{ "generated_at": "2026-10-20T22:05:37Z", "source_health": { "healthy": 8, "total": 8, "sources": { "nvd": true, "cisa": true, "exploitdb": true, "poc_in_github": true, "cxsecurity": true, "sploitus": true, "cve_intel": true, "github": true } }, "is_demo": false, "entries": [ { "id": "CVE-2918-12386", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Exploit for cve-2018-12386 CVE-2018-12386 CVE-2918-12386", "summary": "Sandboxed RCE in Firefox prior to 62.0.3 and ESR 60.2.2.", "updated_at": "2026-09-22T03:32:59Z", "published_at": "2026-09-22T03:32:59Z", "cvss": 8.1, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 101, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "what_happened": "Sandboxed RCE in Firefox prior to 62.0.3 and ESR 60.2.2.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for cve-2018-12386 CVE-2018-12386 CVE-2918-12386", "summary": "Sandboxed RCE in Firefox prior to 62.0.3 and ESR 60.2.2.", "what_happened": "Sandboxed RCE in Firefox prior to 62.0.3 and ESR 60.2.2.", "cvss": 8.1, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-HYDRA3EVIL-CVE-2018-12386", "https://kitploit.com/ru/tools/github/hydra3evil/cve-2018-12386/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-09-22T05:32:59", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-HYDRA3EVIL-CVE-2018-12386" }, { "title": "Exploit for cve-2018-12386 CVE-2018-12386 CVE-2918-12386", "summary": "Sandboxed RCE in Firefox prior to 62.0.3 and ESR 60.2.2.", "what_happened": "Sandboxed RCE in Firefox prior to 62.0.3 and ESR 60.2.2.", "cvss": 8.1, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-HYDRA3EVIL-CVE-2018-12386", "https://kitploit.com/ru/tools/github/hydra3evil/cve-2018-12386/" ], "repository": "kitploit.com", "author": "ru", "first_seen": "2026-09-22T05:32:59", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/ru/tools/github/hydra3evil/cve-2018-12386/" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-HYDRA3EVIL-CVE-2018-12386", "https://kitploit.com/ru/tools/github/hydra3evil/cve-2018-12386/" ], "timeline": [ { "at": "2026-09-22T03:32:59Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-HYDRA3EVIL-CVE-2018-12386" } ], "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "id": "CVE-2099-99999", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Exploit for ngxray CVE-2026-42945 CVE-2026-9256", "summary": "ngxray static scanner detects CVEs in nginx rewrite/script engine directives via JSON rules.", "updated_at": "2026-09-25T03:25:10Z", "published_at": "2026-09-25T03:25:10Z", "cvss": 9.2, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 143, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "Unknown", "what_happened": "ngxray static scanner detects CVEs in nginx rewrite/script engine directives via JSON rules.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for ngxray CVE-2026-42945 CVE-2026-9256", "summary": "ngxray static scanner detects CVEs in nginx rewrite/script engine directives via JSON rules.", "what_happened": "ngxray static scanner detects CVEs in nginx rewrite/script engine directives via JSON rules.", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N", "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-CALIFIO-NGXRAY", "https://kitploit.com/ja/tools/github/califio/ngxray/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-09-25T05:25:10", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-CALIFIO-NGXRAY" }, { "title": "Exploit for ngxray CVE-2026-42945 CVE-2026-9256", "summary": "ngxray static scanner detects CVEs in nginx rewrite/script engine directives via JSON rules.", "what_happened": "ngxray static scanner detects CVEs in nginx rewrite/script engine directives via JSON rules.", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N", "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-CALIFIO-NGXRAY", "https://kitploit.com/ja/tools/github/califio/ngxray/" ], "repository": "kitploit.com", "author": "ja", "first_seen": "2026-09-25T05:25:10", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/ja/tools/github/califio/ngxray/" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-CALIFIO-NGXRAY", "https://kitploit.com/ja/tools/github/califio/ngxray/" ], "timeline": [ { "at": "2026-09-25T03:25:10Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-CALIFIO-NGXRAY" } ], "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N" }, { "id": "CVE-2026-600004", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Exploit for CVE-2026-600004", "summary": "Proof-of-concept exploit for CVE-2026-600004 and CVE-2026-60004. CVSS 9.8.", "updated_at": "2026-09-27T21:50:13Z", "published_at": "2026-09-27T21:50:13Z", "cvss": 9.8, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 307, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "CWE-94", "what_happened": "Unauthenticated RCE in Gitea >= 1.17, = 2.32 via diffpatch API Git Hook.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for CVE-2026-600004 CVE-2026-600004 CVE-2026-60004", "summary": "Unauthenticated RCE in Gitea >= 1.17, = 2.32 via diffpatch API Git Hook.", "what_happened": "Unauthenticated RCE in Gitea >= 1.17, = 2.32 via diffpatch API Git Hook.", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=026C8ED5-2F4A-5505-88A5-30BA77AC4EDE", "https://github.com/ImperfectP/CVE-2026-600004" ], "repository": "Sploitus", "author": "ImperfectP", "first_seen": "2026-09-27T21:51:40", "confidence": "High", "verification": "verified", "verified": true, "verification_detail": "Sploitus reports working code with at least 90% confidence.", "url": "https://sploitus.com/exploit?id=026C8ED5-2F4A-5505-88A5-30BA77AC4EDE" }, { "title": "Exploit for CVE-2026-600004 CVE-2026-600004 CVE-2026-60004", "summary": "Unauthenticated RCE in Gitea >= 1.17, = 2.32 via diffpatch API Git Hook.", "what_happened": "Unauthenticated RCE in Gitea >= 1.17, = 2.32 via diffpatch API Git Hook.", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=026C8ED5-2F4A-5505-88A5-30BA77AC4EDE", "https://github.com/ImperfectP/CVE-2026-600004" ], "repository": "ImperfectP/CVE-2026-600004", "author": "ImperfectP", "first_seen": "2026-09-27T21:51:40", "confidence": "High", "verification": "verified", "verified": true, "verification_detail": "Linked by a Sploitus working-code assessment.", "url": "https://github.com/ImperfectP/CVE-2026-600004" }, { "title": "Exploit for CVE-2026-60004-POC", "summary": "Gitea 1.17–1.27.0 pre-auth RCE via git hook injection through diffpatch API endpoint.", "what_happened": "Gitea 1.17–1.27.0 pre-auth RCE via git hook injection through diffpatch API endpoint.", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-94", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-IMBAS007-CVE-2026-60004-POC", "https://kitploit.com/ru/tools/github/imbas007/cve-2026-60004-poc/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-09-18T15:30:58", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-IMBAS007-CVE-2026-60004-POC" }, { "title": "Exploit for CVE-2026-60004-POC", "summary": "Gitea 1.17–1.27.0 pre-auth RCE via git hook injection through diffpatch API endpoint.", "what_happened": "Gitea 1.17–1.27.0 pre-auth RCE via git hook injection through diffpatch API endpoint.", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-94", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-IMBAS007-CVE-2026-60004-POC", "https://kitploit.com/ru/tools/github/imbas007/cve-2026-60004-poc/" ], "repository": "kitploit.com", "author": "ru", "first_seen": "2026-09-18T15:30:58", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/ru/tools/github/imbas007/cve-2026-60004-poc/" } ], "references": [ "https://sploitus.com/exploit?id=026C8ED5-2F4A-5505-88A5-30BA77AC4EDE", "https://github.com/ImperfectP/CVE-2026-600004", "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-IMBAS007-CVE-2026-60004-POC", "https://kitploit.com/ru/tools/github/imbas007/cve-2026-60004-poc/" ], "timeline": [ { "at": "2026-09-27T21:50:13Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=026C8ED5-2F4A-5505-88A5-30BA77AC4EDE" } ] }, { "id": "CVE-2026-113709", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2026-113709 exploit", "summary": "Exploit for CVE-2026-113709. CVSS 9.9.", "updated_at": "2026-10-20T18:08:36Z", "published_at": "2026-10-20T18:08:36Z", "cvss": 9.9, "confidence": 55, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-10-20T18:08:36+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "CVE-2026-113709 exploit", "summary": "Exploit for CVE-2026-113709. CVSS 9.9.", "cvss": 9.9, "url": "https://sploitus.com/exploit?id=CVE-2026-113709" } ], "references": [ "https://sploitus.com/exploit?id=CVE-2026-113709" ], "timeline": [ { "at": "2026-10-20T18:08:36Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=CVE-2026-113709" } ] }, { "id": "CVE-2026-113708", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2026-113708 exploit", "summary": "Exploit for CVE-2026-113708. CVSS 9.9.", "updated_at": "2026-10-20T18:03:17Z", "published_at": "2026-10-20T18:03:17Z", "cvss": 9.9, "confidence": 55, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-10-20T18:03:17+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "CVE-2026-113708 exploit", "summary": "Exploit for CVE-2026-113708. CVSS 9.9.", "cvss": 9.9, "url": "https://sploitus.com/exploit?id=CVE-2026-113708" } ], "references": [ "https://sploitus.com/exploit?id=CVE-2026-113708" ], "timeline": [ { "at": "2026-10-20T18:03:17Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=CVE-2026-113708" } ] }, { "id": "CVE-2026-113620", "vendor": "Eclipse Foundation", "product": "Eclipse ioFog", "title": "Exploit for CVE-2026-113620", "summary": "In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role, with no account and no RoleBinding. The attacker can open an exec or log session for a microservice or fog whose UUID they already know. HTTP routes are not affected: they verify the token before RBAC. Agent WebSockets verify the fog token and are not affected.", "updated_at": "2026-10-20T13:16:41.610", "published_at": "2026-10-20T13:16:41.610", "cvss": 9.8, "confidence": 80, "confidence_label": "review", "affected": "3.8.0 through 3.9.1 (semver)", "fixed": "See vendor advisory", "source_count": 10, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-347", "what_happened": "In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role, with no account and no RoleBinding. The attacker can open an exec or log session for a microservice or fog whose UUID they already know. HTTP routes are not affected: they verify the token before RBAC. Agent WebSockets verify the fog token and are not affected.