6655-8qgv","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-34-heap-buffer-overflow-via-morph-option","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119125","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T16:18:05.170","lastModified":"2026-10-29T18:17:30.163","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 returns the stored value of a field reverted by a beforeSave trigger in object update responses, even to clients without read access to that object or field. An authenticated client able to update an object whose beforeSave trigger reverts a field, via revert() or a constant: true validator, can read protected values, including its own account's raw MFA authData when protectedFieldsTriggerExempt is enabled."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"parse-community","product":"parse-server","defaultStatus":"unaffected","packageURL":"pkg:npm/parse-server","versions":[{"version":"9.0.0","lessThan":"9.10.5-alpha.8","versionType":"semver","status":"affected"},{"version":"9.10.5-alpha.8","versionType":"semver","status":"unaffected"}]},{"vendor":"parse-community","product":"parse-server","defaultStatus":"unaffected","packageURL":"pkg:npm/parse-server","versions":[{"version":"0","lessThan":"8.6.107","versionType":"semver","status":"affected"},{"version":"8.6.107","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T16:16:11.116265Z","id":"CVE-2026-119125","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-9rvr-f5hc-9f2f","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/parse-server-before-8.6.107-and-9.0.0-before-9.10.5-alpha.8-information-disclosure-via-beforesave-reverted-fields","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119126","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T16:18:05.330","lastModified":"2026-10-29T21:17:17.703","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values when building the saved object, so a write is stored but returns an error and skips afterSave triggers and LiveQuery events. A client with write access can exploit this to evade audit logging, notifications, and derived data updates."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"parse-community","product":"parse-server","defaultStatus":"unaffected","packageURL":"pkg:npm/parse-server","versions":[{"version":"9.0.0","lessThan":"9.10.5-alpha.7","versionType":"semver","status":"affected"},{"version":"9.10.5-alpha.7","versionType":"semver","status":"unaffected"}]},{"vendor":"parse-community","product":"parse-server","defaultStatus":"unaffected","packageURL":"pkg:npm/parse-server","versions":[{"version":"0","lessThan":"8.6.106","versionType":"semver","status":"affected"},{"version":"8.6.106","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T20:15:13.864924Z","id":"CVE-2026-119126","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-754"}]}],"references":[{"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-969q-274f-mc7w","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/parse-server-before-8.6.106-and-9.0.0-before-9.10.5-alpha.7-aftersave-trigger-and-livequery-bypass-via-dot-notation-keys","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119127","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T16:18:05.487","lastModified":"2026-10-29T16:18:05.603","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poison password-reset, invite, and email-verification links by supplying untrusted x-zitadel-public-host, x-zitadel-forward-host, or x-forwarded-host headers. Attackers knowing a victim's login name can point the links in genuine emails at their host, harvest the single-use codes when the links are opened, and take over accounts including instance administrators."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"zitadel","product":"zitadel","defaultStatus":"unaffected","versions":[{"version":"4.0.0","lessThan":"4.19.5","versionType":"semver","status":"affected"},{"version":"4.19.5","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-640"}]}],"references":[{"url":"https://github.com/zitadel/zitadel/security/advisories/GHSA-mchc-246r-6m76","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/zitadel-4.0.0-before-4.19.5-account-takeover-via-login-v2-host-header-injection","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119128","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T16:18:05.643","lastModified":"2026-10-29T16:18:05.760","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser fingerprint to set a password, register a passkey, or link an identity provider, taking over the account."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"zitadel","product":"zitadel","defaultStatus":"unaffected","versions":[{"version":"4.0.0","lessThan":"4.19.5","versionType":"semver","status":"affected"},{"version":"4.19.5","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-565"}]}],"references":[{"url":"https://github.com/zitadel/zitadel/security/advisories/GHSA-84fg-x5h4-w8xv","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/zitadel-4.0.0-before-4.19.5-login-v2-account-takeover-via-forgeable-verificationcheck-cookie","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119129","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T16:18:05.800","lastModified":"2026-10-29T18:17:30.320","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that allows attackers to approve OAuth 2.0 device authorizations using a victim's existing session without consent. Attackers can send a signed-in user a link carrying the attacker's user code to obtain the victim's tokens, and can bypass project access settings via the OIDC device authorization API."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"zitadel","product":"zitadel","defaultStatus":"unaffected","versions":[{"version":"4.0.0","lessThan":"4.19.5","versionType":"semver","status":"affected"},{"version":"4.19.5","versionType":"semver","status":"unaffected"}]},{"vendor":"zitadel","product":"zitadel","defaultStatus":"unaffected","versions":[{"version":"3.0.0","lessThanOrEqual":"3.4.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T17:12:08.195339Z","id":"CVE-2026-119129","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/zitadel/zitadel/security/advisories/GHSA-qj3q-235g-qr6w","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/zitadel-3.0.0-through-3.4.15-and-4.0.0-before-4.19.5-account-takeover-via-device-authorization-approval","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119130","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T16:18:05.947","lastModified":"2026-10-29T21:17:17.830","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written verbatim as the HTTP/1.1 request target while the connection uses the allowed authority. A malicious guest can supply an absolute URL that a forward proxy or gateway at that authority honors, reaching hosts disallowed by embedder filtering policies."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"bytecodealliance","product":"wasmtime","defaultStatus":"unaffected","packageURL":"pkg:cargo/wasmtime-wasi-http","versions":[{"version":"0","lessThan":"36.0.18","versionType":"semver","status":"affected"},{"version":"36.0.18","versionType":"semver","status":"unaffected"},{"version":"37.0.0","lessThan":"48.0.6","versionType":"semver","status":"affected"},{"version":"48.0.6","versionType":"semver","status":"unaffected"},{"version":"49.0.0","lessThan":"49.0.3","versionType":"semver","status":"affected"},{"version":"49.0.3","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N","baseScore":2.6,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T20:14:38.866656Z","id":"CVE-2026-119130","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5qpp-g3j2-8frx","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/wasmtime-before-36.0.18-37.0.0-before-48.0.6-and-49.0.0-before-49.0.3-http-request-target-smuggling","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119131","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T16:18:06.100","lastModified":"2026-10-29T16:18:06.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability in wasmtime-wasi-http that lets guests crash the host by sending long request URLs. Guests can use set-path-with-query with a '?' after byte 65535, overflowing a u16 index in the http crate and triggering a host panic."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"bytecodealliance","product":"wasmtime","defaultStatus":"unaffected","packageURL":"pkg:cargo/wasmtime-wasi-http","versions":[{"version":"46.0.0","lessThan":"48.0.6","versionType":"semver","status":"affected"},{"version":"48.0.6","versionType":"semver","status":"unaffected"},{"version":"49.0.0","lessThan":"49.0.3","versionType":"semver","status":"affected"},{"version":"49.0.3","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-190"}]}],"references":[{"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-w36r-2hch-9xp9","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-host-panic-via-wasi-http","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119132","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T16:18:06.260","lastModified":"2026-10-29T16:18:06.380","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability that allows a WebAssembly guest to trigger a host panic by transcoding overlapping strings in fused adapters. Attackers can make a same-instance component-to-component call transferring a string whose source and destination alias each other, crashing the host instead of raising a trap."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"bytecodealliance","product":"wasmtime","defaultStatus":"unaffected","packageURL":"pkg:cargo/wasmtime","versions":[{"version":"49.0.0","lessThan":"49.0.3","versionType":"semver","status":"affected"},{"version":"49.0.3","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":3.6}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-617"}]}],"references":[{"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-54p9-vhhq-8f7q","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/wasmtime-49.0.0-before-49.0.3-host-panic-via-overlapping-string-transcode-in-fused-adapter","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119133","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T16:18:06.423","lastModified":"2026-10-29T18:17:30.473","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a memory misalignment flaw in VMContext layout that causes undefined behavior when modules contain an odd number of exception tags. A WebAssembly module with an odd tag count misaligns subsequent host fields in embedders with exceptions enabled, although no exploitation path is currently known."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"bytecodealliance","product":"wasmtime","defaultStatus":"unaffected","packageURL":"pkg:cargo/wasmtime","versions":[{"version":"47.0.0","lessThan":"48.0.6","versionType":"semver","status":"affected"},{"version":"48.0.6","versionType":"semver","status":"unaffected"},{"version":"49.0.0","lessThan":"49.0.3","versionType":"semver","status":"affected"},{"version":"49.0.3","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N","baseScore":2.6,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T16:16:13.082223Z","id":"CVE-2026-119133","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-758"}]}],"references":[{"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p79w-pv2r-29qp","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/wasmtime-47.0.0-before-48.0.6-and-49.0.0-before-49.0.3-misaligned-vmcontext-via-exception-tags","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119134","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T16:18:06.577","lastModified":"2026-10-29T21:17:17.937","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate sub-components to exceed the per-instance cap many times over, causing unbounded host memory growth."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"bytecodealliance","product":"wasmtime","defaultStatus":"unaffected","packageURL":"pkg:cargo/wasmtime","versions":[{"version":"0","lessThan":"36.0.18","versionType":"semver","status":"affected"},{"version":"36.0.18","versionType":"semver","status":"unaffected"},{"version":"37.0.0","lessThan":"48.0.6","versionType":"semver","status":"affected"},{"version":"48.0.6","versionType":"semver","status":"unaffected"},{"version":"49.0.0","lessThan":"49.0.3","versionType":"semver","status":"affected"},{"version":"49.0.3","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T20:14:05.502819Z","id":"CVE-2026-119134","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/wasmtime-before-36.0.18-37.0.0-before-48.0.6-and-49.0.0-before-49.0.3-unbounded-memory-growth-via-component-model-resource-handles","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119135","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T16:18:06.757","lastModified":"2026-10-29T16:18:06.870","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the host reads a component model stream as a different Rust item type than it was created with, because the host-to-host read path asserts matching TypeIds instead of returning an error. Guest code can return a host-created StreamReader<U> that the embedder reads as StreamReader<T>, where both types map to the same component model type, crashing the embedding process."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"bytecodealliance","product":"wasmtime","defaultStatus":"unaffected","packageURL":"pkg:cargo/wasmtime","versions":[{"version":"46.0.0","lessThan":"48.0.6","versionType":"semver","status":"affected"},{"version":"48.0.6","versionType":"semver","status":"unaffected"},{"version":"49.0.0","lessThan":"49.0.3","versionType":"semver","status":"affected"},{"version":"49.0.3","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":3.6}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-617"}]}],"references":[{"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-63h4-6cx9-pjfj","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-panic-via-streamreader-type-mismatch","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119136","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T16:18:06.913","lastModified":"2026-10-29T16:18:07.033","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders re-entering WebAssembly via sync APIs from host functions called asynchronously can trigger runtime panics or unsound cross-thread movement of !Send host variables."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"bytecodealliance","product":"wasmtime","defaultStatus":"unaffected","packageURL":"pkg:cargo/wasmtime","versions":[{"version":"42.0.0","lessThan":"48.0.6","versionType":"semver","status":"affected"},{"version":"48.0.6","versionType":"semver","status":"unaffected"},{"version":"49.0.0","lessThan":"49.0.3","versionType":"semver","status":"affected"},{"version":"49.0.3","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":3.6}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-1265"}]}],"references":[{"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/wasmtime-42.0.0-before-48.0.6-and-49.0.0-before-49.0.3-async-entrypoint-enforcement-bypass","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119137","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T16:18:07.073","lastModified":"2026-10-29T17:18:07.820","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow vulnerability that allows guests to crash the host through recursive type drops. Guests can define a long chain of recursive types so that removing the top-level type triggers unbounded recursive drops, exhausting the host stack."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"bytecodealliance","product":"wasmtime","defaultStatus":"unaffected","packageURL":"pkg:cargo/wasmtime","versions":[{"version":"42.0.0","lessThan":"48.0.6","versionType":"semver","status":"affected"},{"version":"48.0.6","versionType":"semver","status":"unaffected"},{"version":"49.0.0","lessThan":"49.0.3","versionType":"semver","status":"affected"},{"version":"49.0.3","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T17:10:32.052007Z","id":"CVE-2026-119137","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-674"}]}],"references":[{"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/wasmtime-42.0.0-before-48.0.6-and-49.0.0-before-49.0.3-stack-overflow-via-type-registry","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119138","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T16:18:07.223","lastModified":"2026-10-29T21:17:18.057","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows pending calls to trigger an assertion failure after a trap poisons the Store. Attackers supplying misbehaving guest code can cause a trap and let earlier calls proceed, crashing embedders that continue using the inconsistent Store."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"bytecodealliance","product":"wasmtime","defaultStatus":"unaffected","packageURL":"pkg:cargo/wasmtime","versions":[{"version":"46.0.0","lessThan":"48.0.6","versionType":"semver","status":"affected"},{"version":"48.0.6","versionType":"semver","status":"unaffected"},{"version":"49.0.0","lessThan":"49.0.3","versionType":"semver","status":"affected"},{"version":"49.0.3","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T20:13:26.495539Z","id":"CVE-2026-119138","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-617"}]}],"references":[{"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-panic-after-trap","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119139","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T16:18:07.373","lastModified":"2026-10-29T16:18:07.480","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. An attacker who supplies a component with an async-lifted export can crash the host process when an embedder invokes that export through Func::call."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"bytecodealliance","product":"wasmtime","defaultStatus":"unaffected","packageURL":"pkg:cargo/wasmtime","versions":[{"version":"46.0.0","lessThan":"48.0.6","versionType":"semver","status":"affected"},{"version":"48.0.6","versionType":"semver","status":"unaffected"},{"version":"49.0.0","lessThan":"49.0.3","versionType":"semver","status":"affected"},{"version":"49.0.3","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":3.6}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-617"}]}],"references":[{"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m6w2-jwq2-cv2c","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-host-panic-via-func-call","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119140","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T16:18:07.520","lastModified":"2026-10-29T16:18:07.630","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious components to panic the host via thread.yield in start functions. Attackers can supply a component whose start function calls an async-lowered import then thread.yield, causing an undisposed fiber drop that crashes embedders."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"bytecodealliance","product":"wasmtime","defaultStatus":"unaffected","packageURL":"pkg:cargo/wasmtime","versions":[{"version":"46.0.0","lessThan":"48.0.6","versionType":"semver","status":"affected"},{"version":"48.0.6","versionType":"semver","status":"unaffected"},{"version":"49.0.0","lessThan":"49.0.3","versionType":"semver","status":"affected"},{"version":"49.0.3","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":3.6}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-372"}]}],"references":[{"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5hhx-4wrr-3j9g","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-host-panic-via-thread-yield","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119141","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T16:18:07.670","lastModified":"2026-10-29T17:18:07.937","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious Wasm modules to panic the host because the may_leave flag is not cleared during realloc. Attackers can call into the host from realloc while lowering stream or future results, such as cancelling the active read or re-waiting a waitable-set, crashing the host."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"bytecodealliance","product":"wasmtime","defaultStatus":"unaffected","packageURL":"pkg:cargo/wasmtime","versions":[{"version":"46.0.0","lessThan":"48.0.6","versionType":"semver","status":"affected"},{"version":"48.0.6","versionType":"semver","status":"unaffected"},{"version":"49.0.0","lessThan":"49.0.3","versionType":"semver","status":"affected"},{"version":"49.0.3","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T17:10:34.489927Z","id":"CVE-2026-119141","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1265"}]}],"references":[{"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-host-panic-via-realloc","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119142","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T16:18:07.817","lastModified":"2026-10-29T21:17:18.197","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability where dropping the Future returned by TypedFunc::call_async can panic the host. When the guest task has not started, cleanup code searches only one location for work items and unwraps the resulting error, crashing embedders that cancel pending calls."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"bytecodealliance","product":"wasmtime","defaultStatus":"unaffected","packageURL":"pkg:cargo/wasmtime","versions":[{"version":"46.0.0","lessThan":"48.0.6","versionType":"semver","status":"affected"},{"version":"48.0.6","versionType":"semver","status":"unaffected"},{"version":"49.0.0","lessThan":"49.0.3","versionType":"semver","status":"affected"},{"version":"49.0.3","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T20:12:45.960221Z","id":"CVE-2026-119142","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-617"}]}],"references":[{"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3r89-v5mq-j5xf","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-host-panic-via-call-async-drop","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119143","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T16:18:07.967","lastModified":"2026-10-29T16:18:08.073","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows guest code to trigger a host panic through out-of-bounds zero-length stream operations. Malicious guests can perform zero-length component model stream reads or writes with unvalidated addresses, causing Direct{Source,Destination}::remaining to panic and crash WASIp3 embedders."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"bytecodealliance","product":"wasmtime","defaultStatus":"unaffected","packageURL":"pkg:cargo/wasmtime","versions":[{"version":"46.0.0","lessThan":"48.0.6","versionType":"semver","status":"affected"},{"version":"48.0.6","versionType":"semver","status":"unaffected"},{"version":"49.0.0","lessThan":"49.0.3","versionType":"semver","status":"affected"},{"version":"49.0.3","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":3.6}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-129"}]}],"references":[{"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-93g3-36p8-x2gc","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-panic-via-zero-length-stream-writes","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119144","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T16:18:08.117","lastModified":"2026-10-29T16:18:08.230","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled message fields are rendered as templates without neutralization. An authenticated attacker holding a common operational role can inject template expressions that the server evaluates in an unrestricted context."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"frappe","product":"frappe","defaultStatus":"unaffected","packageURL":"pkg:pypi/frappe","versions":[{"version":"16.0.0","lessThan":"16.21.0","versionType":"semver","status":"affected"},{"version":"16.21.0","versionType":"semver","status":"unaffected"}]},{"vendor":"frappe","product":"frappe","defaultStatus":"unaffected","packageURL":"pkg:pypi/frappe","versions":[{"version":"0","lessThan":"15.111.0","versionType":"semver","status":"affected"},{"version":"15.111.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-1336"}]}],"references":[{"url":"https://github.com/frappe/frappe/security/advisories/GHSA-6pmg-vc6m-6wrr","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/frappe-framework-before-15.111.0-and-16-x-before-16.21.0-server-side-template-injection-via-message-fields","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-119145","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T16:18:08.277","lastModified":"2026-10-29T17:18:08.053","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"frappe","product":"frappe","defaultStatus":"unaffected","packageURL":"pkg:pypi/frappe","versions":[{"version":"16.0.0","lessThan":"16.34.0","versionType":"semver","status":"affected"},{"version":"16.34.0","versionType":"semver","status":"unaffected"}]},{"vendor":"frappe","product":"frappe","defaultStatus":"unaffected","packageURL":"pkg:pypi/frappe","versions":[{"version":"0","lessThan":"15.121.0","versionType":"semver","status":"affected"},{"version":"15.121.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T16:29:06.486688Z","id":"CVE-2026-119145","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/frappe/frappe/security/advisories/GHSA-9pp9-wgp9-3p3j","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/frappe-before-15.121.0-and-16-x-before-16.34.0-path-traversal-rce-via-file-upload","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-18894","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:18:08.427","lastModified":"2026-10-30T13:23:56.927","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public execution paths are restricted to server-trusted component code."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.4:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T19:37:51.226823Z","id":"CVE-2026-18894","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.12.5","matchCriteriaId":"E87E255E-36D3-4111-86DC-F5632C97BD70"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293016","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20942","sourceIdentifier":"secure@microsoft.com","published":"2026-10-29T16:18:08.593","lastModified":"2026-10-30T14:17:05.497","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network."}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft","product":"Microsoft Edge (Chromium-based)","versions":[{"version":"1.0.0.0","lessThan":"156.0.4314.42","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secure@microsoft.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T13:38:48.039402Z","id":"CVE-2026-20942","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secure@microsoft.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1021"}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20942","source":"secure@microsoft.com"}]}},{"cve":{"id":"CVE-2026-27394","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:08.887","lastModified":"2026-10-30T19:18:23.763","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Jyothis Joy","product":"Eventer","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"eventer","versions":[{"version":"n/a","lessThanOrEqual":"0.1.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:39:14.491400Z","id":"CVE-2026-27394","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/eventer/vulnerability/wordpress-eventer-plugin-0-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-42690","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:09.013","lastModified":"2026-10-29T18:17:31.670","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Broken Access Control in LearnPress <= 4.4.10 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThimPress","product":"LearnPress","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"learnpress","versions":[{"version":"n/a","lessThanOrEqual":"4.4.10","versionType":"custom","status":"affected","changes":[{"at":"4.4.11","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T16:15:53.953176Z","id":"CVE-2026-42690","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/learnpress/vulnerability/wordpress-learnpress-plugin-4-4-10-broken-access-control-vulnerability-2?