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for CVE-2026-113620", "summary": "Unverified JWT in Eclipse ioFog operator WebSocket allows unauthorized access to sessions.", "what_happened": "Unverified JWT in Eclipse ioFog operator WebSocket allows unauthorized access to sessions.", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=CVE-2026-113620", "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-113620" ], "repository": "Sploitus", "author": "eclipse", "first_seen": "2026-10-20T13:16:41", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=CVE-2026-113620" }, { "title": "Exploit for CVE-2026-113620", "summary": "Unverified JWT in Eclipse ioFog operator WebSocket allows unauthorized access to sessions.", "what_happened": "Unverified JWT in Eclipse ioFog operator WebSocket allows unauthorized access to sessions.", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=CVE-2026-113620", "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-113620" ], "repository": "web.nvd.nist.gov", "author": "view", "first_seen": "2026-10-20T13:16:41", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-113620" } ], "references": [ "https://sploitus.com/exploit?id=CVE-2026-113620", "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-113620", "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/468", "https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1267", "https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1269", "https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1270" ], "timeline": [ { "at": "2026-10-20T11:16:41Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=CVE-2026-113620" }, { "at": "2026-10-20T13:16:41.610", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113620" } ], "enrichment_checked_at": "2026-10-20T16:06:01Z", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "id": "CVE-2026-113468", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Exploit for CVE-2026-113468", "summary": "Proof-of-concept exploit for CVE-2026-113468. CVSS 6.9.", "updated_at": "2026-10-20T17:45:28Z", "published_at": "2026-10-20T17:45:28Z", "cvss": 6.9, "confidence": 55, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-10-20T17:45:28+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "Exploit for CVE-2026-113468", "summary": "Proof-of-concept exploit for CVE-2026-113468. CVSS 6.9.", "cvss": 6.9, "url": "https://sploitus.com/exploit?id=AFED6915-CF9C-51D8-AA81-2FC84D0895DE" } ], "references": [ "https://sploitus.com/exploit?id=AFED6915-CF9C-51D8-AA81-2FC84D0895DE" ], "timeline": [ { "at": "2026-10-20T17:45:28Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=AFED6915-CF9C-51D8-AA81-2FC84D0895DE" } ] }, { "id": "CVE-2026-113391", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Exploit for CVE-2026-113391", "summary": "Remote command injection in DrayTek Vigor2960 Upload Endpoint uploadlangs function.", "updated_at": "2026-10-20T11:16:40Z", "published_at": "2026-10-20T11:16:40Z", "cvss": 9.9, "confidence": 80, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "what_happened": "Remote command injection in DrayTek Vigor2960 Upload Endpoint uploadlangs function.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for CVE-2026-113391", "summary": "Remote command injection in DrayTek Vigor2960 Upload Endpoint uploadlangs function.", "what_happened": "Remote command injection in DrayTek Vigor2960 Upload Endpoint uploadlangs function.", "cvss": 9.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C", "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=CVE-2026-113391", "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-113391" ], "repository": "Sploitus", "author": "VulDB", "first_seen": "2026-10-20T13:16:40", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=CVE-2026-113391" }, { "title": "Exploit for CVE-2026-113391", "summary": "Remote command injection in DrayTek Vigor2960 Upload Endpoint uploadlangs function.", "what_happened": "Remote command injection in DrayTek Vigor2960 Upload Endpoint uploadlangs function.", "cvss": 9.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C", "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=CVE-2026-113391", "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-113391" ], "repository": "web.nvd.nist.gov", "author": "view", "first_seen": "2026-10-20T13:16:40", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-113391" } ], "references": [ "https://sploitus.com/exploit?id=CVE-2026-113391", "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-113391" ], "timeline": [ { "at": "2026-10-20T11:16:40Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=CVE-2026-113391" } ], "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C" }, { "id": "CVE-2026-113390", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2026-113390 exploit", "summary": "Exploit for CVE-2026-113390. CVSS 9.9.", "updated_at": "2026-10-20T12:30:17Z", "published_at": "2026-10-20T12:30:17Z", "cvss": 9.9, "confidence": 80, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Remote OS command injection in DrayTek Vigor2960 CGI Interface via mainfunction.cgi.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for CVE-2026-113390", "summary": "Remote OS command injection in DrayTek Vigor2960 CGI Interface via mainfunction.cgi.", "what_happened": "Remote OS command injection in DrayTek Vigor2960 CGI Interface via mainfunction.cgi.", "cvss": 9.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RC:R", "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=CVE-2026-113390", "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-113390" ], "repository": "Sploitus", "author": "VulDB", "first_seen": "2026-10-20T13:16:40", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=CVE-2026-113390" }, { "title": "Exploit for CVE-2026-113390", "summary": "Remote OS command injection in DrayTek Vigor2960 CGI Interface via mainfunction.cgi.", "what_happened": "Remote OS command injection in DrayTek Vigor2960 CGI Interface via mainfunction.cgi.", "cvss": 9.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RC:R", "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=CVE-2026-113390", "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-113390" ], "repository": "web.nvd.nist.gov", "author": "view", "first_seen": "2026-10-20T13:16:40", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-113390" } ], "references": [ "https://sploitus.com/exploit?id=CVE-2026-113390", "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-113390" ], "timeline": [ { "at": "2026-10-20T12:30:17Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=CVE-2026-113390" } ] }, { "id": "CVE-2026-113389", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2026-113389 exploit", "summary": "Exploit for CVE-2026-113389. CVSS 9.9.", "updated_at": "2026-10-20T12:00:14Z", "published_at": "2026-10-20T12:00:14Z", "cvss": 9.9, "confidence": 80, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Remote command injection in DrayTek Vigor2960 CGI Process via set_table sectiontype.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for CVE-2026-113389", "summary": "Remote command injection in DrayTek Vigor2960 CGI Process via set_table sectiontype.", "what_happened": "Remote command injection in DrayTek Vigor2960 CGI Process via set_table sectiontype.", "cvss": 9.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RC:R", "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=CVE-2026-113389", "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-113389" ], "repository": "Sploitus", "author": "VulDB", "first_seen": "2026-10-20T12:17:29", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=CVE-2026-113389" }, { "title": "Exploit for CVE-2026-113389", "summary": "Remote command injection in DrayTek Vigor2960 CGI Process via set_table sectiontype.", "what_happened": "Remote command injection in DrayTek Vigor2960 CGI Process via set_table sectiontype.", "cvss": 9.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RC:R", "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=CVE-2026-113389", "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-113389" ], "repository": "web.nvd.nist.gov", "author": "view", "first_seen": "2026-10-20T12:17:29", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-113389" } ], "references": [ "https://sploitus.com/exploit?id=CVE-2026-113389", "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-113389" ], "timeline": [ { "at": "2026-10-20T12:00:14Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=CVE-2026-113389" } ] }, { "id": "CVE-2026-112071", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Exploit for CVE-2026-112071", "summary": "Proof-of-concept exploit for CVE-2026-112071. CVSS 6.9.", "updated_at": "2026-10-20T17:44:49Z", "published_at": "2026-10-20T17:44:49Z", "cvss": 6.9, "confidence": 55, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-10-20T17:44:49+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "Exploit for CVE-2026-112071", "summary": "Proof-of-concept exploit for CVE-2026-112071. CVSS 6.9.", "cvss": 6.9, "url": "https://sploitus.com/exploit?id=9158BA81-9322-51D3-A676-A16DB849A5AF" } ], "references": [ "https://sploitus.com/exploit?id=9158BA81-9322-51D3-A676-A16DB849A5AF" ], "timeline": [ { "at": "2026-10-20T17:44:49Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=9158BA81-9322-51D3-A676-A16DB849A5AF" } ] }, { "id": "CVE-2026-111943", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Exploit for emudhra-poc CVE-2026-111943", "summary": "Key-generation failure in eMudhra/emSign intermediate CA keys allows private key recovery.", "updated_at": "2026-10-20T16:47:04Z", "published_at": "2026-10-20T16:47:04Z", "cvss": 6, "confidence": 80, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Key-generation failure in eMudhra/emSign intermediate CA keys allows private key recovery.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for emudhra-poc CVE-2026-111943", "summary": "Key-generation failure in eMudhra/emSign intermediate CA keys allows private key recovery.", "what_happened": "Key-generation failure in eMudhra/emSign intermediate CA keys allows private key recovery.", "cvss": 6, "cvss_vector": "NONE", "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=850B2FC2-6C48-577E-8D4C-011B65C6F365", "https://github.com/thiefadjacent/emudhra-poc" ], "repository": "Sploitus", "author": "thiefadjacent", "first_seen": "2026-10-20T18:47:04", "confidence": "High", "verification": "verified", "verified": true, "verification_detail": "Sploitus reports working code with at least 90% confidence.", "url": "https://sploitus.com/exploit?id=850B2FC2-6C48-577E-8D4C-011B65C6F365" }, { "title": "Exploit for emudhra-poc CVE-2026-111943", "summary": "Key-generation failure in eMudhra/emSign intermediate CA keys allows private key recovery.", "what_happened": "Key-generation failure in eMudhra/emSign intermediate CA keys allows private key recovery.", "cvss": 6, "cvss_vector": "NONE", "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=850B2FC2-6C48-577E-8D4C-011B65C6F365", "https://github.com/thiefadjacent/emudhra-poc" ], "repository": "thiefadjacent/emudhra-poc", "author": "thiefadjacent", "first_seen": "2026-10-20T18:47:04", "confidence": "High", "verification": "verified", "verified": true, "verification_detail": "Linked by a Sploitus working-code assessment.", "url": "https://github.com/thiefadjacent/emudhra-poc" } ], "references": [ "https://sploitus.com/exploit?id=850B2FC2-6C48-577E-8D4C-011B65C6F365", "https://github.com/thiefadjacent/emudhra-poc" ], "timeline": [ { "at": "2026-10-20T16:47:04Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=850B2FC2-6C48-577E-8D4C-011B65C6F365" } ], "cvss_vector": "NONE" }, { "id": "CVE-2026-111942", "vendor": "hrisikeshpal", "product": "Blood_Bank_Management_System", "title": "Blood_Bank_Management_System vulnerability", "summary": "A weakness has been identified in hrisikeshpal Blood_Bank_Management_System 1.0.0. Impacted is an unknown function of the file /abs.php. This manipulation of the argument Search causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.", "updated_at": "2026-10-18T07:16:53.343", "published_at": "2026-10-18T07:16:53.343", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "1.0.0", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "A weakness has been identified in hrisikeshpal Blood_Bank_Management_System 1.0.0. Impacted is an unknown function of the file /abs.php. This manipulation of the argument Search causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/hrisikeshpal/Blood_Bank_Management_System/", "https://github.com/hrisikeshpal/Blood_Bank_Management_System/issues/1", "https://vuldb.com/cve/CVE-2026-111942", "https://vuldb.com/submit/1005422", "https://vuldb.com/vuln/421592", "https://vuldb.com/vuln/421592/cti" ], "timeline": [ { "at": "2026-10-18T07:16:53.343", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111942" } ] }, { "id": "CVE-2026-111934", "vendor": "coder", "product": "coder", "title": "coder vulnerability", "summary": "Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied X-Forwarded-For value instead of the client IP appended by a reverse proxy. Attackers can send forged X-Forwarded-For values through appending proxies to bypass per-IP rate limits on login, one-time passcode, and password validation endpoints, enabling brute-force attacks, and to falsify IP addresses recorded in audit logs.", "updated_at": "2026-10-17T19:16:36.497", "published_at": "2026-10-17T19:16:36.497", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 2.34.7 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-348", "what_happened": "Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied X-Forwarded-For value instead of the client IP appended by a reverse proxy. Attackers can send forged X-Forwarded-For values through appending proxies to bypass per-IP rate limits on login, one-time passcode, and password validation endpoints, enabling brute-force attacks, and to falsify IP addresses recorded in audit logs.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/coder/coder/security/advisories/GHSA-vprw-xcrv-287h", "https://www.vulncheck.com/advisories/coder-before-2.34.7-ip-spoofing-via-x-forwarded-for-header" ], "timeline": [ { "at": "2026-10-17T19:16:36.497", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111934" } ] }, { "id": "CVE-2026-111933", "vendor": "coder", "product": "coder", "title": "coder vulnerability", "summary": "Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string \"hunter2\" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password \"hunter2\" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.", "updated_at": "2026-10-17T19:16:36.360", "published_at": "2026-10-17T19:16:36.360", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "2.34.0 through before 2.34.2 (semver); 2.33.0 through before 2.33.8 (semver); 2.30.0 through before 2.32.7 (semver); before 2.29.17 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-203", "what_happened": "Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string \"hunter2\" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password \"hunter2\" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/coder/coder/security/advisories/GHSA-8fxq-53rx-ph5f", "https://www.vulncheck.com/advisories/coder-before-2.34.2-user-enumeration-via-login-placeholder-hash" ], "timeline": [ { "at": "2026-10-17T19:16:36.360", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111933" } ] }, { "id": "CVE-2026-111932", "vendor": "coder", "product": "coder", "title": "coder vulnerability", "summary": "Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store HTML markup in these settings that renders in the Coder dashboard and in SMTP notification emails sent to other deployment users.", "updated_at": "2026-10-17T19:16:36.217", "published_at": "2026-10-17T19:16:36.217", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "2.34.0 through before 2.34.2 (semver); 2.33.0 through before 2.33.8 (semver); 2.30.0 through before 2.32.7 (semver); before 2.29.17 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store HTML markup in these settings that renders in the Coder dashboard and in SMTP notification emails sent to other deployment users.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/coder/coder/security/advisories/GHSA-h58c-xccx-75m3", "https://www.vulncheck.com/advisories/coder-before-2.34.2-stored-html-injection-via-appearance-settings" ], "timeline": [ { "at": "2026-10-17T19:16:36.217", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111932" } ] }, { "id": "CVE-2026-111931", "vendor": "coder", "product": "coder", "title": "coder vulnerability", "summary": "Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally via unsanitized r.URL.Path values. Attackers can craft links on trusted workspace app subdomains with paths beginning with double slashes, which become scheme-relative redirects to attacker sites for phishing.", "updated_at": "2026-10-17T19:16:36.080", "published_at": "2026-10-17T19:16:36.080", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "2.0.0 through before 2.34.8 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-601", "what_happened": "Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally via unsanitized r.URL.Path values. Attackers can craft links on trusted workspace app subdomains with paths beginning with double slashes, which become scheme-relative redirects to attacker sites for phishing.