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-42692","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:09.130","lastModified":"2026-10-29T20:17:31.350","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Themeum","product":"WP Crowdfunding","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-crowdfunding","versions":[{"version":"n/a","lessThanOrEqual":"2.2.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T19:39:28.308403Z","id":"CVE-2026-42692","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-crowdfunding/vulnerability/wordpress-wp-crowdfunding-plugin-2-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-42694","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:09.250","lastModified":"2026-10-30T19:18:24.983","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a through 6.4.0."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Themeum","product":"Kirki","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"kirki","versions":[{"version":"0","lessThanOrEqual":"6.4.0","versionType":"custom","status":"affected","changes":[{"at":"6.4.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:39:58.586742Z","id":"CVE-2026-42694","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-80"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/kirki/vulnerability/wordpress-kirki-plugin-6-4-0-content-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-42701","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:09.370","lastModified":"2026-10-30T19:18:25.100","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Shop manager PHP Object Injection in YayMail <= 4.4.6 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"YayCommerce","product":"YayMail","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"yaymail","versions":[{"version":"n/a","lessThanOrEqual":"4.4.6","versionType":"custom","status":"affected","changes":[{"at":"4.4.7","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:38:39.430332Z","id":"CVE-2026-42701","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/yaymail/vulnerability/wordpress-yaymail-plugin-4-4-6-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-48200","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:09.490","lastModified":"2026-10-29T18:17:32.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Retrieve Embedded Sensitive Data.This issue affects Document Library Lite: from n/a through 1.3.0."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Barn2 Plugins","product":"Document Library Lite","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"document-library-lite","versions":[{"version":"0","lessThanOrEqual":"1.3.0","versionType":"custom","status":"affected","changes":[{"at":"1.3.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T17:10:29.608372Z","id":"CVE-2026-48200","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-201"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/document-library-lite/vulnerability/wordpress-document-library-lite-plugin-1-3-0-sensitive-data-exposure-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-54856","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:09.740","lastModified":"2026-10-30T19:18:26.373","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemeREX","product":"RexCoin","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"1.2.6","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:38:30.630764Z","id":"CVE-2026-54856","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/rexcoin/vulnerability/wordpress-rexcoin-theme-1-2-6-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-54857","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:09.860","lastModified":"2026-10-30T19:18:26.473","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated PHP Object Injection in Quirky <= 1.23 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemeREX","product":"Quirky","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"1.23","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:38:14.786724Z","id":"CVE-2026-54857","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/quirky/vulnerability/wordpress-quirky-theme-1-23-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-54858","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:09.980","lastModified":"2026-10-29T18:17:33.120","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemeREX","product":"Printy","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"1.13.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T17:11:54.969685Z","id":"CVE-2026-54858","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/printy/vulnerability/wordpress-printy-theme-1-13-0-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-54859","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:10.097","lastModified":"2026-10-29T20:17:31.677","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated PHP Object Injection in Preservation <= 1.15 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemeREX","product":"Preservation","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"1.15","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T19:40:16.181269Z","id":"CVE-2026-54859","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/preservation/vulnerability/wordpress-preservation-theme-1-15-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-54860","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:10.220","lastModified":"2026-10-30T19:18:26.580","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemeREX","product":"Ozisti","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"1.1.10","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:38:21.006097Z","id":"CVE-2026-54860","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/ozisti/vulnerability/wordpress-ozisti-theme-1-1-10-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-54864","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:10.333","lastModified":"2026-10-30T19:18:26.680","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"nicashmu","product":"Post Video Players","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"video-playlist-and-gallery-plugin","versions":[{"version":"n/a","lessThanOrEqual":"1.165","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:38:04.122213Z","id":"CVE-2026-54864","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/video-playlist-and-gallery-plugin/vulnerability/wordpress-post-video-players-plugin-1-165-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-54865","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:10.450","lastModified":"2026-10-30T19:18:26.933","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Podamibe Nepal","product":"Podamibe Custom User Gravatar","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"podamibe-custom-user-gravatar","versions":[{"version":"n/a","lessThanOrEqual":"1.0.8","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:33:43.141848Z","id":"CVE-2026-54865","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/podamibe-custom-user-gravatar/vulnerability/wordpress-podamibe-custom-user-gravatar-plugin-1-0-8-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-54866","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:10.577","lastModified":"2026-10-29T18:17:33.217","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin <= 1.2.8 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Razorpay","product":"Razorpay Payment Button Elementor Plugin","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"razorpay-payment-button-elementor","versions":[{"version":"n/a","lessThanOrEqual":"1.2.8","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T16:15:59.239561Z","id":"CVE-2026-54866","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/razorpay-payment-button-elementor/vulnerability/wordpress-razorpay-payment-button-elementor-plugin-plugin-1-2-8-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-61988","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:11.217","lastModified":"2026-10-29T20:17:31.780","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your Site <= 8.4.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"morehawes","product":"Auction Nudge – Your eBay on Your Site","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"auction-nudge","versions":[{"version":"n/a","lessThanOrEqual":"8.4.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T19:40:50.549493Z","id":"CVE-2026-61988","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/auction-nudge/vulnerability/wordpress-auction-nudge-your-ebay-on-your-site-plugin-8-4-0-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-61989","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:11.340","lastModified":"2026-10-30T19:18:29.167","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Merv Barrett","product":"Easy Property Listings","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"easy-property-listings","versions":[{"version":"n/a","lessThanOrEqual":"3.5.25","versionType":"custom","status":"affected","changes":[{"at":"3.5.26","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:37:57.513169Z","id":"CVE-2026-61989","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/easy-property-listings/vulnerability/wordpress-easy-property-listings-plugin-3-5-25-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-61991","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:11.463","lastModified":"2026-10-30T19:18:29.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Ajax Load More","product":"AjaxLoadMore Cache","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"3.1.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:37:53.342793Z","id":"CVE-2026-61991","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/ajax-load-more-cache/vulnerability/wordpress-ajaxloadmore-cache-plugin-3-1-1-remote-code-execution-rce-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-61992","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:11.820","lastModified":"2026-10-30T19:18:29.490","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Von Eyal Fitoussi","product":"GEO my WordPress","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"geo-my-wp","versions":[{"version":"n/a","lessThanOrEqual":"4.5.5.3","versionType":"custom","status":"affected","changes":[{"at":"4.5.5.4","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:37:46.317832Z","id":"CVE-2026-61992","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/geo-my-wp/vulnerability/wordpress-geo-my-wordpress-plugin-4-5-5-4-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-61993","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:12.033","lastModified":"2026-10-29T18:17:34.077","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"blockonomics","product":"Blockonomics","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"blockonomics-bitcoin-payments","versions":[{"version":"3.11.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T16:16:07.033133Z","id":"CVE-2026-61993","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/blockonomics-bitcoin-payments/vulnerability/wordpress-blockonomics-plugin-3-11-0-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-61995","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:12.177","lastModified":"2026-10-29T20:17:31.880","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"emarket-design","product":"YouTube Showcase","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"youtube-showcase","versions":[{"version":"n/a","lessThanOrEqual":"4.1.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T19:41:26.805410Z","id":"CVE-2026-61995","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/youtube-showcase/vulnerability/wordpress-youtube-showcase-plugin-4-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-61996","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:12.303","lastModified":"2026-10-30T19:18:29.623","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"favethemes","product":"MLS On The Fly","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"1.8.1.5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:33:45.668951Z","id":"CVE-2026-61996","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/mls-on-the-fly/vulnerability/wordpress-mls-on-the-fly-plugin-1-8-1-5-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-61997","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:12.457","lastModified":"2026-10-30T19:18:29.807","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemeREX","product":"Legal Stone","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"1.2.11","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:37:40.920501Z","id":"CVE-2026-61997","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/legal-stone/vulnerability/wordpress-legal-stone-theme-1-2-11-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-61998","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:12.580","lastModified":"2026-10-30T19:18:29.960","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemeREX","product":"Le Truffe","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"1.1.7","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:37:33.940983Z","id":"CVE-2026-61998","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/letruffe/vulnerability/wordpress-le-truffe-theme-1-1-7-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-62001","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:12.693","lastModified":"2026-10-29T18:17:34.173","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemeREX","product":"Marcell","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"1.2.14","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T17:11:57.084931Z","id":"CVE-2026-62001","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/marcell/vulnerability/wordpress-marcell-theme-1-2-14-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-62002","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:12.823","lastModified":"2026-10-29T20:17:31.980","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemeREX","product":"Meals & Wheels","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"1.1.13","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T19:42:14.755421Z","id":"CVE-2026-62002","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/meals-wheels/vulnerability/wordpress-meals-wheels-theme-1-1-13-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-62003","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:12.950","lastModified":"2026-10-30T19:18:30.120","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated PHP Object Injection in Mission <= 1.22 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemeREX","product":"Mission","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"1.22","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:40:29.807028Z","id":"CVE-2026-62003","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/mission/vulnerability/wordpress-mission-theme-1-22-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-62004","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:13.070","lastModified":"2026-10-30T19:18:30.270","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated PHP Object Injection in Motorix <= 1.11 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemeREX","product":"Motorix","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"1.11","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:40:22.704584Z","id":"CVE-2026-62004","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/motorix/vulnerability/wordpress-motorix-theme-1-11-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-62005","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:13.190","lastModified":"2026-10-30T19:18:30.410","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemeREX","product":"Muzicon","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"1.15","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:40:16.553320Z","id":"CVE-2026-62005","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/muzicon/vulnerability/wordpress-muzicon-theme-1-15-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-62006","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:13.310","lastModified":"2026-10-29T18:17:34.273","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated PHP Object Injection in Nuts <= 1.12 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemeREX","product":"Nuts","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"1.12","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T17:11:59.527526Z","id":"CVE-2026-62006","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/nuts/vulnerability/wordpress-nuts-theme-1-12-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-62008","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:13.427","lastModified":"2026-10-29T20:17:32.073","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemeREX","product":"Orpheus","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"1.8","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T19:42:42.948327Z","id":"CVE-2026-62008","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/orpheus/vulnerability/wordpress-orpheus-theme-1-8-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-62009","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:13.543","lastModified":"2026-10-30T19:18:30.557","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemeREX","product":"Filmax","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"1.1.11","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:40:10.444723Z","id":"CVE-2026-62009","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/filmax/vulnerability/wordpress-filmax-theme-1-1-11-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-62010","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:13.670","lastModified":"2026-10-30T19:18:30.697","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemeREX","product":"Avventure","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"1.1.12","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:39:00.718830Z","id":"CVE-2026-62010","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/avventure/vulnerability/wordpress-avventure-theme-1-1-12-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-62011","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:13.787","lastModified":"2026-10-30T19:18:30.843","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemeREX","product":"Bonbon","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"1.11","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:38:54.202615Z","id":"CVE-2026-62011","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/bonbon/vulnerability/wordpress-bonbon-theme-1-11-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-62012","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:13.907","lastModified":"2026-10-29T18:17:34.370","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemeREX","product":"Coinpress","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"1.0.15","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T17:12:02.658500Z","id":"CVE-2026-62012","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/coinpress/vulnerability/wordpress-coinpress-theme-1-0-15-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-62013","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:14.027","lastModified":"2026-10-29T20:17:32.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemeREX","product":"Edge Decor","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"2.9","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T19:49:12.532512Z","id":"CVE-2026-62013","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/edge-decor/vulnerability/wordpress-edge-decor-theme-2-9-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-62014","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:14.143","lastModified":"2026-10-30T19:18:30.960","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemeREX","product":"EmojiNation","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"1.0.12","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:37:27.271181Z","id":"CVE-2026-62014","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/emojination/vulnerability/wordpress-emojination-theme-1-0-12-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-62015","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:14.263","lastModified":"2026-10-30T19:18:31.087","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemeREX","product":"Gamezone","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"1.1.11","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:37:21.606672Z","id":"CVE-2026-62015","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/gamezone/vulnerability/wordpress-gamezone-theme-1-1-11-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-62016","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:14.387","lastModified":"2026-10-30T19:18:31.203","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated PHP Object Injection in Gamic <= 1.19 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemeREX","product":"Gamic","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"1.19","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:37:15.988198Z","id":"CVE-2026-62016","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/gamic/vulnerability/wordpress-gamic-theme-1-19-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-62017","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:14.513","lastModified":"2026-10-29T18:17:34.470","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemeREX","product":"Good Homes","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"1.3.13","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T17:12:05.729858Z","id":"CVE-2026-62017","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/good-homes/vulnerability/wordpress-good-homes-theme-1-3-13-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-62018","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:14.643","lastModified":"2026-10-29T20:17:32.290","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemeREX","product":"Gunslinger","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"1.11","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T19:47:41.838379Z","id":"CVE-2026-62018","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/gunslinger/vulnerability/wordpress-gunslinger-theme-1-11-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-62131","sourceIdentifier":"audit@patchstack.com","published":"2026-10-29T16:18:14.800","lastModified":"2026-10-30T19:18:32.357","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Zoho Flow","product":"Zoho Flow","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"zoho-flow","versions":[{"version":"n/a","lessThanOrEqual":"2.14.5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:37:08.865939Z","id":"CVE-2026-62131","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/zoho-flow/vulnerability/wordpress-zoho-flow-plugin-2-14-5-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-66911","sourceIdentifier":"cvd@cert.pl","published":"2026-10-29T16:18:15.390","lastModified":"2026-10-29T16:29:56.553","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, an attacker can set it to a javascript: URI. An unauthenticated remote attacker can send a crafted email to a victim; when the victim opens the email in the Zimbra web interface and clicks the attachment name, the JavaScript payload executes in the victim's browser context. This issue was fixed in version 10.1.21"}],"affected":[{"source":"cvd@cert.pl","affectedData":[{"vendor":"Synacor","product":"Zimbra Collaboration","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"10.1.21","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cvd@cert.pl","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"cvd@cert.pl","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://cert.pl/en/posts/2026/10/CVE-2026-66911","source":"cvd@cert.pl"},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","source":"cvd@cert.pl"}]}},{"cve":{"id":"CVE-2026-66912","sourceIdentifier":"cvd@cert.pl","published":"2026-10-29T16:18:15.530","lastModified":"2026-10-29T16:29:56.553","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From header with an embedded JavaScript payload. When the victim opens the message in Classic UI and clicks Reply while composing in HTML mode with reply headers disabled, the unsanitized From header content is rendered as HTML and the JavaScript payload executes in the victim's browser, potentially allowing the attacker to steal session information or perform actions on behalf of the victim. This issue was fixed in version 10.1.21"}],"affected":[{"source":"cvd@cert.pl","affectedData":[{"vendor":"Synacor","product":"Zimbra Collaboration","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"10.1.21","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cvd@cert.pl","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"cvd@cert.pl","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://cert.pl/en/posts/2026/10/CVE-2026-66911","source":"cvd@cert.pl"},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","source":"cvd@cert.pl"}]}},{"cve":{"id":"CVE-2026-77817","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:18:52.513","lastModified":"2026-10-30T13:22:05.700","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper sanitization of secrets during flow and project exports."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.4:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Primary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.12.5","matchCriteriaId":"E87E255E-36D3-4111-86DC-F5632C97BD70"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293016","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-77819","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:18:52.800","lastModified":"2026-10-30T13:21:49.103","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation of a pathname to a restricted directory."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.3:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.12.4","matchCriteriaId":"7DD7A51A-E98C-4322-8E25-D5DBC2AC55BA"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293015","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-84294","sourceIdentifier":"security@progress.com","published":"2026-10-29T16:19:29.237","lastModified":"2026-10-29T16:24:53.840","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories."}],"affected":[{"source":"security@progress.com","affectedData":[{"vendor":"Progress Software","product":"WS_FTP Server","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"0","lessThan":"2024.0.6","versionType":"custom","status":"affected"},{"version":"0","lessThan":"2025.0.3","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@progress.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0}]},"weaknesses":[{"source":"security@progress.com","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view","source":"security@progress.com"}]}},{"cve":{"id":"CVE-2026-84295","sourceIdentifier":"security@progress.com","published":"2026-10-29T16:19:29.860","lastModified":"2026-10-30T18:18:13.827","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials."}],"affected":[{"source":"security@progress.com","affectedData":[{"vendor":"Progress Software","product":"WS_FTP Server","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"0","lessThan":"2024.0.6","versionType":"custom","status":"affected"},{"version":"0","lessThan":"2025.0.3","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@progress.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:36.511377Z","id":"CVE-2026-84295","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@progress.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-522"}]}],"references":[{"url":"https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view","source":"security@progress.com"}]}},{"cve":{"id":"CVE-2026-84296","sourceIdentifier":"security@progress.com","published":"2026-10-29T16:19:29.980","lastModified":"2026-10-30T18:18:13.973","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of authentication factors between accounts."}],"affected":[{"source":"security@progress.com","affectedData":[{"vendor":"Progress Software","product":"WS_FTP Server","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"0","lessThan":"2024.0.6","versionType":"custom","status":"affected"},{"version":"0","lessThan":"2025.0.3","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@progress.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:37.268653Z","id":"CVE-2026-84296","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@progress.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-303"}]}],"references":[{"url":"https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view","source":"security@progress.com"}]}},{"cve":{"id":"CVE-2026-85330","sourceIdentifier":"secure@microsoft.com","published":"2026-10-29T16:19:31.123","lastModified":"2026-10-30T14:17:10.163","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network."}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft","product":"Microsoft Edge (Chromium-based)","versions":[{"version":"1.0.0.0","lessThan":"155.0.4283.45","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secure@microsoft.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T13:38:12.885270Z","id":"CVE-2026-85330","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secure@microsoft.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85330","source":"secure@microsoft.com"}]}},{"cve":{"id":"CVE-2026-85890","sourceIdentifier":"secure@microsoft.com","published":"2026-10-29T16:19:45.017","lastModified":"2026-10-30T18:18:14.130","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network."}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft","product":"Microsoft Edge (Chromium-based)","versions":[{"version":"1.0.0.0","lessThan":"154.0.4258.37","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secure@microsoft.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:17.714627Z","id":"CVE-2026-85890","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secure@microsoft.com","type":"Secondary","description":[{"lang":"en","value":"CWE-415"}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85890","source":"secure@microsoft.com"}]}},{"cve":{"id":"CVE-2026-85897","sourceIdentifier":"secure@microsoft.com","published":"2026-10-29T16:19:45.220","lastModified":"2026-10-30T18:18:14.307","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network."}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft","product":"Microsoft Edge (Chromium-based)","versions":[{"version":"1.0.0.0","lessThan":"154.0.4258.37","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secure@microsoft.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:18.453394Z","id":"CVE-2026-85897","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secure@microsoft.com","type":"Secondary","description":[{"lang":"en","value":"CWE-122"}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85897","source":"secure@microsoft.com"}]}},{"cve":{"id":"CVE-2026-85899","sourceIdentifier":"secure@microsoft.com","published":"2026-10-29T16:19:45.410","lastModified":"2026-10-30T18:18:14.470","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges over a network."}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft","product":"Microsoft Edge (Chromium-based)","versions":[{"version":"1.0.0.0","lessThan":"155.0.4283.45","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secure@microsoft.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:34.266155Z","id":"CVE-2026-85899","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secure@microsoft.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85899","source":"secure@microsoft.com"}]}},{"cve":{"id":"CVE-2026-88077","sourceIdentifier":"secure@microsoft.com","published":"2026-10-29T16:19:52.807","lastModified":"2026-10-30T18:18:15.730","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network."}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft","product":"Microsoft Edge (Chromium-based)","versions":[{"version":"1.0.0.0","lessThan":"154.0.4258.62","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secure@microsoft.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:35.758065Z","id":"CVE-2026-88077","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secure@microsoft.com","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88077","source":"secure@microsoft.com"}]}},{"cve":{"id":"CVE-2026-88078","sourceIdentifier":"secure@microsoft.com","published":"2026-10-29T16:19:53.440","lastModified":"2026-10-30T14:17:10.467","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper verification of cryptographic signature in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network."}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft","product":"Microsoft Edge (Chromium-based)","versions":[{"version":"1.0.0.0","lessThan":"156.0.4314.42","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secure@microsoft.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T13:37:57.479805Z","id":"CVE-2026-88078","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secure@microsoft.com","type":"Secondary","description":[{"lang":"en","value":"CWE-347"}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88078","source":"secure@microsoft.com"}]}},{"cve":{"id":"CVE-2026-88090","sourceIdentifier":"secure@microsoft.com","published":"2026-10-29T16:19:54.280","lastModified":"2026-10-30T18:18:15.893","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network."}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft","product":"Microsoft Edge (Chromium-based)","versions":[{"version":"1.0.0.0","lessThan":"154.0.4258.37","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secure@microsoft.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:33.394305Z","id":"CVE-2026-88090","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secure@microsoft.com","type":"Secondary","description":[{"lang":"en","value":"CWE-843"}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88090","source":"secure@microsoft.com"}]}},{"cve":{"id":"CVE-2026-90861","sourceIdentifier":"security@progress.com","published":"2026-10-29T16:20:04.097","lastModified":"2026-10-30T18:18:16.590","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another administrator, who could use it to gain broader administrative access to the server."}],"affected":[{"source":"security@progress.com","affectedData":[{"vendor":"Progress Software","product":"WS_FTP Server","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"0","lessThan":"2024.0.7","versionType":"custom","status":"affected"},{"version":"0","lessThan":"2025.0.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@progress.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.7,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:37.996783Z","id":"CVE-2026-90861","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@progress.com","type":"Secondary","description":[{"lang":"en","value":"CWE-522"},{"lang":"en","value":"CWE-532"}]}],"references":[{"url":"https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view","source":"security@progress.com"}]}},{"cve":{"id":"CVE-2026-90862","sourceIdentifier":"security@progress.com","published":"2026-10-29T16:20:04.220","lastModified":"2026-10-30T18:18:16.713","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to access certain files associated with that account without satisfying multi-factor authentication requirements."}],"affected":[{"source":"security@progress.com","affectedData":[{"vendor":"Progress Software","product":"WS_FTP Server","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"0","lessThan":"2024.0.7","versionType":"custom","status":"affected"},{"version":"0","lessThan":"2025.0.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@progress.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:13:52.462395Z","id":"CVE-2026-90862","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@progress.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-308"}]}],"references":[{"url":"https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view","source":"security@progress.com"}]}},{"cve":{"id":"CVE-2026-90863","sourceIdentifier":"security@progress.com","published":"2026-10-29T16:20:04.337","lastModified":"2026-10-30T18:18:16.837","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server."}],"affected":[{"source":"security@progress.com","affectedData":[{"vendor":"Progress Software","product":"WS_FTP Server","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"0","lessThan":"2024.0.7","versionType":"custom","status":"affected"},{"version":"0","lessThan":"2025.0.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@progress.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:38.763130Z","id":"CVE-2026-90863","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@progress.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"},{"lang":"en","value":"CWE-915"}]}],"references":[{"url":"https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view","source":"security@progress.com"}]}},{"cve":{"id":"CVE-2026-90864","sourceIdentifier":"security@progress.com","published":"2026-10-29T16:20:04.453","lastModified":"2026-10-30T18:18:16.967","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope."}],"affected":[{"source":"security@progress.com","affectedData":[{"vendor":"Progress Software","product":"WS_FTP Server","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"0","lessThan":"2024.0.7","versionType":"custom","status":"affected"},{"version":"0","lessThan":"2025.0.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@progress.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:39.496575Z","id":"CVE-2026-90864","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@progress.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view","source":"security@progress.com"}]}},{"cve":{"id":"CVE-2026-90865","sourceIdentifier":"security@progress.com","published":"2026-10-29T16:20:04.570","lastModified":"2026-10-30T18:18:17.093","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations."}],"affected":[{"source":"security@progress.com","affectedData":[{"vendor":"Progress Software","product":"WS_FTP Server","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"0","lessThan":"2024.0.7","versionType":"custom","status":"affected"},{"version":"0","lessThan":"2025.0.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@progress.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:40.340149Z","id":"CVE-2026-90865","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@progress.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-88"}]}],"references":[{"url":"https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view","source":"security@progress.com"}]}},{"cve":{"id":"CVE-2026-90866","sourceIdentifier":"security@progress.com","published":"2026-10-29T16:20:04.690","lastModified":"2026-10-30T18:18:17.220","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution."}],"affected":[{"source":"security@progress.com","affectedData":[{"vendor":"Progress Software","product":"WS_FTP Server","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"0","lessThan":"2024.0.7","versionType":"custom","status":"affected"},{"version":"0","lessThan":"2025.0.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@progress.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:41.141423Z","id":"CVE-2026-90866","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@progress.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view","source":"security@progress.com"}]}},{"cve":{"id":"CVE-2026-90867","sourceIdentifier":"security@progress.com","published":"2026-10-29T16:20:04.827","lastModified":"2026-10-30T18:18:17.340","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts."}],"affected":[{"source":"security@progress.com","affectedData":[{"vendor":"Progress Software","product":"WS_FTP Server","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"0","lessThan":"2024.0.7","versionType":"custom","status":"affected"},{"version":"0","lessThan":"2025.0.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@progress.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:41.868911Z","id":"CVE-2026-90867","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@progress.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view","source":"security@progress.com"}]}},{"cve":{"id":"CVE-2026-90868","sourceIdentifier":"security@progress.com","published":"2026-10-29T16:20:04.963","lastModified":"2026-10-30T18:18:17.463","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations."}],"affected":[{"source":"security@progress.com","affectedData":[{"vendor":"Progress Software","product":"WS_FTP Server","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"0","lessThan":"2024.0.7","versionType":"custom","status":"affected"},{"version":"0","lessThan":"2025.0.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@progress.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:42.616495Z","id":"CVE-2026-90868","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@progress.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-88"}]}],"references":[{"url":"https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view","source":"security@progress.com"}]}},{"cve":{"id":"CVE-2026-90869","sourceIdentifier":"security@progress.com","published":"2026-10-29T16:20:05.080","lastModified":"2026-10-30T18:18:17.587","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows."}],"affected":[{"source":"security@progress.com","affectedData":[{"vendor":"Progress Software","product":"WS_FTP Server","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"0","lessThan":"2024.0.7","versionType":"custom","status":"affected"},{"version":"0","lessThan":"2025.0.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@progress.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:14:25.359940Z","id":"CVE-2026-90869","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@progress.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view","source":"security@progress.com"}]}},{"cve":{"id":"CVE-2026-90870","sourceIdentifier":"security@progress.com","published":"2026-10-29T16:20:05.190","lastModified":"2026-10-30T18:18:17.703","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation."}],"affected":[{"source":"security@progress.com","affectedData":[{"vendor":"Progress Software","product":"WS_FTP Server","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"0","lessThan":"2024.0.7","versionType":"custom","status":"affected"},{"version":"0","lessThan":"2025.0.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@progress.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:14:52.709323Z","id":"CVE-2026-90870","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@progress.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-772"}]}],"references":[{"url":"https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view","source":"security@progress.com"}]}},{"cve":{"id":"CVE-2026-90871","sourceIdentifier":"security@progress.com","published":"2026-10-29T16:20:05.307","lastModified":"2026-10-30T18:18:17.843","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an unauthenticated attacker to affect files outside the intended directory."}],"affected":[{"source":"security@progress.com","affectedData":[{"vendor":"Progress Software","product":"WS_FTP Server","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"0","lessThan":"2024.0.7","versionType":"custom","status":"affected"},{"version":"0","lessThan":"2025.0.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@progress.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:15:23.342163Z","id":"CVE-2026-90871","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@progress.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-73"}]}],"references":[{"url":"https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view","source":"security@progress.com"}]}},{"cve":{"id":"CVE-2026-90872","sourceIdentifier":"security@progress.com","published":"2026-10-29T16:20:05.417","lastModified":"2026-10-30T18:18:19.807","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WS_FTP Server IIS worker process."}],"affected":[{"source":"security@progress.com","affectedData":[{"vendor":"Progress Software","product":"WS_FTP Server","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"0","lessThan":"2024.0.7","versionType":"custom","status":"affected"},{"version":"0","lessThan":"2025.0.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@progress.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L","baseScore":6.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:43.363801Z","id":"CVE-2026-90872","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@progress.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-95"}]}],"references":[{"url":"https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view","source":"security@progress.com"}]}},{"cve":{"id":"CVE-2026-90991","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:20:05.543","lastModified":"2026-10-30T13:21:38.413","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to cause a denial of service due to allocation of resources without limits or throttling."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.4:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T16:15:48.481458Z","id":"CVE-2026-90991","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.12.5","matchCriteriaId":"E87E255E-36D3-4111-86DC-F5632C97BD70"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293016","source":"psirt@us.ibm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-93570","sourceIdentifier":"cvd@cert.pl","published":"2026-10-29T16:20:05.730","lastModified":"2026-10-29T16:22:34.397","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injection. When a user signs or verify a crafted XML file containing a `DOCTYPE` with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem.\n\n\nThis issue was fixed in Szafir version 2.0 build 708. Szafir Weryfikująca is no longer supported (End of Life) and has not been fixed."}],"affected":[{"source":"cvd@cert.pl","affectedData":[{"vendor":"Krajowa Izba Rozliczeniowa","product":"Szafir","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.0.0","versionType":"custom","status":"affected","changes":[{"at":"build 708","status":"unaffected"}]}]},{"vendor":"Krajowa Izba Rozliczeniowa","product":"Szafir Weryfikująca","defaultStatus":"affected","versions":[{"version":"0","lessThanOrEqual":"1.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cvd@cert.pl","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"cvd@cert.pl","type":"Primary","description":[{"lang":"en","value":"CWE-611"}]}],"references":[{"url":"https://cert.pl/posts/2026/10/CVE-2026-93570","source":"cvd@cert.pl"},{"url":"https://www.elektronicznypodpis.pl/","source":"cvd@cert.pl"}]}},{"cve":{"id":"CVE-2026-93571","sourceIdentifier":"cvd@cert.pl","published":"2026-10-29T16:20:05.893","lastModified":"2026-10-29T16:22:34.397","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Szafir is vulnerable to Path Traversal in the uploaded filename. A man-in-the-middle attacker who can reroute update request to their server can prepare arbitrary XML file that will be saved in location chosen by attacker. \n\n\nThis issue was fixed in version 2.0 build 708."}],"affected":[{"source":"cvd@cert.pl","affectedData":[{"vendor":"Krajowa Izba Rozliczeniowa","product":"Szafir","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.0","versionType":"custom","status":"affected","changes":[{"at":"build 708","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"cvd@cert.pl","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"cvd@cert.pl","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://cert.pl/posts/2026/10/CVE-2026-93570","source":"cvd@cert.pl"},{"url":"https://www.elektronicznypodpis.pl/","source":"cvd@cert.pl"}]}},{"cve":{"id":"CVE-2026-93680","sourceIdentifier":"psirt@us.ibm.com","published":"2026-10-29T16:20:06.040","lastModified":"2026-10-30T18:18:20.320","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Langflow OSS","cpes":["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:langflow_oss:1.12.8:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.12.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:31.075788Z","id":"CVE-2026-93680","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.13.0","matchCriteriaId":"C3DBF545-D19A-4FFA-87D2-E137B95D4A55"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7294467","source":"psirt@us.ibm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-96187","sourceIdentifier":"secure@microsoft.com","published":"2026-10-29T16:20:08.143","lastModified":"2026-10-30T14:17:11.230","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network."}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft","product":"Microsoft Edge (Chromium-based)","versions":[{"version":"1.0.0.0","lessThan":"155.0.4283.45","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secure@microsoft.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T13:38:07.997435Z","id":"CVE-2026-96187","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secure@microsoft.com","type":"Secondary","description":[{"lang":"en","value":"CWE-843"}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96187","source":"secure@microsoft.com"}]}},{"cve":{"id":"CVE-2026-96192","sourceIdentifier":"secure@microsoft.com","published":"2026-10-29T16:20:08.347","lastModified":"2026-10-30T18:18:20.607","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Microsoft Edge for iOS allows an unauthorized attacker to execute code over a network."}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft","product":"Microsoft Edge (Chromium-based)","versions":[{"version":"1.0.0.0","lessThan":"155.0.4283.45","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secure@microsoft.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:31.811825Z","id":"CVE-2026-96192","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secure@microsoft.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96192","source":"secure@microsoft.com"}]}},{"cve":{"id":"CVE-2026-96196","sourceIdentifier":"secure@microsoft.com","published":"2026-10-29T16:20:08.477","lastModified":"2026-10-30T18:18:20.730","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network."}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft","product":"Microsoft Edge (Chromium-based)","versions":[{"version":"1.0.0.0","lessThan":"156.0.4314.50","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secure@microsoft.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:35.017904Z","id":"CVE-2026-96196","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secure@microsoft.com","type":"Secondary","description":[{"lang":"en","value":"CWE-184"}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96196","source":"secure@microsoft.com"}]}},{"cve":{"id":"CVE-2026-96198","sourceIdentifier":"secure@microsoft.com","published":"2026-10-29T16:20:08.607","lastModified":"2026-10-30T18:18:20.877","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network."}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft","product":"Microsoft Edge (Chromium-based)","versions":[{"version":"1.0.0.0","lessThan":"154.0.4258.37","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secure@microsoft.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:19.260768Z","id":"CVE-2026-96198","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secure@microsoft.com","type":"Secondary","description":[{"lang":"en","value":"CWE-122"}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96198","source":"secure@microsoft.com"}]}},{"cve":{"id":"CVE-2026-96199","sourceIdentifier":"secure@microsoft.com","published":"2026-10-29T16:20:08.737","lastModified":"2026-10-30T18:18:21.023","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network."}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft","product":"Microsoft Edge (Chromium-based)","versions":[{"version":"1.0.0.0","lessThan":"154.0.4258.37","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secure@microsoft.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:20.232480Z","id":"CVE-2026-96199","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secure@microsoft.com","type":"Secondary","description":[{"lang":"en","value":"CWE-122"}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96199","source":"secure@microsoft.com"}]}},{"cve":{"id":"CVE-2026-96203","sourceIdentifier":"secure@microsoft.com","published":"2026-10-29T16:20:09.003","lastModified":"2026-10-30T18:18:21.170","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network."}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft","product":"Microsoft Edge (Chromium-based)","versions":[{"version":"1.0.0.0","lessThan":"155.0.4283.45","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secure@microsoft.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:32.647654Z","id":"CVE-2026-96203","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secure@microsoft.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96203","source":"secure@microsoft.com"}]}},{"cve":{"id":"CVE-2023-7357","sourceIdentifier":"PSIRT-CNA@flexerasoftware.com","published":"2026-10-29T17:17:54.467","lastModified":"2026-10-30T19:37:07.073","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A remote code execution (RCE) vulnerability was identified in the FlexNet Publisher lmadmin web user interface. This vulnerability is addressed in the FlexNet Publisher 2023 R2 (11.19.4.0) release."}],"affected":[{"source":"PSIRT-CNA@flexerasoftware.com","affectedData":[{"vendor":"Revera","product":"FlexNet Publisher","defaultStatus":"unaffected","modules":["lmadmin"],"versions":[{"version":"2023 R1 (11.19.3.0)","lessThan":"2023 R2 (11.19.4.0)","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"PSIRT-CNA@flexerasoftware.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:16:26.722563Z","id":"CVE-2023-7357","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"PSIRT-CNA@flexerasoftware.com","type":"Secondary","description":[{"lang":"en","value":"CWE-829"}]}],"references":[{"url":"https://community.flexera.com/s/article/remote-code-execution-vulnerability-remediated-in-lmadmin","source":"PSIRT-CNA@flexerasoftware.com"}]}},{"cve":{"id":"CVE-2025-12523","sourceIdentifier":"bd4443e6-1eef-43f3-9886-25fc9ceeaae7","published":"2026-10-29T17:17:55.800","lastModified":"2026-10-30T19:39:14.897","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Broken Object Level Authorization in Users Configuration Endpoint allows Information Disclosure to authenticated user"}],"affected":[{"source":"bd4443e6-1eef-43f3-9886-25fc9ceeaae7","affectedData":[{"vendor":"Centreon","product":"Centreon","defaultStatus":"unaffected","packageName":"https://central.platform/centreon","versions":[{"version":"24.10","lessThan":"centreon-web-25.10.6","versionType":"custom","status":"affected"},{"version":"24.04","lessThan":"centreon-web-24.10.21","versionType":"custom","status":"affected"},{"version":"25.10.x","lessThan":"centreon-web-24.04.25","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"bd4443e6-1eef-43f3-9886-25fc9ceeaae7","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:15:53.318787Z","id":"CVE-2025-12523","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"bd4443e6-1eef-43f3-9886-25fc9ceeaae7","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/centreon/centreon/releases","source":"bd4443e6-1eef-43f3-9886-25fc9ceeaae7"},{"url":"https://thewatch.centreon.comundefined","source":"bd4443e6-1eef-43f3-9886-25fc9ceeaae7"}]}},{"cve":{"id":"CVE-2026-107043","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T17:17:56.630","lastModified":"2026-10-30T19:39:14.897","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mechanism."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://f-droid.org/packages/co.ec.cnsyn.codecatcher/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107043.md","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-107044","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T17:17:56.780","lastModified":"2026-10-30T19:39:14.897","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport mechanism."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:00:45.821144Z","id":"CVE-2026-107044","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-732"}]}],"references":[{"url":"https://bitbucket.org/projectmaxs/maxs","source":"cve@mitre.org"},{"url":"https://f-droid.org/packages/org.projectmaxs.main/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107044.md","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107044.