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/coder/coder/security/advisories/GHSA-98qx-9p2x-c4wh", "https://www.vulncheck.com/advisories/coder-2.0.0-before-2.34.8-open-redirect-via-workspace-app-proxy" ], "timeline": [ { "at": "2026-10-17T19:16:36.080", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111931" } ] }, { "id": "CVE-2026-111930", "vendor": "coder", "product": "coder", "title": "coder vulnerability", "summary": "Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint to harvest group members' emails, login types, status, and last-seen and creation timestamps.", "updated_at": "2026-10-17T19:16:35.940", "published_at": "2026-10-17T19:16:35.940", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "2.26.0 through before 2.34.8 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-200", "what_happened": "Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint to harvest group members' emails, login types, status, and last-seen and creation timestamps.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/coder/coder/security/advisories/GHSA-cvrm-2xxr-hpcv", "https://www.vulncheck.com/advisories/coder-from-2.26.0-before-2.34.8-information-disclosure-via-workspace-acl-endpoint" ], "timeline": [ { "at": "2026-10-17T19:16:35.940", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111930" } ] }, { "id": "CVE-2026-111929", "vendor": "coder", "product": "coder", "title": "coder vulnerability", "summary": "Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a known file UUID can retrieve module source code exposing infrastructure topology or embedded secrets.", "updated_at": "2026-10-17T19:16:35.807", "published_at": "2026-10-17T19:16:35.807", "cvss": 6, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "2.30.0 through before 2.34.8 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "High", "cwe": "CWE-863", "what_happened": "Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a known file UUID can retrieve module source code exposing infrastructure topology or embedded secrets.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/coder/coder/security/advisories/GHSA-hrhj-hpwc-9hmc", "https://www.vulncheck.com/advisories/coder-2.30.0-before-2.34.8-cross-organization-file-disclosure-via-downloadfile-rpc" ], "timeline": [ { "at": "2026-10-17T19:16:35.807", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111929" } ] }, { "id": "CVE-2026-111928", "vendor": "coder", "product": "coder", "title": "coder vulnerability", "summary": "Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of coderd/rbac/policy.rego, which does not verify organization membership for per-user ACL entries, and organization member removal does not scrub those entries. Authenticated users removed from an organization can keep accessing previously granted org-scoped resources such as templates and workspaces via the API.", "updated_at": "2026-10-17T19:16:35.673", "published_at": "2026-10-17T19:16:35.673", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "2.0.0 through before 2.34.8 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-863", "what_happened": "Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of coderd/rbac/policy.rego, which does not verify organization membership for per-user ACL entries, and organization member removal does not scrub those entries. Authenticated users removed from an organization can keep accessing previously granted org-scoped resources such as templates and workspaces via the API.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/coder/coder/security/advisories/GHSA-7v78-w67v-pm2g", "https://www.vulncheck.com/advisories/coder-2.0.0-before-2.34.8-authorization-bypass-via-user-level-acl-in-rbac-policy" ], "timeline": [ { "at": "2026-10-17T19:16:35.673", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111928" } ] }, { "id": "CVE-2026-111927", "vendor": "coder", "product": "coder", "title": "coder vulnerability", "summary": "Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trusted as a proxy. Attackers owning such a domain can lure an authenticated victim to a crafted /api/v2/applications/auth-redirect link, capture the redirected application_connect API key, and replay it to access the victim's workspace apps.", "updated_at": "2026-10-17T19:16:35.527", "published_at": "2026-10-17T19:16:35.527", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "2.35.0 through before 2.35.4 (semver); 2.34.0 through before 2.34.8 (semver); 2.33.0 through before 2.33.12 (semver); before 2.29.20 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "High", "cwe": "CWE-522", "what_happened": "Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trusted as a proxy. Attackers owning such a domain can lure an authenticated victim to a crafted /api/v2/applications/auth-redirect link, capture the redirected application_connect API key, and replay it to access the victim's workspace apps.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/coder/coder/security/advisories/GHSA-h58h-qvv5-xvwg", "https://www.vulncheck.com/advisories/coder-before-2.35.4-credential-theft-via-workspace-proxy-hostname-prefix-match" ], "timeline": [ { "at": "2026-10-17T19:16:35.527", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111927" } ] }, { "id": "CVE-2026-111926", "vendor": "coder", "product": "coder", "title": "coder vulnerability", "summary": "Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this endpoint to read credentials such as cloud keys or registry tokens.", "updated_at": "2026-10-17T19:16:35.390", "published_at": "2026-10-17T19:16:35.390", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "2.10.0 through before 2.34.8 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-200", "what_happened": "Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this endpoint to read credentials such as cloud keys or registry tokens.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/coder/coder/security/advisories/GHSA-73wg-wxvv-9r4j", "https://www.vulncheck.com/advisories/coder-from-2.10.0-before-2.34.8-information-disclosure-via-agent-debug-manifest" ], "timeline": [ { "at": "2026-10-17T19:16:35.390", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111926" } ] }, { "id": "CVE-2026-111924", "vendor": "fleetdm", "product": "fleet", "title": "fleet vulnerability", "summary": "Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during decoding, crashing the entire Fleet instance.", "updated_at": "2026-10-17T19:16:35.257", "published_at": "2026-10-17T19:16:35.257", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 4.83.0 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-409", "what_happened": "Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during decoding, crashing the entire Fleet instance.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/fleetdm/fleet/security/advisories/GHSA-3982-g48v-9rwh", "https://www.vulncheck.com/advisories/fleet-before-4.83.0-denial-of-service-via-unbounded-gzip-decompression" ], "timeline": [ { "at": "2026-10-17T19:16:35.257", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111924" } ] }, { "id": "CVE-2026-111923", "vendor": "fleetdm", "product": "fleet", "title": "fleet vulnerability", "summary": "Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment endpoints, triggering exponential allocation or infinite recursion that exhausts CPU and memory.", "updated_at": "2026-10-17T19:16:35.117", "published_at": "2026-10-17T19:16:35.117", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 4.89.0 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-674", "what_happened": "Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment endpoints, triggering exponential allocation or infinite recursion that exhausts CPU and memory.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/fleetdm/fleet/security/advisories/GHSA-x467-vgxf-2g6h", "https://www.vulncheck.com/advisories/fleet-before-4.89.0-unauthenticated-dos-via-apple-mdm-enrollment-plist-parsing" ], "timeline": [ { "at": "2026-10-17T19:16:35.117", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111923" } ] }, { "id": "CVE-2026-111922", "vendor": "go-vikunja", "product": "vikunja", "title": "vikunja vulnerability", "summary": "Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers controlling a page on any localhost port can send a credentialed request to the token refresh endpoint and read the returned bearer JWT to take over the logged-in user's account.", "updated_at": "2026-10-17T19:16:34.957", "published_at": "2026-10-17T19:16:34.957", "cvss": 7.2, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "2.2.0 through before 2.7.0 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-942", "what_happened": "Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers controlling a page on any localhost port can send a credentialed request to the token refresh endpoint and read the returned bearer JWT to take over the logged-in user's account.