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-107045","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T17:17:56.933","lastModified":"2026-10-30T19:39:14.897","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized attackers to arbitrarily read another's Nostr event database."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://f-droid.org/packages/com.greenart7c3.citrine/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107045.md","source":"cve@mitre.org"},{"url":"https://github.com/greenart7c3/Citrine","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-107046","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T17:17:57.077","lastModified":"2026-10-30T19:39:14.897","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows attackers to scan internal resources via supplying a crafted URL."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://f-droid.org/packages/allen.town.focus.podcast/","source":"cve@mitre.org"},{"url":"https://github.com/AntennaPod/AntennaPod","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107046.md","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-107047","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T17:17:57.223","lastModified":"2026-10-30T19:39:14.897","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T19:59:15.294528Z","id":"CVE-2026-107047","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-732"}]}],"references":[{"url":"https://f-droid.org/packages/com.mendhak.gpslogger/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107047.md","source":"cve@mitre.org"},{"url":"https://github.com/mendhak/gpslogger","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107047.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-107048","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T17:17:57.370","lastModified":"2026-10-30T19:39:14.897","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://f-droid.org/packages/app.motionui.android/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107048.md","source":"cve@mitre.org"},{"url":"https://github.com/motionui/motionui-android","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-107049","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T17:17:57.510","lastModified":"2026-10-30T19:39:14.897","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An issue in Forkyz versionCode 8500000 allows attackers to arbitrarily change another user's storage settings via supplying a crafted URI string."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T18:09:43.232775Z","id":"CVE-2026-107049","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://codeberg.org/jeffshee/forkyz","source":"cve@mitre.org"},{"url":"https://f-droid.org/packages/app.crossword.yourealwaysbe.forkyz/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107049.md","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107049.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-107050","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T17:17:57.650","lastModified":"2026-10-30T19:37:07.073","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in their uid, leading to arbitrary code execution."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://f-droid.org/packages/com.retroarch/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107050.md","source":"cve@mitre.org"},{"url":"https://github.com/libretro/RetroArch","source":"cve@mitre.org"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9136","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-107051","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T17:17:57.787","lastModified":"2026-10-30T19:39:14.897","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to arbitrarily manipulate another user's FHEM home-automation control configurations."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://f-droid.org/packages/li.klass.fhem/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107051.md","source":"cve@mitre.org"},{"url":"https://github.com/klassm/andFHEM","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-107052","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T17:17:57.920","lastModified":"2026-10-30T19:39:14.897","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily reead files outside of the sandbox via providing an absolute path."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T19:55:55.571046Z","id":"CVE-2026-107052","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-276"}]}],"references":[{"url":"https://bitbucket.org/projectmaxs/maxs","source":"cve@mitre.org"},{"url":"https://f-droid.org/packages/org.projectmaxs.module.fileread/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107052.md","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107052.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-107053","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T17:17:58.050","lastModified":"2026-10-30T19:39:14.897","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in a shared storage space outside of the sandbox."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://f-droid.org/packages/com.foobnix.pro.pdf.reader/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107053.md","source":"cve@mitre.org"},{"url":"https://github.com/foobnix/LibreraReader","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-107055","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T17:17:58.190","lastModified":"2026-10-30T19:39:14.897","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in the autosave component of AppML neutriNote CE versionCode 1387 allows unauthorized attackers to write arbitrary files."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:59:37.508493Z","id":"CVE-2026-107055","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-732"}]}],"references":[{"url":"https://f-droid.org/packages/com.appmindlab.nano/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107055.md","source":"cve@mitre.org"},{"url":"https://github.com/appml/neutrinote","source":"cve@mitre.org"},{"url":"https://github.com/appml/neutrinote/issues/71","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107055.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-107056","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T17:17:58.320","lastModified":"2026-10-30T19:39:14.897","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data into the victim's location database via a crafted SEND message."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://codeberg.org/OpenTracksApp/OpenTracks","source":"cve@mitre.org"},{"url":"https://f-droid.org/packages/de.dennisguse.opentracks/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107056.md","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-107057","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T17:17:58.457","lastModified":"2026-10-30T19:39:14.897","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://f-droid.org/packages/net.bible.android.activity/","source":"cve@mitre.org"},{"url":"https://github.com/AndBible/and-bible","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107057.md","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-107058","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T17:17:58.620","lastModified":"2026-10-30T19:39:14.897","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service API and preference state."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T19:53:59.673864Z","id":"CVE-2026-107058","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://f-droid.org/packages/net.typeblog.shelter/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107058.md","source":"cve@mitre.org"},{"url":"https://github.com/PeterCxy/Shelter","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107058.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-107059","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T17:17:58.797","lastModified":"2026-10-30T19:03:27.583","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker controlled progile, bypassing authentication."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://f-droid.org/packages/com.nextcloud.client/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107059.md","source":"cve@mitre.org"},{"url":"https://github.com/nextcloud/android","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-107060","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T17:17:58.933","lastModified":"2026-10-30T19:18:03.053","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:57:48.702391Z","id":"CVE-2026-107060","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-732"}]}],"references":[{"url":"https://f-droid.org/packages/com.tailscale.ipn/","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107060.md","source":"cve@mitre.org"},{"url":"https://github.com/tailscale/tailscale","source":"cve@mitre.org"},{"url":"https://tailscale.com/security-bulletins","source":"cve@mitre.org"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107060.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-115805","sourceIdentifier":"cve@rapid7.com","published":"2026-10-29T17:18:01.840","lastModified":"2026-10-30T18:17:23.107","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper handling of local filesystem paths in Rapid7 Insight Agent on Linux and macOS may allow authenticated local users to gain elevated privileges. Exploitation requires existing local access and depends on the Agent's inventory collection processing the crafted path."}],"affected":[{"source":"cve@rapid7.com","affectedData":[{"vendor":"Rapid7","product":"Insight Agent","defaultStatus":"unaffected","platforms":["MacOS","Linux"],"versions":[{"version":"0","lessThan":"4.1.4.43","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@rapid7.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T03:56:44.353245Z","id":"CVE-2026-115805","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@rapid7.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://docs.rapid7.com/insight/release-notes-2026-october/#rapid7-agent-insight-agent","source":"cve@rapid7.com"}]}},{"cve":{"id":"CVE-2026-118758","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T17:18:06.487","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the volume artifact handler for GET /artifacts/get?source=volume did not confine a caller-supplied file path to the selected volume. A caller who can reach the route and identify an existing mounted volume can use path traversal to read files outside that volume when the artifact-serving process can read them. The frontend pod serves the request when artifact proxying is disabled, while the selected namespace's artifact-service pod serves it when proxying is enabled. A deployment with authentication disabled requires no application credentials; in multi-user deployments, the caller ordinarily must be authorized for the supplied namespace. This issue is fixed in version 2.18.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"kubeflow","product":"pipelines","versions":[{"version":"< 2.18.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T20:18:21.704175Z","id":"CVE-2026-118758","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/kubeflow/pipelines/blob/2.18.0/docs/operator-guides/upgrade-2.18.md#custom-storage-configuration-and-rollout","source":"security-advisories@github.com"},{"url":"https://github.com/kubeflow/pipelines/commit/4d9bc5ab12b67efedb3923ef428a399cb445cf5f","source":"security-advisories@github.com"},{"url":"https://github.com/kubeflow/pipelines/pull/13677","source":"security-advisories@github.com"},{"url":"https://github.com/kubeflow/pipelines/releases/tag/2.18.0","source":"security-advisories@github.com"},{"url":"https://github.com/kubeflow/pipelines/security/advisories/GHSA-2fg9-fx2f-439r","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-118759","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T17:18:06.630","lastModified":"2026-10-30T18:17:24.807","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server's GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log handler retrieved logs without authorizing the caller against the selected run. A caller who can reach the backend and knows a victim run ID and suitable pod or node identifier can read live or archived logs with the API server's permissions. For live logs, the caller-controlled node ID was also accepted as a pod name without verifying that the pod belonged to the requested run, allowing a known run ID to select the namespace of an unrelated pod and read its main container logs. The handler does not authenticate requests itself, although an external authentication gate or network policy can limit reachability. Exposed logs can contain sensitive workload data or credentials. This issue is fixed in version 2.18.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"kubeflow","product":"pipelines","versions":[{"version":"< 2.18.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T15:47:06.206005Z","id":"CVE-2026-118759","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/kubeflow/pipelines/commit/be4723e33727c6dad71a95cba61e8f61562ab20f","source":"security-advisories@github.com"},{"url":"https://github.com/kubeflow/pipelines/pull/13684","source":"security-advisories@github.com"},{"url":"https://github.com/kubeflow/pipelines/releases/tag/2.18.0","source":"security-advisories@github.com"},{"url":"https://github.com/kubeflow/pipelines/security/advisories/GHSA-wg5q-x4j9-qm54","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-118760","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T17:18:06.770","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 0.5.1 until 2.17.0, the frontend artifact routes did not check whether an authenticated user was authorized to access the requested namespace. A user who can reach the frontend and knows an artifact location can select another tenant's namespace, or omit the namespace and reach an unguarded direct handler, to read artifact contents such as datasets, models, or pipeline outputs. The issue applies to multi-user deployments that rely on Kubeflow Pipelines authorization for tenant isolation. Authentication at ingress identifies the caller but does not authorize access to the selected artifact namespace. The issue does not establish arbitrary Kubernetes Secret disclosure, storage modification, or server-side code execution. This issue is fixed in version 2.17.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"kubeflow","product":"pipelines","versions":[{"version":"< 2.17.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/kubeflow/pipelines/commit/fb69119c997402ebddab4f6410c617cb3d3634ba","source":"security-advisories@github.com"},{"url":"https://github.com/kubeflow/pipelines/issues/9889","source":"security-advisories@github.com"},{"url":"https://github.com/kubeflow/pipelines/pull/12860","source":"security-advisories@github.com"},{"url":"https://github.com/kubeflow/pipelines/releases/tag/2.17.0","source":"security-advisories@github.com"},{"url":"https://github.com/kubeflow/pipelines/security/advisories/GHSA-vjhf-6c8f-qhwj","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-118761","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T17:18:06.907","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar archive can consume disproportionately large memory and exhaust API-server resources. Multipart pipeline and pipeline-version upload processing performs decompression before namespace authorization, so a reachable caller does not need a successful pipeline-create authorization decision. URL-import handlers authorize before fetching and decompressing a remote archive. The amount of expansion required to interrupt service depends on deployment resource limits and concurrent activity, and no specific archive is guaranteed to crash every deployment. This issue is fixed in version 2.18.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"kubeflow","product":"pipelines","versions":[{"version":"< 2.18.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T20:18:49.737846Z","id":"CVE-2026-118761","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-409"}]}],"references":[{"url":"https://github.com/kubeflow/pipelines/commit/1121d9a081fdf9e2107c39abb2cd8947727c6953","source":"security-advisories@github.com"},{"url":"https://github.com/kubeflow/pipelines/commit/ba9ae72cc860e3afbea232185e4132fc2896cac5","source":"security-advisories@github.com"},{"url":"https://github.com/kubeflow/pipelines/pull/14171","source":"security-advisories@github.com"},{"url":"https://github.com/kubeflow/pipelines/pull/14186","source":"security-advisories@github.com"},{"url":"https://github.com/kubeflow/pipelines/releases/tag/2.18.0","source":"security-advisories@github.com"},{"url":"https://github.com/kubeflow/pipelines/security/advisories/GHSA-8fmv-6rg5-5924","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-118762","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T17:18:07.070","lastModified":"2026-10-29T17:18:07.200","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/fix-formatting.yml workflow runs on pull_request_target with repository write permissions, checks out a fork pull request, installs dependencies from the fork's package.json, and invokes the fork-controlled oxfmt binary. Because actions/checkout persists the elevated GITHUB_TOKEN in Git configuration until after untrusted code executes, an external contributor whose pull request receives the format label can run arbitrary code, read or exfiltrate the token, and push repository content or modify pull requests and issues. The issue affects the repository CI workflow, not the Monkeytype application or user data. This issue is fixed in version 26.43.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"monkeytypegame","product":"monkeytype","versions":[{"version":"< 26.43.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.8}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-829"}]}],"references":[{"url":"https://github.com/monkeytypegame/monkeytype/commit/592ce1becb9b6824badc14a803bcd9268cbea382","source":"security-advisories@github.com"},{"url":"https://github.com/monkeytypegame/monkeytype/releases/tag/v26.43.0","source":"security-advisories@github.com"},{"url":"https://github.com/monkeytypegame/monkeytype/security/advisories/GHSA-47v3-j88w-92f8","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-118763","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T17:18:07.230","lastModified":"2026-10-30T19:39:14.897","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.2, packages/oci/src/registry.ts contains a RegistryClient.signIn() method that stores registry Authorization and Docker configuration headers as defaults on a shared HTTP client, while RegistryClient.uploadBlob() sends a fresh PUT to an absolute blob-upload Location supplied by the registry without checking that its origin or scheme matches the registry. A malicious or compromised registry can therefore direct a user pushing an artifact through attachArtifactToImage() to an attacker-controlled host and receive the registry bearer token, Basic credentials, or custom authentication headers. Redirect-time header stripping does not prevent the leak because the cross-host PUT is a new explicit request rather than a followed redirect. This is a residual of CVE-2026-59891, whose fix changed credential selection in credentials.ts but did not constrain where credentials are sent from registry.ts. Version 0.7.2 fixes the issue by separating registry credentials from client-wide defaults and sending them only to the registry origin."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"sigstore","product":"sigstore-js","versions":[{"version":"< 0.7.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T15:20:32.038162Z","id":"CVE-2026-118763","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-522"}]}],"references":[{"url":"https://github.com/sigstore/sigstore-js/commit/b855f46cfe81f26481c6d3f4b333dfd00f2fd1b1","source":"security-advisories@github.com"},{"url":"https://github.com/sigstore/sigstore-js/commit/e4ca65c3ab3c675456ab9b0bd04217ceccad3558","source":"security-advisories@github.com"},{"url":"https://github.com/sigstore/sigstore-js/pull/1762","source":"security-advisories@github.com"},{"url":"https://github.com/sigstore/sigstore-js/releases/tag/@sigstore/oci@0.7.2","source":"security-advisories@github.com"},{"url":"https://github.com/sigstore/sigstore-js/security/advisories/GHSA-j63v-mwhm-56jx","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-118764","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T17:18:07.380","lastModified":"2026-10-30T23:17:09.437","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"isaacs","product":"minimatch","versions":[{"version":"< 11.0.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-405"}]}],"references":[{"url":"https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","source":"security-advisories@github.com"},{"url":"https://github.com/isaacs/minimatch/releases/tag/v11.0.1","source":"security-advisories@github.com"},{"url":"https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-118765","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T17:18:07.523","lastModified":"2026-10-30T19:37:07.073","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Botan is a C++ cryptography library. From 3.7.0 until 3.13.0, an application that calls AutoSeeded_RNG::clear() and then calls randomize with an empty output buffer while the generator is unseeded can cause AutoSeeded_RNG to mark itself seeded without consulting the configured entropy source. On builds without BOTAN_HAS_SYSTEM_RNG, the fallback uses only a clock value and process ID, so a later non-empty request can produce output from predictable state. This issue is fixed in version 3.13.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"randombit","product":"botan","versions":[{"version":">= 3.7.0, < 3.13.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T20:19:42.210615Z","id":"CVE-2026-118765","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-335"}]}],"references":[{"url":"https://github.com/randombit/botan/commit/a7389222ace990604b6985add91ee06f55a80c0e","source":"security-advisories@github.com"},{"url":"https://github.com/randombit/botan/pull/5838","source":"security-advisories@github.com"},{"url":"https://github.com/randombit/botan/security/advisories/GHSA-95xx-xh9v-v9c4","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119115","sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","published":"2026-10-29T17:18:07.667","lastModified":"2026-10-30T17:07:53.700","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in the issuer resolution logic in AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 might allow an authenticated remote user to obtain certificates, including subordinate CA certificates, signed by a cluster-scoped AWS Private CA issuer that their approval policy does not authorize.\n\n\n\nTo remediate this issue, users should upgrade aws-privateca-issuer to version v1.10.1 or the AWS Private CA Connector for Kubernetes EKS add-on to version v1.10.1-eksbuild.1, and update any certificate requests, Certificate resources, or Ingress annotations whose issuerRef.kind is missing, incorrect, or does not match the referenced issuer, since v1.10.1 requires issuerRef.kind to be exactly AWSPCAIssuer or AWSPCAClusterIssuer and to match the issuer it references."}],"affected":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","affectedData":[{"vendor":"AWS","product":"aws-privateca-issuer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.10.1","versionType":"custom","status":"affected"}]},{"vendor":"AWS","product":"aws-privateca-issuer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.10.1-eksbuild.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.7}]},"weaknesses":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://aws.amazon.com/security/security-bulletins/2026-156-aws/","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"},{"url":"https://github.com/cert-manager/aws-privateca-issuer/releases/tag/v1.10.1","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"},{"url":"https://github.com/cert-manager/aws-privateca-issuer/security/advisories/GHSA-hjrh-q6pg-mh82","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}]}},{"cve":{"id":"CVE-2026-11587","sourceIdentifier":"bd4443e6-1eef-43f3-9886-25fc9ceeaae7","published":"2026-10-29T17:18:08.167","lastModified":"2026-10-30T19:39:14.897","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database"}],"affected":[{"source":"bd4443e6-1eef-43f3-9886-25fc9ceeaae7","affectedData":[{"vendor":"Centreon","product":"Centreon","defaultStatus":"unaffected","packageName":"Centreon Web 26.03.0 — Open-source IT monitoring platform (centreon/centreon on GitHub)","versions":[{"version":"25.10","lessThan":"centreon-web-25.10.15","versionType":"custom","status":"affected"},{"version":"24.10","lessThan":"centreon-web-24.10.28","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"bd4443e6-1eef-43f3-9886-25fc9ceeaae7","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:17:03.866596Z","id":"CVE-2026-11587","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"bd4443e6-1eef-43f3-9886-25fc9ceeaae7","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/centreon/centreon/releases","source":"bd4443e6-1eef-43f3-9886-25fc9ceeaae7"},{"url":"https://thewatch.centreon.comundefined","source":"bd4443e6-1eef-43f3-9886-25fc9ceeaae7"}]}},{"cve":{"id":"CVE-2026-62374","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T17:18:10.143","lastModified":"2026-10-30T19:39:14.897","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification. In version 0.19.0 and earlier, `@sd-jwt/decode`, also used by `@sd-jwt/core`, silently drops a tampered Disclosure whose digest no longer matches the Issuer-signed `_sd` array and returns a reduced claim set, reporting success while the Issuer signature remains valid. Both a tampered Disclosure that remains valid JSON and a Disclosure containing invalid UTF-8 bytes reach this silent-drop behavior. In the latter case, the `TextDecoder / Buffer` decoding path substitutes U+FFFD replacement characters, recovering syntactically valid disclosure data instead of rejecting the malformed input. This violates RFC 9901 section 7.1 step 5, which requires rejection of unreferenced Disclosures, and section 7.1 step 3 / section 4.2.1, which require rejection of invalid Disclosures. A malicious holder can exploit this omission primitive, including through `SDJwtInstance.verify()` when key binding is required. An on-path attacker can also tamper with a Disclosure when the relying party does not enforce key binding; enforced key binding rejects on-path tampering because it invalidates the KB-JWT `sd_hash` binding. If the relying party defaults to allowing access when a constraining age, role, or restriction claim is absent, the silent claim reduction can change an authorization decision without an error. This issue is fixed in `@sd-jwt/core` version 0.20.0; no patched version of the standalone `@sd-jwt/decode` package is identified."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"openwallet-foundation","product":"@sd-jwt/core","versions":[{"version":"<= 0.19.0","status":"affected"}]},{"vendor":"openwallet-foundation","product":"@sd-jwt/decode","versions":[{"version":"<= 0.19.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-176"},{"lang":"en","value":"CWE-754"}]}],"references":[{"url":"https://github.com/openwallet-foundation/sd-jwt-js/security/advisories/GHSA-f9j6-8p6x-r9j6","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-102260","sourceIdentifier":"security@hashicorp.com","published":"2026-10-29T18:17:21.160","lastModified":"2026-10-30T19:37:07.073","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API endpoints that may allow an authenticated user with read permissions in one namespace to view information about objects in other namespaces. This vulnerability (CVE-2026-102260) is fixed in Nomad Community Edition 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18."}],"affected":[{"source":"security@hashicorp.com","affectedData":[{"vendor":"HashiCorp","product":"Nomad","defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"repo":"https://github.com/hashicorp/nomad","versions":[{"version":"0.11.0","lessThan":"2.1.1","versionType":"semver","status":"affected"}]},{"vendor":"HashiCorp","product":"Nomad Enterprise","defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"repo":"https://github.com/hashicorp/nomad","versions":[{"version":"0.11.0","lessThan":"2.1.0","versionType":"semver","status":"affected","changes":[{"at":"1.11.12","status":"unaffected"},{"at":"1.10.18","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@hashicorp.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:18:32.035527Z","id":"CVE-2026-102260","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@hashicorp.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2026-51-nomad-vulnerable-to-cross-namespace-information-disclosure-in-multiple-endpoints/77929","source":"security@hashicorp.com"}]}},{"cve":{"id":"CVE-2026-107347","sourceIdentifier":"security@hashicorp.com","published":"2026-10-29T18:17:21.940","lastModified":"2026-10-30T19:37:07.073","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to modify files outside its allocation directory. When the client agent runs as root, this could lead to code execution as root on the client host. This vulnerability (CVE-2026-107347) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18."}],"affected":[{"source":"security@hashicorp.com","affectedData":[{"vendor":"HashiCorp","product":"Nomad","defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"repo":"https://github.com/hashicorp/nomad","versions":[{"version":"0.3.0","lessThan":"2.1.1","versionType":"semver","status":"affected"}]},{"vendor":"HashiCorp","product":"Nomad Enterprise","defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"repo":"https://github.com/hashicorp/nomad","versions":[{"version":"0.3.0","lessThan":"2.1.0","versionType":"semver","status":"affected","changes":[{"at":"1.11.12","status":"unaffected"},{"at":"1.10.18","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@hashicorp.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:19:03.266866Z","id":"CVE-2026-107347","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@hashicorp.com","type":"Secondary","description":[{"lang":"en","value":"CWE-59"}]}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2026-52-nomad-dispatch-payload-writes-can-escape-the-allocation-directory-through-symlinks/77930","source":"security@hashicorp.com"}]}},{"cve":{"id":"CVE-2026-116566","sourceIdentifier":"cna@python.org","published":"2026-10-29T18:17:24.667","lastModified":"2026-10-30T18:17:23.903","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated."}],"affected":[{"source":"cna@python.org","affectedData":[{"vendor":"Python Software Foundation","product":"CPython","defaultStatus":"unaffected","modules":["socket"],"repo":"https://github.com/python/cpython","versions":[{"version":"0","lessThan":"3.16.0","versionType":"python","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@python.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:18:00.445284Z","id":"CVE-2026-116566","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@python.org","type":"Secondary","description":[{"lang":"en","value":"CWE-158"}]}],"references":[{"url":"https://github.com/python/cpython/commit/131a3a66c5f400b588f9fd2732a5ed4e89623ee3","source":"cna@python.org"},{"url":"https://github.com/python/cpython/issues/160898","source":"cna@python.org"},{"url":"https://github.com/python/cpython/pull/160899","source":"cna@python.org"},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/HCHE62VYTPYI6WOPJQDWUBR4CINBPSM7/","source":"cna@python.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/29/4","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-118766","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T18:17:28.693","lastModified":"2026-10-30T19:37:07.073","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HTTP redirect while posting an OCSP request to the URI in a certificate's Authority Information Access extension. A malicious OCSP responder or an on-path attacker could redirect the client to make one blind request to an otherwise unreachable internal HTTP service. The primary impact is blind SSRF that might affect internal services with non-idempotent GET handlers, and response timing can provide a coarse internal-service oracle. This issue is fixed in version 3.13.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"randombit","product":"botan","versions":[{"version":"< 3.13.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.7}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/randombit/botan/commit/9791ca39a556c76186b1fc943c7d8d460712d58f","source":"security-advisories@github.com"},{"url":"https://github.com/randombit/botan/pull/5815","source":"security-advisories@github.com"},{"url":"https://github.com/randombit/botan/security/advisories/GHSA-9qgq-q9j4-4f82","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-118767","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T18:17:28.853","lastModified":"2026-10-30T19:37:07.073","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Botan is a C++ cryptography library. From 1.11.22 until 3.13.0, Botan's Python binding converted Python strings containing U+0000 to const char* values without consistently rejecting the embedded NUL, causing bcrypt and check_bcrypt to process only the prefix before the NUL. Applications could validate a longer password but hash a shorter effective value, allowing application password-policy bypass; scrypt and argon2 are unaffected. This issue is fixed in version 3.13.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"randombit","product":"botan","versions":[{"version":">= 1.11.22, < 3.13.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T15:20:33.590831Z","id":"CVE-2026-118767","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-158"}]}],"references":[{"url":"https://github.com/randombit/botan/commit/5a4ac737e72e18a08eca848049e3dd38571c73b4","source":"security-advisories@github.com"},{"url":"https://github.com/randombit/botan/pull/5814","source":"security-advisories@github.com"},{"url":"https://github.com/randombit/botan/security/advisories/GHSA-w8gj-5xrm-gvrp","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-118768","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T18:17:28.997","lastModified":"2026-10-30T19:37:07.073","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocsp_check command requested an OCSP response from a certificate's Authority Information Access URL without verifying the response signature or authorizing the signer. A malicious responder or on-path attacker could return a matching and timely GOOD response with an empty, invalid, or unauthorized signature, causing a revoked certificate to produce exit status 0 and OCSP check OK output. Only the command-line interface is affected. This issue is fixed in version 3.13.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"randombit","product":"botan","versions":[{"version":">= 1.11.34, < 3.13.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-347"}]}],"references":[{"url":"https://github.com/randombit/botan/commit/46b2a9ca59b0797184fbf7537495bda6e61a1983","source":"security-advisories@github.com"},{"url":"https://github.com/randombit/botan/pull/5825","source":"security-advisories@github.com"},{"url":"https://github.com/randombit/botan/security/advisories/GHSA-mpr7-9494-4qcw","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-118769","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T18:17:29.180","lastModified":"2026-10-30T19:37:07.073","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API function botan_block_cipher_block_size converted a size_t block size to int without a bounds check. In an application that accepts external algorithm parameter strings and uses the FFI raw ECB mode, an attacker can select the variable-block-size Lion cipher so that the reported size is truncated, the caller allocates insufficient memory, and later block processing causes memory corruption. The C++ API and normally used C API modes such as CBC and CTR are unaffected. This issue is fixed in version 3.13.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"randombit","product":"botan","versions":[{"version":">= 2.1.0, < 3.13.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T20:20:31.067238Z","id":"CVE-2026-118769","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"},{"lang":"en","value":"CWE-681"},{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/randombit/botan/commit/c6089ab7fab616517d56c447c93e13a5c57a0af3","source":"security-advisories@github.com"},{"url":"https://github.com/randombit/botan/pull/5805","source":"security-advisories@github.com"},{"url":"https://github.com/randombit/botan/security/advisories/GHSA-c68p-822g-jfvr","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-51851","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T18:17:32.153","lastModified":"2026-10-30T19:39:14.897","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"modelscope agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_text_file. The save_text_file method accepts user-controlled file paths without normalization or validation, allowing path traversal attacks."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://gist.github.com/Ro1ME/a1bbf47465175e279a72121cd0df298b","source":"cve@mitre.org"},{"url":"https://github.com/agent0ai/agent-zero/issues/1541","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-51863","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T18:17:32.293","lastModified":"2026-10-30T19:39:14.897","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"DB-GPT v0.7.5 and 0.8.0 contains directory traversal in use_example_file (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/examples_api.py:129). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://gist.github.com/Ro1ME/8be4e1bad6c9d7a777ec7638b1192dee","source":"cve@mitre.org"},{"url":"https://github.com/eosphoros-ai/DB-GPT/issues/3028","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-51902","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T18:17:32.417","lastModified":"2026-10-30T19:39:14.897","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SuperAGI up to v0.0.14 contains an improper access control vulnerability. The agent controller endpoint /api/agents/get/project/{project_id} allows authenticated users from one organization to retrieve the complete list of agents belonging to a different organization's project. The endpoint accepts a project_id parameter but does not verify that the project belongs to the authenticated user's organization."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://gist.github.com/Ro1ME/68d7dfa6ecc41caa9945a02dd31156ca","source":"cve@mitre.org"},{"url":"https://github.com/TransformerOptimus/SuperAGI/issues/1558","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-51903","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T18:17:32.547","lastModified":"2026-10-30T19:39:14.897","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SuperAGI v0.0.14 contains an improper access control vulnerability in get_agent_by_latest_execution in superagi/controllers/agent_execution.py. A remote authenticated attacker from one organization can retrieve latest execution and agent metadata for another organization's project through /agentexecutions/get/latest/agent/project/{project_id} by supplying a victim project_id."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://gist.github.com/Ro1ME/d5e2ff57f9ed891bac0d401c0a7e9aae","source":"cve@mitre.org"},{"url":"https://github.com/TransformerOptimus/SuperAGI","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-51905","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T18:17:32.660","lastModified":"2026-10-30T19:39:14.897","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in get_agent_execution_configuration in superagi/controllers/agent_execution_config.py. A remote authenticated attacker from one organization can read another organization's agent execution configuration by supplying the victim agent_id and agent_execution_id to /agent_executions_configs/details/agent_id/{agent_id}/agent_execution_id/{agent_execution_id}. The endpoint lacks an organization ownership check on the selected agent and execution."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T16:51:02.781918Z","id":"CVE-2026-51905","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://gist.github.com/Ro1ME/f803bb0db782428b212492c8157290db","source":"cve@mitre.org"},{"url":"https://github.com/TransformerOptimus/SuperAGI/issues/1559","source":"cve@mitre.org"},{"url":"https://github.com/TransformerOptimus/SuperAGI/issues/1559","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-51912","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T18:17:32.783","lastModified":"2026-10-30T19:39:14.897","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenBMB XAgent v1.0.0 contains directory traversal vulnerability in main-upload_file-the-preserved-live-upload-file-witness-directly-reaches (ToolServer/ToolServerNode/main.py:46)."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://gist.github.com/Ro1ME/9999d9e504c5238dc48a023ef7c51d01","source":"cve@mitre.org"},{"url":"https://github.com/OpenBMB/XAgent","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-60111","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T18:17:33.777","lastModified":"2026-10-29T18:17:33.777","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-103093","sourceIdentifier":"psirt@servicenow.com","published":"2026-10-29T19:17:15.113","lastModified":"2026-10-30T17:44:35.820","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This vulnerability could enable an authenticated user with the admin role to bypass Rhino sandbox restrictions and execute arbitrary code on the underlying host operating system, potentially enabling further unintended access. \n\n\n\nServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so."}],"affected":[{"source":"psirt@servicenow.com","affectedData":[{"vendor":"ServiceNow","product":"ServiceNow AI Platform","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"Yokohama Patch 13 Hot Fix 4a","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 10 Hot Fix 3b","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 12","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 13","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@servicenow.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T20:36:35.492953Z","id":"CVE-2026-103093","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@servicenow.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3228994","source":"psirt@servicenow.com"}]}},{"cve":{"id":"CVE-2026-103094","sourceIdentifier":"psirt@servicenow.com","published":"2026-10-29T19:17:15.267","lastModified":"2026-10-30T17:44:35.820","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ServiceNow has remediated an information disclosure vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could cause a user's plaintext password to be persisted in a system table, potentially exposing that password to a user who otherwise would not be entitled to view it.\n\n\n\n\n\nServiceNow remediated the vulnerability through security updates that address the unintended persistence of plaintext credentials. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so."}],"affected":[{"source":"psirt@servicenow.com","affectedData":[{"vendor":"ServiceNow","product":"ServiceNow AI Platform","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"Xanadu Patch 11 Hot Fix 7a","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Yokohama Patch 13 Hot Fix 4a","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 10 Hot Fix 3a","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 11 Hot Fix 1","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 11m (m-branch)","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 12","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 13","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 2 Hot Fix 3b","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 4 Hot Fix 1","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 4m (m-branch)","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@servicenow.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T20:38:13.797280Z","id":"CVE-2026-103094","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-256"}]}],"references":[{"url":"https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3228994","source":"psirt@servicenow.com"}]}},{"cve":{"id":"CVE-2026-118772","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T19:17:19.563","lastModified":"2026-10-30T19:37:07.073","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace run that contains no separator, causing quadratic work during String.prototype.split. The behavior applies to the default separator and every custom separator. Applications that validate attacker-controlled values with the multiple option and no effective prior length limit can have the Node.js event loop blocked for seconds by one request, preventing other work. A .max() rule is not sufficient when abortEarly: false allows the email rule to run after the maximum-length check fails. This vulnerability is fixed in versions 17.13.9 and 18.3.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"hapijs","product":"joi","versions":[{"version":">= 16.0.0, <= 17.1.1","status":"affected"},{"version":">= 18.0.0, < 18.3.1","status":"affected"}]},{"vendor":"@hapi","product":"joi","versions":[{"version":">= 16.0.0, <= 17.1.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-1333"}]}],"references":[{"url":"https://github.com/hapijs/joi/commit/03dc1d909818503b06240dadc81e9227ed2649cf","source":"security-advisories@github.com"},{"url":"https://github.com/hapijs/joi/commit/807858d7480f5075b0610817e3e44230890fb18e","source":"security-advisories@github.com"},{"url":"https://github.com/hapijs/joi/pull/3162","source":"security-advisories@github.com"},{"url":"https://github.com/hapijs/joi/pull/3163","source":"security-advisories@github.com"},{"url":"https://github.com/hapijs/joi/releases/tag/v17.13.9","source":"security-advisories@github.com"},{"url":"https://github.com/hapijs/joi/releases/tag/v18.3.1","source":"security-advisories@github.com"},{"url":"https://github.com/hapijs/joi/security/advisories/GHSA-4528-x5fx-h6hg","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-118773","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T19:17:19.720","lastModified":"2026-10-30T19:37:07.073","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync(), invoke the callbacks without returning. After AbortSignal or AbortSignal.timeout() rejects or emits an error, execution can continue into processor.processPatterns(), readdirCB(), and recursive traversal. The issue affects glob() and globStream() when applications expose attacker-influenced patterns or directory trees and rely on cancellation as a traversal budget. Repeated timed-out requests can stack background filesystem operations and CPU work, degrading worker throughput or service availability; no confidentiality or integrity impact was observed. This issue is fixed in 14.0.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"isaacs","product":"node-glob","versions":[{"version":">= 9.0.0, < 14.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T15:20:35.333742Z","id":"CVE-2026-118773","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://github.com/isaacs/node-glob/commit/4682e8c9babee1b385202ede36389634e12076d7","source":"security-advisories@github.com"},{"url":"https://github.com/isaacs/node-glob/releases/tag/v14.0.2","source":"security-advisories@github.com"},{"url":"https://github.com/isaacs/node-glob/security/advisories/GHSA-3g3m-2fjr-6pw4","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-118774","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T19:17:19.863","lastModified":"2026-10-30T17:07:53.700","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used certificate.verify(child), _verifySignature(), lib/x509.js to process the relevant input or security decision. node-forge selected RSA padding and RSASSA-PSS parameters from the issuer certificate rather than the child certificate being verified. A child labeled as RSASSA-PSS could therefore be accepted with a PKCS#1 v1.5 signature when the issuer used PKCS#1 v1.5. The signature still had to be produced with the trusted issuer's private key, so this did not permit certificate identity forgery, but it could bypass policies that require a declared signature scheme. This issue is fixed in version 1.4.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"digitalbazaar","product":"forge","versions":[{"version":"< 1.4.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-347"}]}],"references":[{"url":"https://github.com/digitalbazaar/forge/commit/c7f42614d5166a77ddf11ce174b2601b14f6956b","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-9wg5-mj3p-v49q","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-118775","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T19:17:20.007","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer() in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked or authorized that string, and then encoded it with asn1.oidToDer() could emit DER representing a different, trusted OID from the one that was checked. DER parsing is not affected. This issue is fixed in version 1.4.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"digitalbazaar","product":"forge","versions":[{"version":"< 1.4.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T20:21:35.966507Z","id":"CVE-2026-118775","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"references":[{"url":"https://github.com/digitalbazaar/forge/commit/e56a3dde8e4e63bae566bb32546eeaf92f515e1e","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-4642-5mcj-2rqw","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-4642-5mcj-2rqw","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-118776","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T19:17:20.147","lastModified":"2026-10-30T17:07:53.700","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish(), CBC and ECB modes, PKCS#7 padding to process the relevant input or security decision. node-forge validated only the final byte of PKCS#7 padding during CBC and ECB decryption and accepted zero, oversized, or mismatched padding bytes. Malformed ciphertext could consequently be accepted and up to four plaintext blocks could be silently removed, causing an integrity failure in applications that treated successful decryption as proof of valid padding. This issue is fixed in version 1.4.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"digitalbazaar","product":"forge","versions":[{"version":"< 1.4.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-354"}]}],"references":[{"url":"https://github.com/digitalbazaar/forge/commit/81774ff99e2da64aec9a43591df45a360040c136","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-2vgq-wchc-25w7","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-118777","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T19:17:20.283","lastModified":"2026-10-30T17:17:16.110","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the forge.http client stored cookie names and paths from Set-Cookie response headers in ordinary JavaScript objects. A malicious server could use the cookie name __proto__ so that the attacker-controlled cookie path was written as a property on Object.prototype, or use inherited names such as constructor to modify Object. An empty cookie value could use the removal path to delete an inherited Object.prototype property. Applications using forge.http directly or through forge.xhr are affected; applications that do not use forge.http are unaffected. This issue is fixed in version 1.4.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"digitalbazaar","product":"forge","versions":[{"version":"< 1.4.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T15:20:36.875932Z","id":"CVE-2026-118777","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1321"}]}],"references":[{"url":"https://github.com/digitalbazaar/forge/commit/797c3f816a22748a96fceebb34eb3a6716853991","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-6wvx-3r32-xmcg","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-118778","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T19:17:20.420","lastModified":"2026-10-30T17:07:53.700","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), c.session.serverCertificate, RSA key exchange to process the relevant input or security decision. node-forge's TLS client checked the wrong property when deciding whether a server certificate was missing. A malicious TLS server or on-path peer could omit the Certificate message and reach code that dereferenced the absent certificate, causing an uncaught exception and terminating the connection or process. This issue is fixed in version 1.4.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"digitalbazaar","product":"forge","versions":[{"version":"< 1.4.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-476"}]}],"references":[{"url":"https://github.com/digitalbazaar/forge/commit/7be9fbd40df2e2f15f29fea2846b1c87d58f6888","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-525v-9gp9-w22h","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-118779","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T19:17:20.560","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode(), lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in pem.decode(), including when searching for a matching END line and parsing encapsulated headers. An unauthenticated attacker able to supply PEM input to any high-level parser could consume excessive CPU with a long malformed message and cause denial of service. This issue is fixed in version 1.4.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"digitalbazaar","product":"forge","versions":[{"version":"< 1.4.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T20:22:46.362205Z","id":"CVE-2026-118779","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-1333"}]}],"references":[{"url":"https://github.com/digitalbazaar/forge/commit/412345db583cd28a9d23636d0d93e9f751b935f3","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-7wch-p9px-956x","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-7wch-p9px-956x","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-118780","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T19:17:20.703","lastModified":"2026-10-30T17:07:53.700","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pki.verifyCertificateChain(), pki.createCaStore(), duplicate subject names to process the relevant input or security decision. node-forge modified the CA store while trying certificates that shared a subject name during pki.verifyCertificateChain(). A failed chain verification could permanently remove trusted CA certificates from the store, causing later valid chains to fail and creating a persistent availability impact for applications that reused the store. This issue is fixed in version 1.4.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"digitalbazaar","product":"forge","versions":[{"version":"< 1.4.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":1.4}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-295"},{"lang":"en","value":"CWE-471"}]}],"references":[{"url":"https://github.com/digitalbazaar/forge/commit/f6555609bd30f442fbfacd543155928ceccf98d0","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-4487-j8r4-4g2f","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-118781","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T19:17:20.843","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used BigInteger.prototype.modInverse(), bnModInverse(), lib/jsbn.js, RSA public exponent e to process the relevant input or security decision. node-forge's bundled jsbn implementation entered an infinite loop when BigInteger.prototype.modInverse() received a negative value or modulus. An attacker who could control the RSA public exponent passed to key generation, or a direct modInverse() operand, could block the Node.js event loop at full CPU. Parsed DER, PEM, JWK, PKCS#12, X.509, and TLS values are unsigned and cannot trigger this issue. This issue is fixed in version 1.4.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"digitalbazaar","product":"forge","versions":[{"version":"< 1.4.