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m687-p538-r5hp", "https://www.vulncheck.com/advisories/vikunja-2.2.0-before-2.7.0-permissive-cors-policy-trusting-localhost-origins" ], "timeline": [ { "at": "2026-10-17T19:16:34.957", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111922" } ] }, { "id": "CVE-2026-111921", "vendor": "go-vikunja", "product": "vikunja", "title": "vikunja vulnerability", "summary": "Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permission to delete admin-tier link shares because the delete permission check reads an unloaded share object. Attackers can send DELETE requests to the v1 or v2 projects shares endpoints with sequential share IDs to revoke admin links and invalidate existing share sessions.", "updated_at": "2026-10-17T19:16:34.820", "published_at": "2026-10-17T19:16:34.820", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0.13.0 through before 2.7.0 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-863", "what_happened": "Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permission to delete admin-tier link shares because the delete permission check reads an unloaded share object. Attackers can send DELETE requests to the v1 or v2 projects shares endpoints with sequential share IDs to revoke admin links and invalidate existing share sessions.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fmmf-xq98-g327", "https://www.vulncheck.com/advisories/vikunja-0.13.0-before-2.7.0-incorrect-authorization-in-link-share-deletion" ], "timeline": [ { "at": "2026-10-17T19:16:34.820", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111921" } ] }, { "id": "CVE-2026-111920", "vendor": "go-vikunja", "product": "vikunja", "title": "vikunja vulnerability", "summary": "Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser (pkg/models/project_access.go), which resolves a user's effective project permission as the maximum over the project tree, silently overriding explicit lower-permission shares on sub-projects. A collaborator with write access on a parent project but read-only access to a child project can modify the child project's tasks and content.", "updated_at": "2026-10-17T19:16:34.680", "published_at": "2026-10-17T19:16:34.680", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "2.6.0 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-269", "what_happened": "Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser (pkg/models/project_access.go), which resolves a user's effective project permission as the maximum over the project tree, silently overriding explicit lower-permission shares on sub-projects. A collaborator with write access on a parent project but read-only access to a child project can modify the child project's tasks and content.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-pjr3-86v4-5p7w", "https://www.vulncheck.com/advisories/vikunja-2.6.0-broken-access-control-via-inherited-project-permissions" ], "timeline": [ { "at": "2026-10-17T19:16:34.680", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111920" } ] }, { "id": "CVE-2026-111919", "vendor": "go-vikunja", "product": "vikunja", "title": "vikunja vulnerability", "summary": "Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after their access was revoked.", "updated_at": "2026-10-17T19:16:34.543", "published_at": "2026-10-17T19:16:34.543", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0.22.0 through before 2.7.0 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-613", "what_happened": "Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after their access was revoked.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-hjx8-qv73-f7cm", "https://www.vulncheck.com/advisories/vikunja-0.22.0-before-2.7.0-improper-access-revocation-via-webhooks" ], "timeline": [ { "at": "2026-10-17T19:16:34.543", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111919" } ] }, { "id": "CVE-2026-111918", "vendor": "go-vikunja", "product": "vikunja", "title": "vikunja vulnerability", "summary": "Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write task_positions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing default_project_id, then create empty-filter saved filters to persist cross-tenant references and amplify writes for denial of service.", "updated_at": "2026-10-17T19:16:34.403", "published_at": "2026-10-17T19:16:34.403", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "1.0.0-rc0 through before 2.7.0 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-863", "what_happened": "Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write task_positions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing default_project_id, then create empty-filter saved filters to persist cross-tenant references and amplify writes for denial of service.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fprf-r6rv-xg99", "https://www.vulncheck.com/advisories/vikunja-1.0.0-rc0-before-2.7.0-cross-tenant-task-position-writes-via-saved-filter-creation" ], "timeline": [ { "at": "2026-10-17T19:16:34.403", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111918" } ] }, { "id": "CVE-2026-111917", "vendor": "go-vikunja", "product": "vikunja", "title": "vikunja vulnerability", "summary": "Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks the JWT sid claim against the sessions table. Attackers holding a stolen access token can open or maintain connections to /api/v2/ws after session deletion or TOTP enrollment, continuing to receive the victim's notification.created pushes, including comment, task and project content.", "updated_at": "2026-10-17T19:16:34.263", "published_at": "2026-10-17T19:16:34.263", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "2.3.0 through before 2.7.0 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-613", "what_happened": "Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks the JWT sid claim against the sessions table. Attackers holding a stolen access token can open or maintain connections to /api/v2/ws after session deletion or TOTP enrollment, continuing to receive the victim's notification.created pushes, including comment, task and project content.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-4hv6-xc92-j86g", "https://www.vulncheck.com/advisories/vikunja-2.3.0-before-2.7.0-websocket-authentication-ignores-session-revocation" ], "timeline": [ { "at": "2026-10-17T19:16:34.263", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111917" } ] }, { "id": "CVE-2026-111916", "vendor": "Admidio", "product": "admidio", "title": "admidio vulnerability", "summary": "Admidio before 5.0.16 contains an information disclosure vulnerability that allows unauthenticated attackers to view role-restricted weblinks because rss/links.php omits the category_view role-visibility filter. Attackers can request the weblinks RSS feed for an organization to retrieve link names, URLs, descriptions, categories, and creator names from restricted LNK categories.", "updated_at": "2026-10-17T19:16:34.127", "published_at": "2026-10-17T19:16:34.127", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 5.0.16 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Admidio before 5.0.16 contains an information disclosure vulnerability that allows unauthenticated attackers to view role-restricted weblinks because rss/links.php omits the category_view role-visibility filter. Attackers can request the weblinks RSS feed for an organization to retrieve link names, URLs, descriptions, categories, and creator names from restricted LNK categories.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/Admidio/admidio/security/advisories/GHSA-552r-jc93-7qr3", "https://www.vulncheck.com/advisories/admidio-before-5.0.16-information-disclosure-via-rss-links-php-weblinks-feed" ], "timeline": [ { "at": "2026-10-17T19:16:34.127", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111916" } ] }, { "id": "CVE-2026-111914", "vendor": "Admidio", "product": "admidio", "title": "admidio vulnerability", "summary": "Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated users to bypass the inventory_module_enabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory item and keeper names, even when the module is disabled.", "updated_at": "2026-10-17T19:16:33.963", "published_at": "2026-10-17T19:16:33.963", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "5.0.11 through before 5.0.16 (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated users to bypass the inventory_module_enabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory item and keeper names, even when the module is disabled.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/Admidio/admidio/security/advisories/GHSA-5f29-r7rj-43mf", "https://github.com/Admidio/admidio/security/advisories/GHSA-qfjf-c48f-x87g", "https://www.vulncheck.com/advisories/admidio-5.0.11-before-5.0.16-broken-access-control-via-inventory-data-php" ], "timeline": [ { "at": "2026-10-17T19:16:33.963", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111914" } ] }, { "id": "CVE-2026-111913", "vendor": "Admidio", "product": "admidio", "title": "admidio vulnerability", "summary": "Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability that allows authenticated users to export lists despite export restrictions by requesting mode=pdfl. The groups_roles_export check in modules/groups-roles/lists_show.php omits pdfl, which later runs the pdf export, letting users with list view rights download member lists as PDF files.", "updated_at": "2026-10-17T19:16:33.823", "published_at": "2026-10-17T19:16:33.823", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "5.0.0 through before 5.0.16 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-285", "what_happened": "Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability that allows authenticated users to export lists despite export restrictions by requesting mode=pdfl. The groups_roles_export check in modules/groups-roles/lists_show.php omits pdfl, which later runs the pdf export, letting users with list view rights download member lists as PDF files.