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":2.9,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.4,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T15:20:38.496495Z","id":"CVE-2026-118781","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-835"}]}],"references":[{"url":"https://github.com/digitalbazaar/forge/commit/e96c47b7f006dec66fb7bb1934e7375498b04a72","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-h6cr-wjv9-3cpp","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-118782","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T19:17:20.983","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge accepted a PKCS#12 MAC or PKCS#12 password-based encryption iteration count of zero or less. pki.pbe.generatePkcs12Key() then returned a constant key independent of the password and salt, allowing crafted PKCS#12 input processed by forge.pkcs12.pkcs12FromAsn1() to bypass password-based integrity checks. Predictable encryption keys and IVs also affected PKCS#12 PBE using pbeWithSHAAnd3-KeyTripleDES-CBC or pbewithSHAAnd40BitRC2-CBC, including shrouded key bags, encrypted SafeContents, and PKCS#8 ENCRYPTED PRIVATE KEY input processed independently by forge.pki.decryptPrivateKeyInfo(). PBES2/PBKDF2-encrypted content is unaffected. This issue is fixed in version 1.4.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"digitalbazaar","product":"forge","versions":[{"version":"< 1.4.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-354"},{"lang":"en","value":"CWE-1284"}]}],"references":[{"url":"https://github.com/digitalbazaar/forge/commit/d9584aa56824972858366d5187b3d29e46bf3656","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-jc66-7q78-782g","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119168","sourceIdentifier":"security@hashicorp.com","published":"2026-10-29T19:17:21.120","lastModified":"2026-10-30T19:37:07.073","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host files, potentially leading to privilege escalation. This vulnerability (CVE-2026-119168) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18."}],"affected":[{"source":"security@hashicorp.com","affectedData":[{"vendor":"HashiCorp","product":"Nomad","defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"repo":"https://github.com/hashicorp/nomad","versions":[{"version":"0.5.3","lessThan":"2.1.1","versionType":"semver","status":"affected"}]},{"vendor":"HashiCorp","product":"Nomad Enterprise","defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"repo":"https://github.com/hashicorp/nomad","versions":[{"version":"0.5.3","lessThan":"2.1.0","versionType":"semver","status":"affected","changes":[{"at":"1.11.12","status":"unaffected"},{"at":"1.10.18","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@hashicorp.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:19:36.166956Z","id":"CVE-2026-119168","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@hashicorp.com","type":"Secondary","description":[{"lang":"en","value":"CWE-59"}]}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2026-53-nomad-allocation-data-migration-may-allow-host-directory-permission-modification-via-symlink-following/77931","source":"security@hashicorp.com"}]}},{"cve":{"id":"CVE-2026-119249","sourceIdentifier":"fe490ce8-0395-4072-90d8-2707e1bdf984","published":"2026-10-29T19:17:21.237","lastModified":"2026-10-30T17:44:35.820","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop for macOS to obtain information about the host device."}],"affected":[{"source":"fe490ce8-0395-4072-90d8-2707e1bdf984","affectedData":[{"vendor":"Ubiquiti Inc","product":"WiFiman Desktop for macOS","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.3.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"fe490ce8-0395-4072-90d8-2707e1bdf984","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T20:40:36.381065Z","id":"CVE-2026-119249","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"fe490ce8-0395-4072-90d8-2707e1bdf984","type":"Secondary","description":[{"lang":"en","value":"CWE-1327"}]}],"references":[{"url":"https://community.ui.com/releases/Security-Advisory-Bulletin-072/351a6d54-3ef7-49b4-ac99-b3a5388a9808","source":"fe490ce8-0395-4072-90d8-2707e1bdf984"}]}},{"cve":{"id":"CVE-2026-119250","sourceIdentifier":"fe490ce8-0395-4072-90d8-2707e1bdf984","published":"2026-10-29T19:17:21.363","lastModified":"2026-10-30T17:44:35.820","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop for macOS to execute arbitrary commands with root privileges on the host device."}],"affected":[{"source":"fe490ce8-0395-4072-90d8-2707e1bdf984","affectedData":[{"vendor":"Ubiquiti Inc","product":"WiFiman Desktop for macOS","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.3.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"fe490ce8-0395-4072-90d8-2707e1bdf984","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T20:40:06.398548Z","id":"CVE-2026-119250","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"fe490ce8-0395-4072-90d8-2707e1bdf984","type":"Secondary","description":[{"lang":"en","value":"CWE-73"}]}],"references":[{"url":"https://community.ui.com/releases/Security-Advisory-Bulletin-072/351a6d54-3ef7-49b4-ac99-b3a5388a9808","source":"fe490ce8-0395-4072-90d8-2707e1bdf984"}]}},{"cve":{"id":"CVE-2026-119251","sourceIdentifier":"fe490ce8-0395-4072-90d8-2707e1bdf984","published":"2026-10-29T19:17:21.480","lastModified":"2026-10-30T17:44:35.820","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in WiFiman Desktop for macOS to escalate privileges on the host device."}],"affected":[{"source":"fe490ce8-0395-4072-90d8-2707e1bdf984","affectedData":[{"vendor":"Ubiquiti Inc","product":"WiFiman Desktop for macOS","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.3.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"fe490ce8-0395-4072-90d8-2707e1bdf984","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T20:39:27.106841Z","id":"CVE-2026-119251","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"fe490ce8-0395-4072-90d8-2707e1bdf984","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://community.ui.com/releases/Security-Advisory-Bulletin-072/351a6d54-3ef7-49b4-ac99-b3a5388a9808","source":"fe490ce8-0395-4072-90d8-2707e1bdf984"}]}},{"cve":{"id":"CVE-2026-41216","sourceIdentifier":"talos-cna@cisco.com","published":"2026-10-29T19:17:21.710","lastModified":"2026-10-30T18:17:30.177","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An invalid pointer dereference vulnerability exists in the vtkPNGReader::ExecuteInformation functionality of vtk 9.6. A specially crafted .png file can lead to a denial of service. An attacker can provide a malicious file to trigger this vulnerability."}],"affected":[{"source":"talos-cna@cisco.com","affectedData":[{"vendor":"vtk","product":"vtk","defaultStatus":"unaffected","versions":[{"version":"9.6","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"talos-cna@cisco.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:22:29.322889Z","id":"CVE-2026-41216","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"talos-cna@cisco.com","type":"Secondary","description":[{"lang":"en","value":"CWE-825"}]}],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2412","source":"talos-cna@cisco.com"},{"url":"https://vtk.org/download/","source":"talos-cna@cisco.com"}]}},{"cve":{"id":"CVE-2026-42057","sourceIdentifier":"talos-cna@cisco.com","published":"2026-10-29T19:17:21.837","lastModified":"2026-10-30T18:17:30.293","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2 functionality of vtk 9.6. A specially crafted .png file can lead to a denial of service. An attacker can provide a malicious file to trigger this vulnerability."}],"affected":[{"source":"talos-cna@cisco.com","affectedData":[{"vendor":"vtk","product":"vtk","defaultStatus":"unaffected","versions":[{"version":"9.6","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"talos-cna@cisco.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:22:02.474070Z","id":"CVE-2026-42057","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"talos-cna@cisco.com","type":"Secondary","description":[{"lang":"en","value":"CWE-825"}]}],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2413","source":"talos-cna@cisco.com"},{"url":"https://vtk.org/download/","source":"talos-cna@cisco.com"}]}},{"cve":{"id":"CVE-2026-58118","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T19:17:23.787","lastModified":"2026-10-29T19:17:23.787","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-58119","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T19:17:23.863","lastModified":"2026-10-29T19:17:23.863","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-58120","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T19:17:23.920","lastModified":"2026-10-29T19:17:23.920","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-6877","sourceIdentifier":"psirt@servicenow.com","published":"2026-10-29T19:17:26.647","lastModified":"2026-10-30T17:44:35.820","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ServiceNow has addressed a domain separation bypass security issue that was identified in the ServiceNow SR – CSM – Task Plan Templates Store application. This vulnerability could enable an authenticated user with a specific role to create records in domains they do not have access to, potentially leading to unauthorized data creation across domain boundaries. \n\nWe are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so."}],"affected":[{"source":"psirt@servicenow.com","affectedData":[{"vendor":"ServiceNow","product":"ServiceNow AI Platform","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"SR - CSM - Task Plan Templates v3.0 (Task Plan Templates application)","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@servicenow.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T20:37:20.210737Z","id":"CVE-2026-6877","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@servicenow.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3228994","source":"psirt@servicenow.com"}]}},{"cve":{"id":"CVE-2026-8822","sourceIdentifier":"talos-cna@cisco.com","published":"2026-10-29T19:17:28.173","lastModified":"2026-10-30T18:18:16.343","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A memory corruption vulnerability exists in the vtkDEMReader ReadProfiles functionality of vtk (version(s): 9.6.1). A specially crafted USGS DEM can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vulnerability."}],"affected":[{"source":"talos-cna@cisco.com","affectedData":[{"vendor":"vtk","product":"vtk","defaultStatus":"unaffected","versions":[{"version":"9.6.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"talos-cna@cisco.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:21:38.231085Z","id":"CVE-2026-8822","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"talos-cna@cisco.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2421","source":"talos-cna@cisco.com"},{"url":"https://vtk.org/download/","source":"talos-cna@cisco.com"}]}},{"cve":{"id":"CVE-2026-8824","sourceIdentifier":"talos-cna@cisco.com","published":"2026-10-29T19:17:28.330","lastModified":"2026-10-30T18:18:16.467","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInformation functionality of vtk (version(s): 9.6.1). A specially crafted .bmp file can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vulnerability."}],"affected":[{"source":"talos-cna@cisco.com","affectedData":[{"vendor":"vtk","product":"vtk","defaultStatus":"unaffected","versions":[{"version":"9.6.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"talos-cna@cisco.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:20:59.605485Z","id":"CVE-2026-8824","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"talos-cna@cisco.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2422","source":"talos-cna@cisco.com"},{"url":"https://vtk.org/download/","source":"talos-cna@cisco.com"}]}},{"cve":{"id":"CVE-2026-9535","sourceIdentifier":"talos-cna@cisco.com","published":"2026-10-29T19:17:29.923","lastModified":"2026-10-30T18:18:21.757","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk (version(s): 9.6.1). A specially crafted chaco can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability."}],"affected":[{"source":"talos-cna@cisco.com","affectedData":[{"vendor":"vtk","product":"vtk","defaultStatus":"unaffected","versions":[{"version":"9.6.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"talos-cna@cisco.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:20:34.812139Z","id":"CVE-2026-9535","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"talos-cna@cisco.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2423","source":"talos-cna@cisco.com"},{"url":"https://vtk.org/download/","source":"talos-cna@cisco.com"}]}},{"cve":{"id":"CVE-2026-9536","sourceIdentifier":"talos-cna@cisco.com","published":"2026-10-29T19:17:30.047","lastModified":"2026-10-30T18:18:21.873","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk (version(s): 9.6.1). A specially crafted .wind can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vulnerability."}],"affected":[{"source":"talos-cna@cisco.com","affectedData":[{"vendor":"vtk","product":"vtk","defaultStatus":"unaffected","versions":[{"version":"9.6.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"talos-cna@cisco.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:20:09.854200Z","id":"CVE-2026-9536","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"talos-cna@cisco.com","type":"Secondary","description":[{"lang":"en","value":"CWE-122"}]}],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2424","source":"talos-cna@cisco.com"},{"url":"https://vtk.org/download/","source":"talos-cna@cisco.com"}]}},{"cve":{"id":"CVE-2026-119186","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T20:17:29.500","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start() during decryption through forge.cipher.createDecipher(). When an application derived tagLength from received data or used an unset or zero-like configuration value, a value that converted to zero together with an empty or missing authentication tag caused the calculated and supplied tags to compare as empty, so decipher.finish() accepted unauthenticated ciphertext. Applications that omit tagLength to use the 128-bit default or pass a fixed valid tag length are unaffected. This issue is fixed in version 1.4.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"digitalbazaar","product":"forge","versions":[{"version":"< 1.4.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T20:23:41.622079Z","id":"CVE-2026-119186","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-354"},{"lang":"en","value":"CWE-1284"}]}],"references":[{"url":"https://github.com/digitalbazaar/forge/commit/236845d96c71207259f91638d0138bba8e2fd624","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-5cwg-6vw7-rj6p","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-5cwg-6vw7-rj6p","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-119187","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T20:17:29.647","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), TLS record processing, process() to process the relevant input or security decision. node-forge processed received TLS records recursively, consuming one JavaScript stack frame per record in a single input chunk. A remote peer could send thousands of small records together and exhaust the call stack, causing an uncaught exception and denial of service. This issue is fixed in version 1.4.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"digitalbazaar","product":"forge","versions":[{"version":"< 1.4.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-674"}]}],"references":[{"url":"https://github.com/digitalbazaar/forge/commit/817e2ce0d0f6d8a25bc9c2670615c38a9ffdc51c","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-hqq3-7jhf-c5jx","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119188","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T20:17:29.783","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), fragmented handshake message, interleaved record to process the relevant input or security decision. node-forge continued processing after a TLS record of another content type interrupted a fragmented handshake message. A remote peer could trigger an uncaught TypeError in process(), causing the connection or hosting process to fail. This issue is fixed in version 1.4.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"digitalbazaar","product":"forge","versions":[{"version":"< 1.4.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T15:47:07.746474Z","id":"CVE-2026-119188","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-248"},{"lang":"en","value":"CWE-476"}]}],"references":[{"url":"https://github.com/digitalbazaar/forge/commit/700d977d39f9f8f896c55b0763eebb940a2c087e","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-8hrf-8g6f-7xwp","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119189","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T20:17:29.923","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when that certificate also carried a keyUsage extension. Exploitation requires a path-length-constrained CA without keyUsage that chains to a root trusted by the application, and an attacker who holds that CA's private key or obtains a subordinate CA certificate from it. The attacker could then construct a chain exceeding the declared path length that still passed pki.verifyCertificateChain(). Public web PKI CA certificates normally include keyUsage; private PKIs with CA certificates created without it are more likely to be affected. This issue is fixed in version 1.4.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"digitalbazaar","product":"forge","versions":[{"version":"< 1.4.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-295"}]}],"references":[{"url":"https://github.com/digitalbazaar/forge/commit/696db92348623e88cc63c35f0a89ede481d55ad0","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-h46v-rmh6-fq4f","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119190","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T20:17:30.067","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain() used the first extension with that name. Exploitation requires a CA trusted by the application to issue a certificate carrying an attacker-supplied deprecated-OID extension, commonly because the CA copies extensions from a certificate signing request. By placing a permissive deprecated extension before the genuine 2.5.29.19 basicConstraints extension, the certificate holder could have the certificate accepted as a CA and issue certificates for arbitrary names, enabling server or client impersonation. If the issuing CA adds a keyUsage extension without keyCertSign, node-forge rejects the chain. This issue is fixed in version 1.4.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"digitalbazaar","product":"forge","versions":[{"version":"< 1.4.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T20:24:38.825329Z","id":"CVE-2026-119190","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-295"},{"lang":"en","value":"CWE-436"}]}],"references":[{"url":"https://github.com/digitalbazaar/forge/commit/58c06bc251856b409c30ecb35a93f5f6c9bbc84a","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-5x38-2vff-x55p","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-5x38-2vff-x55p","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-119191","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T20:17:30.197","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security decision. node-forge decoded ASN.1 stored inside BIT STRING values without consistently applying the configured maxDepth limit and recursively retained copies at each nesting level. Crafted DER containing nested BIT STRINGs could cause excessive recursion, CPU use, and quadratic memory consumption during asn1.fromDer(). This issue is fixed in version 1.4.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"digitalbazaar","product":"forge","versions":[{"version":"< 1.4.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-674"}]}],"references":[{"url":"https://github.com/digitalbazaar/forge/commit/24035c181f41885ea3ec7279e6c0fcf270b6ec4b","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/commit/523c8e74c28457daeff044230dce4a36313c5ab7","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","source":"security-advisories@github.com"},{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-rhr8-3pm8-cq29","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119193","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T20:17:30.340","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"PHPUnit is a testing framework for PHP. From 13.4.0 until 13.4.4, the TestCase::coverageFilesDirectory() logic in src/Runner/Phpt/TestCase.php creates temporary files for PHPT code coverage in a predictable phpunit-phpt directory under sys_get_temp_dir() and reuses that directory without verifying its ownership or permissions. On multi-user systems with a shared temporary path, a local attacker who creates the directory before the developer runs PHPT tests with code coverage can replace the generated job file before the child process executes it with require, allowing arbitrary code execution with the developer's privileges while the test and coverage report appear successful. PHPUnit 12.5 and earlier, default macOS and Windows configurations with per-user temporary directories, and single-user environments where another user cannot create files in the temporary path are not affected. This issue is fixed in 13.4.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"sebastianbergmann","product":"phpunit","versions":[{"version":">= 13.4.0, < 13.4.4","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T15:34:44.219252Z","id":"CVE-2026-119193","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-379"}]}],"references":[{"url":"https://github.com/sebastianbergmann/phpunit/commit/ae31c78a86e9d6c641497bacf47462d7bb7d7f34","source":"security-advisories@github.com"},{"url":"https://github.com/sebastianbergmann/phpunit/releases/tag/13.4.4","source":"security-advisories@github.com"},{"url":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-9vw2-f4vp-x7gf","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119194","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T20:17:30.480","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of earlier colliding tags in ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing quadratic CPU work while decoded values and order remain valid. Repeated inputs can exhaust decoder CPU and reduce service availability. This issue is fixed in version 0.6.5."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"pyasn1","product":"pyasn1","versions":[{"version":">= 0.3.3, < 0.6.5","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-407"}]}],"references":[{"url":"https://github.com/pyasn1/pyasn1/commit/a36e3a3d067148d26197a6b7221fd0e2cde9cc86","source":"security-advisories@github.com"},{"url":"https://github.com/pyasn1/pyasn1/pull/132","source":"security-advisories@github.com"},{"url":"https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5","source":"security-advisories@github.com"},{"url":"https://github.com/pyasn1/pyasn1/security/advisories/GHSA-fm9c-5rcf-2q5p","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119195","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T20:17:30.633","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET STRING without a schema, but accepts its definite-length form when asn1Spec selects univ.OctetString; it also accepts constructed character strings such as UTF8String without a schema, even though those encodings are not valid DER. The separate indefinite-length ANY path is reachable in BER and CER when asn1Spec selects univ.Any; DER rejects indefinite lengths. OctetStringPayloadDecoder uses growing header concatenation and AnyPayloadDecoder.indefLenValueDecoder uses growing chunk concatenation, repeatedly copying an increasing prefix and causing quadratic work. A sufficiently fragmented value can occupy decoding workers and cause CPU exhaustion without confidentiality or integrity impact. This issue is fixed in version 0.6.5."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"pyasn1","product":"pyasn1","versions":[{"version":"< 0.6.5","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T20:25:48.864403Z","id":"CVE-2026-119195","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-407"}]}],"references":[{"url":"https://github.com/pyasn1/pyasn1/commit/4ce00797c594b59c1fd6b86d9ebc3ba87b7ec9f9","source":"security-advisories@github.com"},{"url":"https://github.com/pyasn1/pyasn1/pull/132","source":"security-advisories@github.com"},{"url":"https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5","source":"security-advisories@github.com"},{"url":"https://github.com/pyasn1/pyasn1/security/advisories/GHSA-9m75-vc3g-4x39","source":"security-advisories@github.com"},{"url":"https://github.com/pyasn1/pyasn1/security/advisories/GHSA-9m75-vc3g-4x39","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-119196","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T20:17:30.770","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"pyasn1","product":"pyasn1","versions":[{"version":"< 0.6.5","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-407"}]}],"references":[{"url":"https://github.com/pyasn1/pyasn1/commit/73ba7b043cc7e92cb37f16f2c955bff93b0e6f6c","source":"security-advisories@github.com"},{"url":"https://github.com/pyasn1/pyasn1/pull/132","source":"security-advisories@github.com"},{"url":"https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5","source":"security-advisories@github.com"},{"url":"https://github.com/pyasn1/pyasn1/security/advisories/GHSA-2qm8-x737-gmw5","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119197","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T20:17:30.907","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in mantissa length. A comparatively small REAL value can hold a decoding worker on one CPU core for seconds or longer and cause availability loss. This issue is fixed in version 0.6.5."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"pyasn1","product":"pyasn1","versions":[{"version":"< 0.6.5","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T15:47:11.257992Z","id":"CVE-2026-119197","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-407"}]}],"references":[{"url":"https://github.com/pyasn1/pyasn1/commit/ce3ec3390784780a530047e0e77be5ff457636a4","source":"security-advisories@github.com"},{"url":"https://github.com/pyasn1/pyasn1/pull/132","source":"security-advisories@github.com"},{"url":"https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5","source":"security-advisories@github.com"},{"url":"https://github.com/pyasn1/pyasn1/security/advisories/GHSA-mm57-4v3p-rchx","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-51831","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T20:17:31.450","lastModified":"2026-10-30T19:37:07.073","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below affected, remediated in Version 7.0.1.2 allows a local attacker to execute arbitrary code via the id_service.exe component"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://frsecure.com/blog/idrive-vulnerabilities-cve-2026-51831-and-cve-2026-51832/","source":"cve@mitre.org"},{"url":"https://www.idrive.com/release-info#win","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-51832","sourceIdentifier":"cve@mitre.org","published":"2026-10-29T20:17:31.570","lastModified":"2026-10-30T19:37:07.073","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below affected, remediated in Version 7.0.1.2 allows a local attacker to execute arbitrary code via the id_service.exe component"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{},"references":[{"url":"https://frsecure.com/blog/idrive-vulnerabilities-cve-2026-51831-and-cve-2026-51832/","source":"cve@mitre.org"},{"url":"https://www.idrive.com/release-info#win","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-67203","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T20:17:33.380","lastModified":"2026-10-29T20:17:33.380","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-67205","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T20:17:33.453","lastModified":"2026-10-29T20:17:33.453","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-92092","sourceIdentifier":"secalert@redhat.com","published":"2026-10-29T20:17:36.440","lastModified":"2026-10-30T17:17:30.957","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in openshift-ansible. The installer container's `run` script downloads and executes remote inventory and dynamic scripts without integrity verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack or compromising the HTTP server providing these scripts, could substitute an arbitrary executable. This malicious executable would then run with the installer's user ID (UID) and full cluster-provisioning privileges, leading to arbitrary code execution."