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/Admidio/admidio/security/advisories/GHSA-86f5-rg96-frrj", "https://www.vulncheck.com/advisories/admidio-5.0.0-before-5.0.16-authorization-bypass-via-pdfl-mode-in-lists-show-php" ], "timeline": [ { "at": "2026-10-17T19:16:33.823", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111913" } ] }, { "id": "CVE-2026-111912", "vendor": "Admidio", "product": "admidio", "title": "admidio vulnerability", "summary": "Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic() that allows authenticated members to modify other users' forum topics. Attackers can replace the topic_uuid parameter in their own topic_save request, reusing their CSRF token, to overwrite the victim topic's title and first post.", "updated_at": "2026-10-17T19:16:33.687", "published_at": "2026-10-17T19:16:33.687", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "5.0.0 through before 5.0.16 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-639", "what_happened": "Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic() that allows authenticated members to modify other users' forum topics. Attackers can replace the topic_uuid parameter in their own topic_save request, reusing their CSRF token, to overwrite the victim topic's title and first post.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/Admidio/admidio/security/advisories/GHSA-8256-4wm7-f628", "https://www.vulncheck.com/advisories/admidio-5.0.0-before-5.0.16-idor-via-forum-topic-update" ], "timeline": [ { "at": "2026-10-17T19:16:33.687", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111912" } ] }, { "id": "CVE-2026-111911", "vendor": "thorsten", "product": "phpMyFAQ", "title": "phpMyFAQ vulnerability", "summary": "phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.", "updated_at": "2026-10-17T19:16:33.633", "published_at": "2026-10-17T19:16:33.500", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "4.0.0 through before 4.1.9 (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-287", "what_happened": "phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-g6cq-6rqg-6c9p", "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-rg9h-f29v-xhxr", "https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-authentication-bypass-via-webauthn-credential-injection" ], "timeline": [ { "at": "2026-10-17T19:16:33.500", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111911" } ] }, { "id": "CVE-2026-111910", "vendor": "thorsten", "product": "phpMyFAQ", "title": "phpMyFAQ vulnerability", "summary": "phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of restricted FAQs by bypassing per-record permission checks. Low-privileged users with the dlattachment right, or anonymous users when allowDownloadsForGuests is enabled, can request attachment IDs to retrieve confidential files from restricted FAQs.", "updated_at": "2026-10-17T19:16:33.457", "published_at": "2026-10-17T19:16:33.343", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 4.1.9 (semver); 4.2.0-alpha through before 4.2.0-beta (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of restricted FAQs by bypassing per-record permission checks. Low-privileged users with the dlattachment right, or anonymous users when allowDownloadsForGuests is enabled, can request attachment IDs to retrieve confidential files from restricted FAQs.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pp67-9fv9-ph7q", "https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-authorization-bypass-via-attachment-php-downloads" ], "timeline": [ { "at": "2026-10-17T19:16:33.343", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111910" } ] }, { "id": "CVE-2026-111909", "vendor": "thorsten", "product": "phpMyFAQ", "title": "phpMyFAQ vulnerability", "summary": "phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1, removing administrative access and accountability.", "updated_at": "2026-10-17T19:16:33.300", "published_at": "2026-10-17T19:16:33.190", "cvss": 7.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 4.1.9 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-269", "what_happened": "phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1, removing administrative access and accountability.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7j43-ww55-pm3g", "https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-missing-authorization-allows-superadmin-deletion-via-deleteuser-api" ], "timeline": [ { "at": "2026-10-17T19:16:33.190", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111909" } ] }, { "id": "CVE-2026-111908", "vendor": "thorsten", "product": "phpMyFAQ", "title": "phpMyFAQ vulnerability", "summary": "phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify access to the target FAQ. Authenticated users with edit_faq permission can supply the ID of a restricted FAQ they cannot view to modify its content, bypass moderation, and change its publication state.", "updated_at": "2026-10-17T19:16:33.153", "published_at": "2026-10-17T19:16:33.043", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "4.0.0 through before 4.1.9 (semver); 4.2.0-alpha through before 4.2.0-beta (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-639", "what_happened": "phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify access to the target FAQ. Authenticated users with edit_faq permission can supply the ID of a restricted FAQ they cannot view to modify its content, bypass moderation, and change its publication state.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j3px-r7cr-r26r", "https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-bola-in-faq-update-via-rest-api" ], "timeline": [ { "at": "2026-10-17T19:16:33.043", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111908" } ] }, { "id": "CVE-2026-111907", "vendor": "thorsten", "product": "phpMyFAQ", "title": "phpMyFAQ vulnerability", "summary": "phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATION_EDIT permission into submitting a crafted cross-site request, triggering migrations that may impact database integrity or availability.", "updated_at": "2026-10-17T19:16:32.993", "published_at": "2026-10-17T19:16:32.883", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "4.0.0 through before 4.1.9 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-352", "what_happened": "phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATION_EDIT permission into submitting a crafted cross-site request, triggering migrations that may impact database integrity or availability.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6x9g-rfx8-g42q", "https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-csrf-via-admin-api-update-database" ], "timeline": [ { "at": "2026-10-17T19:16:32.883", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111907" } ] }, { "id": "CVE-2026-111906", "vendor": "thorsten", "product": "phpMyFAQ", "title": "phpMyFAQ vulnerability", "summary": "phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which do not validate a CSRF token for the create, drop, and import actions. Attackers can lure a user with CONFIGURATION_EDIT permission to a malicious page that triggers these actions, deleting search indexes, forcing re-indexing, or exhausting resources.", "updated_at": "2026-10-17T19:16:32.837", "published_at": "2026-10-17T19:16:32.723", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 4.1.9 (semver); 4.2.0-alpha through before 4.2.0-beta (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-352", "what_happened": "phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which do not validate a CSRF token for the create, drop, and import actions. Attackers can lure a user with CONFIGURATION_EDIT permission to a malicious page that triggers these actions, deleting search indexes, forcing re-indexing, or exhausting resources.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-cmvh-fpmf-8gfx", "https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-csrf-in-elasticsearch-opensearch-admin-api-index-operations" ], "timeline": [ { "at": "2026-10-17T19:16:32.723", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111906" } ] }, { "id": "CVE-2026-111905", "vendor": "thorsten", "product": "phpMyFAQ", "title": "phpMyFAQ vulnerability", "summary": "phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/{userId}, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated administrators with user-management rights can read a SuperAdmin's TOTP secret and generate valid codes to bypass two-factor authentication.", "updated_at": "2026-10-17T19:16:32.677", "published_at": "2026-10-17T19:16:32.563", "cvss": 7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "3.2.0 through before 4.1.9 (semver); 4.2.0-alpha through before 4.2.0-beta (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-639", "what_happened": "phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/{userId}, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated administrators with user-management rights can read a SuperAdmin's TOTP secret and generate valid codes to bypass two-factor authentication.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hp8j-w94m-j5c7", "https://www.vulncheck.com/advisories/phpmyfaq-3.2.0-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-idor-leaks-totp-secret-via-admin-api-user-data" ], "timeline": [ { "at": "2026-10-17T19:16:32.563", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111905" } ] }, { "id": "CVE-2026-111904", "vendor": "thorsten", "product": "phpMyFAQ", "title": "phpMyFAQ vulnerability", "summary": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers to read hidden open questions due to an inverted api.onlyPublicQuestions check in OpenQuestionController. Attackers can send GET requests to the /api/v4.0/open-questions endpoint to retrieve non-public moderation or internal questions and their associated usernames.", "updated_at": "2026-10-17T19:16:32.520", "published_at": "2026-10-17T19:16:32.407", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "4.2.0-alpha through before 4.2.0-beta (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-200", "what_happened": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers to read hidden open questions due to an inverted api.onlyPublicQuestions check in OpenQuestionController. Attackers can send GET requests to the /api/v4.0/open-questions endpoint to retrieve non-public moderation or internal questions and their associated usernames.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6xm9-p734-8fx6", "https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-information-disclosure-via-open-questions-api" ], "timeline": [ { "at": "2026-10-17T19:16:32.407", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111904" } ] }, { "id": "CVE-2026-111903", "vendor": "thorsten", "product": "phpMyFAQ", "title": "phpMyFAQ vulnerability", "summary": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows users with FAQ_EDIT permission to bypass sanitization using XML DTD custom entities. Attackers can upload an SVG defining an entity that expands to javascript in an anchor href, executing script when viewers click it to hijack admin sessions.", "updated_at": "2026-10-17T19:16:32.367", "published_at": "2026-10-17T19:16:32.253", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "4.2.0-alpha through before 4.2.0-beta (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows users with FAQ_EDIT permission to bypass sanitization using XML DTD custom entities. Attackers can upload an SVG defining an entity that expands to javascript in an anchor href, executing script when viewers click it to hijack admin sessions.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j3v5-p957-w6gq", "https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-stored-xss-via-svg-dtd-entity-bypass" ], "timeline": [ { "at": "2026-10-17T19:16:32.253", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111903" } ] }, { "id": "CVE-2026-111902", "vendor": "thorsten", "product": "phpMyFAQ", "title": "phpMyFAQ vulnerability", "summary": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser() that treats a missing FAQ translation as visible to unauthenticated users. Attackers can send a mismatched Accept-Language header to the comments and attachments API endpoints to read comments and attachment listings of unpublished or ACL-restricted FAQs.", "updated_at": "2026-10-17T19:16:32.217", "published_at": "2026-10-17T19:16:32.103", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "4.2.0-alpha through before 4.2.0-beta (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-639", "what_happened": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser() that treats a missing FAQ translation as visible to unauthenticated users. Attackers can send a mismatched Accept-Language header to the comments and attachments API endpoints to read comments and attachment listings of unpublished or ACL-restricted FAQs.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-g6fj-8cjr-wrxv", "https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-authorization-bypass-via-comments-and-attachments-api" ], "timeline": [ { "at": "2026-10-17T19:16:32.103", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111902" } ] }, { "id": "CVE-2026-111901", "vendor": "thorsten", "product": "phpMyFAQ", "title": "phpMyFAQ vulnerability", "summary": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server.", "updated_at": "2026-10-17T19:16:32.063", "published_at": "2026-10-17T19:16:31.953", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "4.2.0-alpha through before 4.2.0-beta (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-400", "what_happened": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-m42f-6p37-2c79", "https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-unauthenticated-dos-via-api-pagination" ], "timeline": [ { "at": "2026-10-17T19:16:31.953", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111901" } ] }, { "id": "CVE-2026-111900", "vendor": "thorsten", "product": "phpMyFAQ", "title": "phpMyFAQ vulnerability", "summary": "phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is published or visible to the requester. Authenticated users with the dlattachment permission can request index.php?action=attachment&id= to download complete attachment files belonging to draft FAQs.", "updated_at": "2026-10-17T19:16:31.910", "published_at": "2026-10-17T19:16:31.800", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 4.1.9 (semver); 4.2.0-alpha through before 4.2.0-beta (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-863", "what_happened": "phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is published or visible to the requester. Authenticated users with the dlattachment permission can request index.php?action=attachment&id= to download complete attachment files belonging to draft FAQs.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-h76j-35m7-3mwq", "https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-draft-faq-attachment-disclosure-via-attachment-php" ], "timeline": [ { "at": "2026-10-17T19:16:31.800", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111900" } ] }, { "id": "CVE-2026-111898", "vendor": "thorsten", "product": "phpMyFAQ", "title": "phpMyFAQ vulnerability", "summary": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferred_username or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through /auth/keycloak/authorize to bind their subject and gain superadmin privileges.", "updated_at": "2026-10-17T19:16:31.757", "published_at": "2026-10-17T19:16:31.647", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "4.2.0-alpha through before 4.2.0-beta (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "High", "cwe": "CWE-287", "what_happened": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferred_username or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through /auth/keycloak/authorize to bind their subject and gain superadmin privileges.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-rg4w-2j3r-2hhp", "https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-account-takeover-via-keycloak-implicit-account-linking" ], "timeline": [ { "at": "2026-10-17T19:16:31.647", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111898" } ] }, { "id": "CVE-2026-111897", "vendor": "thorsten", "product": "phpMyFAQ", "title": "phpMyFAQ vulnerability", "summary": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their categories by supplying arbitrary record IDs. Attackers in medium permission mode can send upload or delete requests with a target record_id or attachment ID to tamper with or remove files on unauthorized FAQs.", "updated_at": "2026-10-17T19:16:31.600", "published_at": "2026-10-17T19:16:31.487", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "4.2.0-alpha through before 4.2.0-beta (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their categories by supplying arbitrary record IDs. Attackers in medium permission mode can send upload or delete requests with a target record_id or attachment ID to tamper with or remove files on unauthorized FAQs.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hj8v-cg6r-gg6q", "https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-authorization-bypass-in-attachment-administration-endpoints" ], "timeline": [ { "at": "2026-10-17T19:16:31.487", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111897" } ] }, { "id": "CVE-2026-111896", "vendor": "thorsten", "product": "phpMyFAQ", "title": "phpMyFAQ vulnerability", "summary": "phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows FAQ editors to store executable SVG files. Attackers can split script tags around removed tokens like processing instructions so single-pass removal reassembles them, executing script in the application origin when victims open the file.", "updated_at": "2026-10-17T19:16:31.447", "published_at": "2026-10-17T19:16:31.337", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "4.2.0-alpha through before 4.2.0-beta (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-182", "what_happened": "phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows FAQ editors to store executable SVG files. Attackers can split script tags around removed tokens like processing instructions so single-pass removal reassembles them, executing script in the application origin when victims open the file.