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-ansible","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 5","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-ansible","cpes":["cpe:/a:redhat:openshift:5"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T15:34:46.028419Z","id":"CVE-2026-92092","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-494"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-92092","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515862","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-119198","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T21:17:18.653","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, a client with TCP access to an exposed Nuxt development server can send a nuxt:dev:client-error event over the HMR socket with an absolute file path at the end of its message. The development server reads that file while building the client error report and returns its contents through the error overlay, development error channel, and terminal report, bypassing Vite's server.fs allow list. The default localhost binding limits remote exposure, cross-origin browser requests are rejected, production builds and Nuxt 3 are not affected, and no browser interaction is required. This issue is fixed in version 4.6.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"nuxt","product":"nuxt","versions":[{"version":">= 4.6.0, < 4.6.3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-73"}]}],"references":[{"url":"https://github.com/nuxt/nuxt/commit/35856eb148bf8d6f1ad753c5b8b337c52b4fd6b3","source":"security-advisories@github.com"},{"url":"https://github.com/nuxt/nuxt/commit/aec8129f68e9b870ca919f8f60e65a4608c8a6d8","source":"security-advisories@github.com"},{"url":"https://github.com/nuxt/nuxt/releases/tag/v4.6.3","source":"security-advisories@github.com"},{"url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-x287-wcfc-q46c","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119199","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T21:17:18.797","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.3, the Nuxt development server can expose the Nitro 2 development bundle at <buildDir>/dev/index.mjs through Vite file serving when the server is reachable over HTTP. Nitro inlines private runtimeConfig values resolved at build time into that bundle, including secrets configured in nuxt.config, and Nuxt 4.6.0 and later also inline the generated development appSecret. The default localhost binding limits remote exposure, production builds and Nitro 3 are not affected, and runtime configuration supplied only through NUXT_* environment variables at server startup is not inlined. This issue is fixed in version 4.6.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"nuxt","product":"nuxt","versions":[{"version":">= 3.0.0, < 4.6.3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T20:27:35.512756Z","id":"CVE-2026-119199","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-538"}]}],"references":[{"url":"https://github.com/nuxt/nuxt/commit/12b58f9d8768682611c3ad4ea4d403875129dbca","source":"security-advisories@github.com"},{"url":"https://github.com/nuxt/nuxt/releases/tag/v4.6.3","source":"security-advisories@github.com"},{"url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-648h-gw55-m2g7","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119200","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T21:17:18.943","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-encoded dot segments before rendering a page while Nitro routing, server/middleware checks, and server route rules evaluate the unresolved path. A request such as /%2e/admin can therefore render app/pages/admin.vue and its server-rendered data while checks keyed to /admin, redirects, or per-route security headers do not apply. API handlers, appMiddleware, Nuxt 3, and Nuxt 4.0.0 through 4.5.x are not affected, and exploitation requires a client that sends dot segments without browser normalization. This issue is fixed in version 4.6.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"nuxt","product":"nuxt","versions":[{"version":">= 4.6.0, < 4.6.3","status":"affected"}]},{"vendor":"@nuxt","product":"nitro-server","versions":[{"version":">= 4.6.0, < 4.6.3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-41"},{"lang":"en","value":"CWE-436"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/nuxt/nuxt/commit/45463f8b58487e387149ebfb704d6a0834b3a450","source":"security-advisories@github.com"},{"url":"https://github.com/nuxt/nuxt/releases/tag/v4.6.3","source":"security-advisories@github.com"},{"url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-9v7c-q64q-vv33","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119201","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T21:17:19.077","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, nuxt dev stores a generated appSecret in <buildDir>/app-secret, by default .nuxt/app-secret, within a directory allowed by Vite's server.fs configuration. A client with direct HTTP access to an exposed development server can fetch the file, use deriveSecret() to compute derived secrets such as the default useSession password, and forge session cookies accepted by that development server. The default localhost binding limits remote exposure, cross-origin browser reads are blocked, production builds and development servers with an explicitly configured appSecret are not affected. This issue is fixed in version 4.6.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"nuxt","product":"nuxt","versions":[{"version":">= 4.6.0, < 4.6.3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T15:20:40.211444Z","id":"CVE-2026-119201","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-552"}]}],"references":[{"url":"https://github.com/nuxt/nuxt/commit/2981290f36d9c5412c022758f3d89ba21a845308","source":"security-advisories@github.com"},{"url":"https://github.com/nuxt/nuxt/commit/545004cc350be7003dea4116ce6206d6f980b1fd","source":"security-advisories@github.com"},{"url":"https://github.com/nuxt/nuxt/releases/tag/v4.6.3","source":"security-advisories@github.com"},{"url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-3xf4-9g3c-4h4w","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119202","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T21:17:19.217","lastModified":"2026-10-30T19:39:14.897","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"@hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching over the remaining input when a Content-Disposition parameter contains a long token without an equals sign. The resulting quadratic processing can block the Node.js event loop before route handlers or validation when @hapi/pez parses multipart/form-data headers, including unauthenticated hapi routes with payload.multipart enabled, and also affects applications that pass untrusted headers directly to Content.disposition(). This issue is fixed in @hapi/content version 6.0.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"hapijs","product":"content","versions":[{"version":"< 6.0.3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-1333"}]}],"references":[{"url":"https://github.com/hapijs/content/commit/0993851dc7234976a3fce3a7c31662b213c940fd","source":"security-advisories@github.com"},{"url":"https://github.com/hapijs/content/releases/tag/v6.0.3","source":"security-advisories@github.com"},{"url":"https://github.com/hapijs/content/security/advisories/GHSA-8494-f6mr-cjpv","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119203","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T21:17:19.377","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop while opening a crafted incomplete PDF whose standard cross-reference table reaches the end of the file without a trailer. The trailer search can repeatedly rewind to the same stream position instead of terminating when parsing makes no progress, blocking the processing thread. This issue is fixed in version 6.21.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.21.4","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:10:48.181038Z","id":"CVE-2026-119203","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-835"}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/06593f993789a4b573dd955730c1a7051128bb2a","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/pull/4289","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.21.4","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-5849-834g-hvw5","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119204","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T21:17:19.527","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can consume excessive memory while parsing a crafted PDF page tree containing many shared resources. Page-tree flattening copies page dictionary and inherited resource entries without a document-wide entry budget, allowing the crafted resource structure to cause disproportionate allocations. This issue is fixed in version 6.21.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.21.4","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/ea4ac663133f1b3de1d7a8f2e6fa239802fde79e","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/pull/4290","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.21.4","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-cggf-277g-3q54","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119205","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T21:17:19.677","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop when cloning or duplicating a crafted cyclic DictionaryObject. Clone traversal checked generated destination references rather than the original source references, allowing some source cycles to evade the visited-object check. This issue is fixed in version 6.21.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.21.4","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T15:47:20.322109Z","id":"CVE-2026-119205","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-835"}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/f176db1a1f7f9af3e472e69a843ef1175653b044","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/pull/4288","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.21.4","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-mfr5-77xh-9j7h","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119206","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T21:17:19.817","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label number tree with many ranges. The page_labels property resolves each page independently and repeatedly scans the same /Nums array from the beginning, causing work to grow with both the page count and the number of label ranges. This issue is fixed in version 6.21.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.21.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/b891fef37000cd86baa6e9848a3387d080b3b03e","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/pull/4251","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.21.3","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-42gh-23hr-vphw","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119207","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T21:17:19.953","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict mode loads a crafted invalid PDF dictionary. Nested parsing failures add repeated exception text to newly raised errors, allowing a small malformed dictionary to amplify into very large error messages. This issue is fixed in version 6.21.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.21.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:12:29.821934Z","id":"CVE-2026-119207","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-405"}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/64270258c0eced720f7960aecf8cef31afd39f8d","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/pull/4265","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.21.3","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vqv-7265-gm2w","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119208","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T21:17:20.090","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory when an application accesses the page count of a crafted encrypted PDF whose page tree declares a forged /Count value. Even after successful decryption, page-count retrieval trusts the unvalidated declared count instead of walking the page tree, allowing the attacker-controlled value to drive excessive work and memory use. This issue is fixed in version 6.21.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.21.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/82b91951dc74496bb3efe6465434f041bb6a5e6b","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/pull/4270","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.21.3","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-62m5-6wh8-28x7","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119209","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T21:17:20.230","lastModified":"2026-10-30T17:07:53.700","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while opening a crafted PDF containing cross-reference streams that declare very large entry counts. Highly compressible streams and /Prev chains can multiply the number of parsed entries across a document, while negative /Index counts can bypass the existing per-stream clamp. This issue is fixed in version 6.21.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.21.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T15:47:28.155084Z","id":"CVE-2026-119209","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/a93fe3a901fd00af38f0a105c3ba7175fa72dcb4","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/pull/4269","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.21.3","source":"security-advisories@github.com"},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-x3rh-gjgm-fmqc","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119210","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T21:17:20.403","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the ClientMessage.validateLocalFileName() check used a regular expression that could match LOAD DATA LOCAL INFILE text inside quoted identifiers, string literals, or comments instead of requiring a real statement. A malicious or compromised server, or a machine-in-the-middle attacker, could return crafted database or table identifiers that the connector reused in metadata or updatable-result queries, then answer with a LOCAL INFILE request for a client file. With allowLocalInfile enabled, this caused the connector to stream any readable client-host file named by the crafted text, including through DatabaseMetaData.getImportedKeys(), DatabaseMetaData.getExportedKeys(), or ResultSet.updateRow() paths. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"mariadb-corporation","product":"mariadb-connector-j","versions":[{"version":">= 3.0.0, < 3.3.7","status":"affected"},{"version":">= 3.4.0, < 3.4.5","status":"affected"},{"version":">= 3.5.0, < 3.5.11","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-73"}]}],"references":[{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/4d2f8002399949ed7f138e9c0b75b69229538120","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/5812e0ca7574c3934915179b76f2e819a556d099","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/a4891f877f1c885a573194771c1ed0aacec0ce1d","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-fhx5-2xqw-2cgm","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119276","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T21:17:20.907","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, when CLIENT_SESSION_TRACK was negotiated, the OkPacket.parse() and OkPacket.parseWithInfo() paths allocated byte arrays using server-declared lengths for the OK packet info field and session-state variable names and values before confirming that the bytes remained in the packet. A malicious or compromised server, or a machine-in-the-middle attacker, could send a small OK packet declaring a much larger length and repeatedly force attacker-controlled heap allocations before the subsequent copy failed. This could create garbage-collection pressure or an OutOfMemoryError in the client application. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"mariadb-corporation","product":"mariadb-connector-j","versions":[{"version":">= 3.0.0, < 3.3.7","status":"affected"},{"version":">= 3.4.0, < 3.4.5","status":"affected"},{"version":">= 3.5.0, < 3.5.11","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:11:37.642004Z","id":"CVE-2026-119276","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-130"},{"lang":"en","value":"CWE-789"}]}],"references":[{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/b9e1ee8d9b4d820d70719504cdfd5c97f1aede5f","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/beb445fcf9294113878fc05ac77f0efdf0596ac6","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/ea8c7b6537e50053444188a9a3fd9cae99550f56","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-h599-m3w5-9m7x","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119277","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T21:17:21.067","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, decoders for OK packet session-state blocks, column definition packets, text row data, or binary row data used server-declared lengths without confirming that the requested bytes remained in the receive buffer. The decoders could position reads, create sub-buffers, or decode strings beyond the packet boundary. A malicious or compromised server, or a machine-in-the-middle attacker, could trigger unchecked ArrayIndexOutOfBoundsException or IllegalArgumentException failures inside JDBC calls and terminate connection handling. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"mariadb-corporation","product":"mariadb-connector-j","versions":[{"version":">= 3.0.0, < 3.3.7","status":"affected"},{"version":">= 3.4.0, < 3.4.5","status":"affected"},{"version":">= 3.5.0, < 3.5.11","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-125"},{"lang":"en","value":"CWE-130"}]}],"references":[{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/49c92adfcf816853e324031ba9762a69444cfd12","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/52538206298db39062ad67939f1446b767cacde4","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/ea8c7b6537e50053444188a9a3fd9cae99550f56","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-wfxr-v78w-p49r","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119278","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T21:17:21.237","lastModified":"2026-10-30T17:07:53.700","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7 and 3.4.5, during caching_sha2_password authentication, the authentication-more-data response was treated as a length-encoded byte array, memory was allocated from the server-declared length, and authResult[0] was accessed without ensuring a byte existed. A malicious or compromised server, or a machine-in-the-middle attacker, could declare a very large length or send an empty response before any password was transmitted. The malformed packet could cause excessive allocation or an unchecked ArrayIndexOutOfBoundsException escaping from DriverManager.getConnection(). This issue is fixed in versions 3.3.7 and 3.4.5."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"mariadb-corporation","product":"mariadb-connector-j","versions":[{"version":">= 3.0.0, < 3.3.7","status":"affected"},{"version":">= 3.4.0, < 3.4.5","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T15:20:41.784215Z","id":"CVE-2026-119278","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-129"},{"lang":"en","value":"CWE-789"}]}],"references":[{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/1e32b7010485f090cc402528c334301432495fbe","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/86a90b0dc9746aa3bd4aa1df264be22a2d1b7d98","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-r9vh-xh4r-j6gr","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119279","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T21:17:21.387","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.10, the ReadableByteBuf.readLength() and ReadableByteBuf.readIntLengthEncodedNotNull() methods narrowed the protocol's unsigned 8-byte length-encoded integer to a Java int without checking that the value fit a non-negative integer. Values above Integer.MAX_VALUE could wrap to a negative or unrelated length that downstream allocation and read paths used. A malicious or compromised server, or a machine-in-the-middle attacker, could trigger NegativeArraySizeException, out-of-bounds failures, or oversized allocation behavior in client connection handling. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.10."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"mariadb-corporation","product":"mariadb-connector-j","versions":[{"version":">= 3.0.0, < 3.3.7","status":"affected"},{"version":">= 3.4.0, < 3.4.5","status":"affected"},{"version":">= 3.5.0, < 3.5.10","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-130"},{"lang":"en","value":"CWE-190"}]}],"references":[{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/30d4a883377a9b7762e02ee2c60d54567032ab99","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/bfd9f5ad666a6f7f5401a5b78f2ac2fbd6df8667","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/dbbadc3e215c47bdb913ddf50739ada09a7f23ea","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.10","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-797x-p4mc-jwpm","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119280","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T21:17:21.553","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recover() and MariaDbPoolPinnedConnection.recover() implementations trusted the gtrid_length and bqual_length columns returned by XA RECOVER. The methods allocated and split Xid byte arrays without validating the lengths against Xid.MAXGTRIDSIZE, Xid.MAXBQUALSIZE, or the actual data payload. A malicious or compromised server, or a machine-in-the-middle attacker, could cause large allocations, NegativeArraySizeException, or ArrayIndexOutOfBoundsException during XA recovery. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"mariadb-corporation","product":"mariadb-connector-j","versions":[{"version":">= 3.0.0, < 3.3.7","status":"affected"},{"version":">= 3.4.0, < 3.4.5","status":"affected"},{"version":">= 3.5.0, < 3.5.11","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:09:58.150194Z","id":"CVE-2026-119280","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-789"}]}],"references":[{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/280efcfb4390055858fa2dd12b722d85a6a13ab8","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/47aba5a23548b35191865a428cc674316b95ee47","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/e9d767103bfd178ed57caa4cb97bbfbf7e54da6b","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-4jq2-8v3c-97w8","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119281","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T21:17:21.710","lastModified":"2026-10-30T17:18:03.880","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed result bytes were UTF-8 but guarded only changes to character_set_client. It did not reject non-UTF-8 character_set_results changes and relied on the server's global session_track_system_variables configuration to report character-set changes. A malicious or compromised server, or a machine-in-the-middle attacker, could suppress tracking or change the result charset so application strings differed from the returned bytes, potentially defeating application-side validation or escaping that depended on the decoded values. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"mariadb-corporation","product":"mariadb-connector-j","versions":[{"version":">= 3.0.0, < 3.3.7","status":"affected"},{"version":">= 3.4.0, < 3.4.5","status":"affected"},{"version":">= 3.5.0, < 3.5.11","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-838"}]}],"references":[{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/af5e565eb171cfc66ea8e948ddc616abed0c4623","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/d51b968c1b795c73d24e0b3f960205b7bc82d423","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/fdabe74a7df6dce1d6c099f4d0ca1e2acc25919a","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11","source":"security-advisories@github.com"},{"url":"https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-grfq-r75j-rw9x","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119325","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-29T21:17:21.870","lastModified":"2026-10-30T19:23:25.493","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks. Attackers can obtain a public nonce via the bricks_regenerate_query_nonce action and then increment the popupId value in requests to the /wp-json/bricks/v1/load_popup_content endpoint to enumerate and disclose confidential content from any unpublished post on the site."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Bricks","product":"Bricks Theme","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.4.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:12:59.241454Z","id":"CVE-2026-119325","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://bricksbuilder.io/release/bricks-2-4-1/","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/bricks-theme-broken-access-control-via-load-popup-content","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-13303","sourceIdentifier":"security@hashicorp.com","published":"2026-10-29T21:17:22.000","lastModified":"2026-10-30T19:37:07.073","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a project to cause the Boundary controller to issue outbound requests to a network destination of the requester's choosing and to receive the response. This may expose endpoints reachable only from the controller's host, such as a cloud instance metadata service. This vulnerability, CVE-2026-13303, is fixed in Boundary Enterprise 1.0.2 and 0.21.6."}],"affected":[{"source":"security@hashicorp.com","affectedData":[{"vendor":"HashiCorp","product":"Boundary","defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"repo":"https://github.com/hashicorp/boundary","versions":[{"version":"0.21.3","lessThan":"*","versionType":"semver","status":"affected"}]},{"vendor":"HashiCorp","product":"Boundary Enterprise","defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"repo":"https://github.com/hashicorp/boundary","versions":[{"version":"0.21.3","lessThan":"1.0.2","versionType":"semver","status":"affected","changes":[{"at":"0.21.6","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@hashicorp.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:08:47.821598Z","id":"CVE-2026-13303","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@hashicorp.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2026-54-boundary-vulnerable-to-server-side-request-forgery-in-vault-credential-store/77932","source":"security@hashicorp.com"}]}},{"cve":{"id":"CVE-2026-61576","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T21:17:27.313","lastModified":"2026-10-30T16:17:57.253","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook `POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook` has no authentication middleware or signature validation. In `packages/backend/src/controllers/projectController.ts`, `testWebhook()` accepts `accountId` and `runId` from a `job.run.completed` request and passes them to `createPreviewWithExplores()` in `packages/backend/src/services/ProjectService/ProjectService.ts`. These unsanitized values are interpolated into the server-side dbt Cloud API URL, which is requested with the victim project's API key in the `Authorization` header. Path traversal through `accountId` changes the requested path on `cloud.getdbt.com` without changing its host, so the credential-bearing request reaches an attacker-influenced path on that fixed host. The advisory claims API-key theft, but the supplied evidence does not establish that the attacker can observe the `Authorization` header. The unauthenticated webhook also allows preview creation. The target must be a `dbt Cloud IDE` project and the attacker must know its `projectUuid`; the UUID is not enumerable but can be discovered in shared or multi-tenant contexts. Version 0.3214.0 fixes identifier path traversal and verifies webhook HMAC signatures only when a secret is configured; without a secret, unsigned webhooks continue to be processed."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"lightdash","product":"lightdash","versions":[{"version":"< 0.3214.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T15:20:43.431367Z","id":"CVE-2026-61576","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/lightdash/lightdash/commit/8d1d9bb6804bbea66a7bdf1b9b00092665382f14","source":"security-advisories@github.com"},{"url":"https://github.com/lightdash/lightdash/pull/24587","source":"security-advisories@github.com"},{"url":"https://github.com/lightdash/lightdash/releases/tag/0.3214.0","source":"security-advisories@github.com"},{"url":"https://github.com/lightdash/lightdash/security/advisories/GHSA-3594-hhm2-76fj","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-115943","sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","published":"2026-10-29T22:17:00.767","lastModified":"2026-10-30T19:39:14.897","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt.\n\nWhen a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX->new parses it.\n\nAn attacker who supplies an XLSX file can run arbitrary Perl code."}],"affected":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://cpan.org/modules","packageName":"Spreadsheet-XLSX","modules":["Spreadsheet::XLSX"],"programFiles":["lib/Spreadsheet/XLSX/Utility2007.pm"],"programRoutines":[{"name":"Spreadsheet::XLSX::Utility2007::ExcelFmt"}],"repo":"https://github.com/asb-capfan/Spreadsheet-XLSX","packageURL":"pkg:cpan/Spreadsheet-XLSX","versions":[{"version":"0","lessThan":"0.19","versionType":"custom","status":"affected"}]}]}],"metrics":{},"weaknesses":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary","description":[{"lang":"en","value":"CWE-95"}]}],"references":[{"url":"https://metacpan.org/release/ASB/Spreadsheet-XLSX-0.19/changes","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/30/3","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-119282","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T22:17:00.887","lastModified":"2026-10-30T19:37:07.073","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and interpolate plugin options from nx.json into command arguments. The @nx/maven targetNamePrefix value and arbitrary @nx/gradle option names or values can therefore be interpreted as shell syntax whenever an nx command constructs the project graph. A user who runs Nx in an attacker-controlled repository or pull request can execute injected commands with the user's privileges, while workspaces that register neither affected plugin are not exposed to this path. Remediation requires upgrading both nx and each affected plugin to matching releases because the plugin fix depends on code in the nx package. This issue is fixed in versions 22.7.9 and 23.1.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"nrwl","product":"nx","versions":[{"version":">= 21.0.0, < 22.7.9","status":"affected"},{"version":">= 23.0.0, < 23.1.2","status":"affected"}]},{"vendor":"@nx","product":"maven","versions":[{"version":">= 21.0.0, < 22.7.9","status":"affected"},{"version":">= 23.0.0, < 23.1.2","status":"affected"}]},{"vendor":"@nx","product":"gradle","versions":[{"version":">= 21.0.0, < 22.7.9","status":"affected"},{"version":">= 23.0.0, < 23.1.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-88"}]}],"references":[{"url":"https://github.com/nrwl/nx/commit/02c5d59e8dbbbe30963c0181c6a22cd8c1190a25","source":"security-advisories@github.com"},{"url":"https://github.com/nrwl/nx/commit/60196b7cfcffcada35b6b90e53bf1a78d049b548","source":"security-advisories@github.com"},{"url":"https://github.com/nrwl/nx/commit/c227f4780b054c512965c73aa480a48f9f781409","source":"security-advisories@github.com"},{"url":"https://github.com/nrwl/nx/pull/36626","source":"security-advisories@github.com"},{"url":"https://github.com/nrwl/nx/releases/tag/22.7.9","source":"security-advisories@github.com"},{"url":"https://github.com/nrwl/nx/releases/tag/23.1.2","source":"security-advisories@github.com"},{"url":"https://github.com/nrwl/nx/security/advisories/GHSA-qm8w-vx34-5j9j","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119283","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T22:17:01.047","lastModified":"2026-10-30T17:17:17.740","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.5, joserfc.jwe.decrypt_json() accepts a JWE General JSON Serialization recipients array without a count limit and calls decrypt_cek() for every entry. An unauthenticated attacker who can submit a JWE to an endpoint using an RSA key-management algorithm can choose the number of private-key decryption operations performed by one request. The verify_all_recipients option does not reduce this work because the affected loop processes every recipient before consulting that setting, allowing repeated requests to exhaust service CPU without affecting confidentiality or integrity. This issue is fixed in version 1.7.5."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"authlib","product":"joserfc","versions":[{"version":"< 1.7.5","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:08:00.789446Z","id":"CVE-2026-119283","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://github.com/authlib/joserfc/commit/d6dc8df6c7609277e741069d3733e43996c1cd17","source":"security-advisories@github.com"},{"url":"https://github.com/authlib/joserfc/releases/tag/1.7.5","source":"security-advisories@github.com"},{"url":"https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76","source":"security-advisories@github.com"},{"url":"https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-119284","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T22:17:01.210","lastModified":"2026-10-30T17:17:17.850","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.6, joserfc compact JWS deserialization calls bytes.split() before enforcing the existing aggregate segment-size limits. When attacker-controlled compact serialization bytes reach deserialize_compact(), the split creates copies of the header, payload, and signature segments before ExceededSizeError rejects them, causing an additional allocation approximately proportional to the supplied token. Requests that exhaust available process memory can therefore cause an availability failure even though signature verification fails. This issue is fixed in version 1.7.6."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"authlib","product":"joserfc","versions":[{"version":"< 1.7.6","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:05:14.978930Z","id":"CVE-2026-119284","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://github.com/authlib/joserfc/commit/397e04f4bbce0b94d86e31c1c003f4640af8fb39","source":"security-advisories@github.com"},{"url":"https://github.com/authlib/joserfc/releases/tag/1.7.6","source":"security-advisories@github.com"},{"url":"https://github.com/authlib/joserfc/security/advisories/GHSA-9pg5-8c7x-5hfx","source":"security-advisories@github.com"},{"url":"https://github.com/authlib/joserfc/security/advisories/GHSA-9pg5-8c7x-5hfx","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-119285","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T22:17:01.367","lastModified":"2026-10-30T19:37:07.073","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely ends with the configured base domain. A user who visits that origin can expose authenticated cross-origin responses to the attacker's page; empty-label origins and later comma-space parsing hardening are outside this advisory. This issue is fixed in version 2.52.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"gofiber","product":"fiber","versions":[{"version":">= 2.52.1, < 2.52.3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":4.2}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-346"},{"lang":"en","value":"CWE-942"}]}],"references":[{"url":"https://github.com/gofiber/fiber/commit/1aac6f618b6bd3e159d2449acb4232a2170b976b","source":"security-advisories@github.com"},{"url":"https://github.com/gofiber/fiber/pull/2915","source":"security-advisories@github.com"},{"url":"https://github.com/gofiber/fiber/releases/tag/v2.52.3","source":"security-advisories@github.com"},{"url":"https://github.com/gofiber/fiber/security/advisories/GHSA-g5jq-qmqr-qrwf","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119286","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T22:17:01.517","lastModified":"2026-10-30T19:37:07.073","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate() reuses a module-level ValidationAbortedError when a document exceeds max_errors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validation context, and error set for the process lifetime. An unauthenticated client can repeatedly submit a small document with more than 100 validation errors to cause unbounded memory growth before query execution, eventually exhausting worker memory without disclosing or modifying data. This issue is fixed in version 3.3.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"graphql-python","product":"graphql-core","versions":[{"version":">= 3.3.0a3, < 3.3.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T15:47:35.331193Z","id":"CVE-2026-119286","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-401"}]}],"references":[{"url":"https://github.com/graphql-python/graphql-core/commit/3c319fd9f4b8f6c9db4189520561bf8dd0e70be9","source":"security-advisories@github.com"},{"url":"https://github.com/graphql-python/graphql-core/issues/287","source":"security-advisories@github.com"},{"url":"https://github.com/graphql-python/graphql-core/pull/288","source":"security-advisories@github.com"},{"url":"https://github.com/graphql-python/graphql-core/releases/tag/v3.3.1","source":"security-advisories@github.com"},{"url":"https://github.com/graphql-python/graphql-core/security/advisories/GHSA-mpqx-q82w-9x46","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-119317","sourceIdentifier":"vulnreport@tenable.com","published":"2026-10-29T22:17:01.670","lastModified":"2026-10-30T17:44:35.820","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"On Linux, an authenticated, low-privileged Nessus user with scan-creation rights could read arbitrary text files on the scanner host with the privileges of the nessusd process by running a custom Unix compliance audit against the scanner itself."}],"affected":[{"source":"vulnreport@tenable.com","affectedData":[{"vendor":"Tenable, Inc.","product":"Plugin Feed","defaultStatus":"affected","platforms":["Linux"],"versions":[{"version":"0","lessThan":"202610282338","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vulnreport@tenable.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"vulnreport@tenable.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:06:57.763805Z","id":"CVE-2026-119317","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://www.tenable.com/security/tns-2026-33","source":"vulnreport@tenable.com"}]}},{"cve":{"id":"CVE-2026-45049","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T22:17:02.400","lastModified":"2026-10-30T19:37:07.073","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`CDSSO`) servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. An attacker who induces an authenticated victim to visit a crafted URL can receive the session credential and potentially hijack the session. Deployments must have `CDSSO` enabled, as is common in multi-domain deployments, and exploitation is additionally gated on a non-default configuration being absent. This issue is fixed in version 16.1.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"OpenIdentityPlatform","product":"OpenAM","versions":[{"version":"< 16.1.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":6.0}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-201"}]}],"references":[{"url":"https://github.com/OpenIdentityPlatform/OpenAM/commit/bda647f8540d8fb28aaaed716914692678c5a0a7","source":"security-advisories@github.com"},{"url":"https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1","source":"security-advisories@github.com"},{"url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-r9pv-5rpp-vm8g","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-61645","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T22:17:04.963","lastModified":"2026-10-30T19:39:14.897","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the `Upload API` arises because the API does not validate the `uploaded file path or type`. An attacker can overwrite sensitive configuration files or place malicious files on the Docat web server. Depending on deployment context, uploaded content can enable remote code execution or cross-site scripting intended to steal cookies or redirect users to malicious websites. Version 1.6.0 mitigates filename-based path traversal; remediation of unrestricted file types or deployment-dependent malicious-content effects is not established by the verified patch."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"docat-org","product":"docat","versions":[{"version":"< 1.6.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":5.3}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T15:20:45.317186Z","id":"CVE-2026-61645","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://github.com/docat-org/docat/commit/85fc40e8348c6328f488395d03c779517a0913fd","source":"security-advisories@github.com"},{"url":"https://github.com/docat-org/docat/releases/tag/1.6.0","source":"security-advisories@github.com"},{"url":"https://github.com/docat-org/docat/security/advisories/GHSA-jcxj-j5qf-8crw","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-61654","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T22:17:05.110","lastModified":"2026-10-29T22:17:05.227","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook `POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook` has no authentication middleware or signature validation. In `packages/backend/src/controllers/projectController.ts`, `testWebhook()` accepts `accountId` and `runId` from a `job.run.completed` request and passes them to `createPreviewWithExplores()` in `packages/backend/src/services/ProjectService/ProjectService.ts`. These unsanitized values are interpolated into the server-side dbt Cloud API URL, which is requested with the victim project's API key in the `Authorization` header. Path traversal through `accountId` changes the requested path on `cloud.getdbt.com` without changing its host, so the credential-bearing request reaches an attacker-influenced path on that fixed host. The advisory claims API-key theft, but the supplied evidence does not establish that the attacker can observe the `Authorization` header. The unauthenticated webhook also allows preview creation. The target must be a `dbt Cloud IDE` project and the attacker must know its `projectUuid`; the UUID is not enumerable but can be discovered in shared or multi-tenant contexts. Version 0.3214.0 fixes identifier path traversal and verifies webhook HMAC signatures only when a secret is configured; without a secret, unsigned webhooks continue to be processed."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"lightdash","product":"lightdash","versions":[{"version":"< 0.3214.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/lightdash/lightdash/commit/8d1d9bb6804bbea66a7bdf1b9b00092665382f14","source":"security-advisories@github.com"},{"url":"https://github.com/lightdash/lightdash/pull/24587","source":"security-advisories@github.com"},{"url":"https://github.com/lightdash/lightdash/releases/tag/0.3214.0","source":"security-advisories@github.com"},{"url":"https://github.com/lightdash/lightdash/security/advisories/GHSA-r4xc-vwqr-3252","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-61671","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T22:17:05.273","lastModified":"2026-10-30T17:17:26.620","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the `/controle/control.php` dispatch endpoint accepts attacker-controlled `nomeClasse`, `metodo`, and record identifier parameters through `extract($_REQUEST)`, including id, `idatendido`, `idInterno`, and `id_funcionario`, while the affected Controle CRUD methods do not verify record ownership. Any authenticated user can view, modify, or delete another user's records, exposing CPF, RG, addresses, medical records, financial data, and employee records. `AtendidoControle` lacks ownership checks on alterar, excluir, `listarUm`, `alterarInfPessoal`, `alterarDocumentacao`, `alterarImagem`, `alterarEndereco`, and `alterarStatus`; `InternoControle` lacks them on incluir, alterar, excluir, `listarUm`, `listarTodos`, and `listarCpf`. `FuncionarioControle` lacks ownership checks on `alterarInfPessoal`, `alterarEndereco`, `alterarDocumentacao`, `alterarImagem`, `alterarCargaHoraria`, and excluir; `VoluntarioControle` lacks them on `alterarInfPessoal`, `alterarEndereco`, `alterarDetalhes`, `alterarImagem`, and excluir. `AtendidoControle` and `InternoControle` additionally lack CSRF validation, allowing a malicious page visited by an authenticated victim to perform state-changing operations using the victim's session. `FuncionarioControle` and `VoluntarioControle` have per-method CSRF checks, but those checks do not prevent the object-authorization bypass. The advisory identifies version 3.8.7 as patched."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"LabRedesCefetRJ","product":"WeGIA","versions":[{"version":"< 3.8.7","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:06:03.834852Z","id":"CVE-2026-61671","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"},{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/LabRedesCefetRJ/WeGIA/commit/5fd072a416e3c85817f8b77d47a6d970345b0fc2","source":"security-advisories@github.com"},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/commit/83ae8d1b417e0d8ef6a603ec5745f0967426ca6d","source":"security-advisories@github.com"},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/issues/492","source":"security-advisories@github.com"},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.7","source":"security-advisories@github.com"},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-rf87-2prr-f2p2","source":"security-advisories@github.com"},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-rf87-2prr-f2p2","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-61673","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T22:17:05.447","lastModified":"2026-10-29T22:17:05.563","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in `web/html/memorando/listar_despachos.php` results from unsafe handling of the `texto` field. The affected flow spans `web/controle/memorando/DespachoControle.php` and `web/dao/memorando/DespachoDAO.php`: `FILTER_SANITIZE_SPECIAL_CHARS` is applied during storage, but `html_entity_decode()` later decodes the stored content and `jQuery .html()` inserts the result into the DOM. An attacker able to submit a memorandum dispatch through `/controle/control.php` using `DespachoControle` and `metodo=incluir` can store malicious HTML or JavaScript. The code executes automatically when another user views the memorandum thread through `/html/memorando/listar_despachos.php` with `id_memorando`. This permits arbitrary JavaScript execution, theft of administrator `PHPSESSID` session tokens, privileged session hijacking, account takeover, and unauthorized access to privileged or internal functionality. This issue is fixed in version 3.8.7."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"LabRedesCefetRJ","product":"WeGIA","versions":[{"version":"< 3.8.7","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/LabRedesCefetRJ/WeGIA/commit/9524556c5940149e20cea389d2966dd010d3b5af","source":"security-advisories@github.com"},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/issues/516","source":"security-advisories@github.com"},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.7","source":"security-advisories@github.com"},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-83p7-cx5x-7g34","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-61707","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T22:17:05.603","lastModified":"2026-10-30T17:13:54.187","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, in the reported deployment, case-report templates uploaded by `customer_user`, the lowest-privilege portal role, are later executed by non-sandboxed Jinja2 engines when an admin or analyst generates a report. The `/case-report-template/upload` route in `backend/app/incidents/routes/db_operations.py` validates only the filename-derived MIME type, not the template content. Templates share a global store without customer_code scoping, and `customer_user` can also list, download and delete them, allowing an attacker to replace a legitimate default template under the same name. In `backend/app/incidents/services/reports.py`, `render_document_with_context` uses `DocxTemplate` without a sandbox; in `backend/app/incidents/services/reports_pdf.py`, `render_html_template` uses a non-sandboxed `Environment` without autoescaping. Normal privileged requests to `POST /api/incidents/report/generate-report-docx` or `/generate-report-pdf` therefore evaluate attacker-controlled Jinja expressions as Python on the backend. The reported deployment executes commands as root, exposing all tenants' incident and SIEM data and stored connector credentials. The HTML/PDF wkhtmltopdf renderer additionally permits local-file reads and requests to internal services. This issue is fixed in version 0.1.76."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"socfortress","product":"CoPilot","versions":[{"version":"< 0.1.76","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T15:34:47.697339Z","id":"CVE-2026-61707","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-862"},{"lang":"en","value":"CWE-1336"}]}],"references":[{"url":"https://github.com/socfortress/CoPilot/commit/a5ed4a250094d1b6d15ba0ec088dbd773ab1b4e0","source":"security-advisories@github.com"},{"url":"https://github.com/socfortress/CoPilot/pull/936","source":"security-advisories@github.com"},{"url":"https://github.com/socfortress/CoPilot/security/advisories/GHSA-7q83-228r-wfh5","source":"security-advisories@github.com"},{"url":"https://github.com/socfortress/CoPilot/tree/v0.1.76","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-61719","sourceIdentifier":"security-advisories@github.com","published":"2026-10-29T22:17:05.763","lastModified":"2026-10-29T22:17:05.883","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in `saude/historico_prontuarios.php` arises because the `textoProntuario` field accepts arbitrary HTML or JavaScript without proper sanitization. An attacker able to create or access a patient's medical record can submit the field through `POST /controle/control.php` with `nomeClasse=SaudeControle`, `metodo=alterarProntuario`, and `id_fichamedica`. The stored content is rendered when another user accesses `/html/saude/historico_prontuarios.php` with `id_historico`, automatically executing attacker-controlled JavaScript in the victim's browser. The vulnerability permits session cookie theft and potential account compromise depending on the victim's privileges. This issue is fixed in version 3.8.7."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"LabRedesCefetRJ","product":"WeGIA","versions":[{"version":"< 3.8.7","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L","baseScore":8.9,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":6.0}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/LabRedesCefetRJ/WeGIA/commit/52eeca63e9df1298c6f661d55aa26dc9eb0f564d","source":"security-advisories@github.com"},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/issues/1704","source":"security-advisories@github.com"},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.7","source":"security-advisories@github.com"},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-qm7p-cprp-f974","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2023-22793","sourceIdentifier":"support@hackerone.com","published":"2026-10-29T23:16:54.270","lastModified":"2026-10-30T19:37:07.073","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center."}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"Veeam","product":"Management Pack for Microsoft System Center","defaultStatus":"unaffected","versions":[{"version":"9.0","lessThan":"13.1.0.334","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"support@hackerone.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:03:57.174327Z","id":"CVE-2023-22793","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"support@hackerone.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://www.veeam.com/kb4961","source":"support@hackerone.com"}]}},{"cve":{"id":"CVE-2026-107238","sourceIdentifier":"support@hackerone.com","published":"2026-10-29T23:16:54.760","lastModified":"2026-10-30T19:37:07.073","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service."}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"Veeam","product":"Management Pack for Microsoft System Center","defaultStatus":"unaffected","versions":[{"version":"9.0","lessThan":"13.1.0.334","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"support@hackerone.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:02:46.617903Z","id":"CVE-2026-107238","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"support@hackerone.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://www.veeam.com/kb4961","source":"support@hackerone.com"}]}},{"cve":{"id":"CVE-2026-107239","sourceIdentifier":"support@hackerone.com","published":"2026-10-29T23:16:54.887","lastModified":"2026-10-30T19:37:07.073","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center Collector service."}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"Veeam","product":"Management Pack for Microsoft System Center","defaultStatus":"unaffected","versions":[{"version":"9.0","lessThan":"13.1.0.334","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"support@hackerone.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:03:16.890803Z","id":"CVE-2026-107239","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"support@hackerone.com","type":"Secondary","description":[{"lang":"en","value":"CWE-23"}]}],"references":[{"url":"https://www.veeam.com/kb4961","source":"support@hackerone.com"}]}},{"cve":{"id":"CVE-2026-112211","sourceIdentifier":"cve@gitlab.com","published":"2026-10-29T23:16:55.143","lastModified":"2026-10-29T23:16:55.143","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-92744","sourceIdentifier":"1443cd92-d354-46d2-9290-d812316ca43a","published":"2026-10-29T23:17:02.190","lastModified":"2026-10-30T19:39:14.897","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute\narbitrary code as LocalSystem."}],"affected":[{"source":"1443cd92-d354-46d2-9290-d812316ca43a","affectedData":[{"vendor":"Delinea","product":"Privilege Manager","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"10.1.0","lessThanOrEqual":"12.0.5796","versionType":"custom","status":"affected"},{"version":"13.0.0","lessThanOrEqual":"13.0.1058","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"1443cd92-d354-46d2-9290-d812316ca43a","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T17:00:47.417177Z","id":"CVE-2026-92744","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"1443cd92-d354-46d2-9290-d812316ca43a","type":"Secondary","description":[{"lang":"en","value":"CWE-295"},{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://delinea.com/security-advisories","source":"1443cd92-d354-46d2-9290-d812316ca43a"}]}}]}