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-95fm-rwq4-rxrf", "https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-stored-xss-via-svg-upload-sanitizer-bypass" ], "timeline": [ { "at": "2026-10-17T19:16:31.337", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111896" } ] }, { "id": "CVE-2026-111895", "vendor": "thorsten", "product": "phpMyFAQ", "title": "phpMyFAQ vulnerability", "summary": "phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferred_username claim and whose AuthEntraId::create() ignores the duplicate-login exception while continuing with the existing local account. Attackers controlling an Entra identity in the configured tenant with a matching preferred_username can take over that local account, including super-admin accounts.", "updated_at": "2026-10-17T19:16:31.290", "published_at": "2026-10-17T19:16:31.177", "cvss": 7.6, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "3.2.0 through before 4.0.0 (semver); 4.0.2 through before 4.2.0-beta (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "High", "cwe": "CWE-287", "what_happened": "phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferred_username claim and whose AuthEntraId::create() ignores the duplicate-login exception while continuing with the existing local account. Attackers controlling an Entra identity in the configured tenant with a matching preferred_username can take over that local account, including super-admin accounts.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6hhv-gc4g-f4r7", "https://www.vulncheck.com/advisories/phpmyfaq-3.2.0-before-4.0.0-and-4.0.2-before-4.2.0-beta-account-takeover-via-entra-id-preferred-username" ], "timeline": [ { "at": "2026-10-17T19:16:31.177", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111895" } ] }, { "id": "CVE-2026-111894", "vendor": "thorsten", "product": "phpMyFAQ", "title": "phpMyFAQ vulnerability", "summary": "phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content. Attackers can bypass the hostless media-host allowlist in FaqHelper::cleanUpContent(), which is rendered via Twig's raw filter, to run phishing interfaces or top-frame redirects for viewers.", "updated_at": "2026-10-17T19:16:31.130", "published_at": "2026-10-17T19:16:31.017", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "3.2.1 through before 4.1.9 (semver); 4.2.0-alpha through before 4.2.0-beta (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content. Attackers can bypass the hostless media-host allowlist in FaqHelper::cleanUpContent(), which is rendered via Twig's raw filter, to run phishing interfaces or top-frame redirects for viewers.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-fg92-v5rr-4xjq", "https://www.vulncheck.com/advisories/phpmyfaq-3.2.1-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-stored-xss-via-iframe-data-uri" ], "timeline": [ { "at": "2026-10-17T19:16:31.017", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111894" } ] }, { "id": "CVE-2026-111893", "vendor": "thorsten", "product": "phpMyFAQ", "title": "phpMyFAQ vulnerability", "summary": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions() that lets delegated administrators assign categories outside their own scope. Category-restricted administrators can POST to /admin/api/group/category-restrictions with out-of-scope or empty categoryIds to grant groups unrestricted category access.", "updated_at": "2026-10-17T19:16:30.970", "published_at": "2026-10-17T19:16:30.860", "cvss": 8.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "4.2.0-alpha through before 4.2.0-beta (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-269", "what_happened": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions() that lets delegated administrators assign categories outside their own scope. Category-restricted administrators can POST to /admin/api/group/category-restrictions with out-of-scope or empty categoryIds to grant groups unrestricted category access.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gv7w-78f6-mcmh", "https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-privilege-escalation-via-group-category-restrictions-api" ], "timeline": [ { "at": "2026-10-17T19:16:30.860", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111893" } ] }, { "id": "CVE-2026-111892", "vendor": "thorsten", "product": "phpMyFAQ", "title": "phpMyFAQ vulnerability", "summary": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user/password/update and user/password/reset endpoints. Unauthenticated attackers can send unlimited reset requests to flood a registered user's inbox with reset emails, exhausting mailer and server resources.", "updated_at": "2026-10-17T19:16:30.817", "published_at": "2026-10-17T19:16:30.703", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "4.2.0-alpha through before 4.2.0-beta (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-307", "what_happened": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user/password/update and user/password/reset endpoints. Unauthenticated attackers can send unlimited reset requests to flood a registered user's inbox with reset emails, exhausting mailer and server resources.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-p2cj-r7vv-fr2r", "https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-missing-rate-limiting-on-password-reset-endpoints" ], "timeline": [ { "at": "2026-10-17T19:16:30.703", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111892" } ] }, { "id": "CVE-2026-111891", "vendor": "thorsten", "product": "phpMyFAQ", "title": "phpMyFAQ vulnerability", "summary": "phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and updateMembers endpoints check held rights without regard to language or category scope and write unrestricted group grants. Non-superadmin administrators holding GROUP_EDIT can grant a group a right they hold only in a narrow scope and self-join it via updateMembers, gaining unrestricted FAQ create, edit, and publish access across all languages and categories.", "updated_at": "2026-10-17T19:16:30.660", "published_at": "2026-10-17T19:16:30.550", "cvss": 7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "4.2.0-alpha.2 through before 4.2.0-beta (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-269", "what_happened": "phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and updateMembers endpoints check held rights without regard to language or category scope and write unrestricted group grants. Non-superadmin administrators holding GROUP_EDIT can grant a group a right they hold only in a narrow scope and self-join it via updateMembers, gaining unrestricted FAQ create, edit, and publish access across all languages and categories.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6vf7-mrj2-7c37", "https://www.vulncheck.com/advisories/phpmyfaq-from-4.2.0-alpha.2-before-4.2.0-beta-privilege-escalation-via-group-permissions-api" ], "timeline": [ { "at": "2026-10-17T19:16:30.550", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111891" } ] }, { "id": "CVE-2026-111890", "vendor": "thorsten", "product": "phpMyFAQ", "title": "phpMyFAQ vulnerability", "summary": "phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions when rights are re-granted. Administrators holding USER_EDIT can submit language-scoped rights to the update-rights API, including for themselves, to gain unrestricted FAQ create, edit, and publish access across all languages.", "updated_at": "2026-10-17T19:16:30.507", "published_at": "2026-10-17T19:16:30.393", "cvss": 7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "4.2.0-alpha.2 through before 4.2.0-beta (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-269", "what_happened": "phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions when rights are re-granted. Administrators holding USER_EDIT can submit language-scoped rights to the update-rights API, including for themselves, to gain unrestricted FAQ create, edit, and publish access across all languages.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-3666-fmjj-qm5h", "https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha.2-before-4.2.0-beta-privilege-escalation-via-updateuserrights" ], "timeline": [ { "at": "2026-10-17T19:16:30.393", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111890" } ] }, { "id": "CVE-2026-111889", "vendor": "thorsten", "product": "phpMyFAQ", "title": "phpMyFAQ vulnerability", "summary": "phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows authenticated users without admin rights to view restricted data. Attackers with any activated account can request /admin/index.php/ to read unpublished FAQ questions, admin edit URLs, recent user identities, and site statistics.", "updated_at": "2026-10-17T19:16:30.350", "published_at": "2026-10-17T19:16:30.237", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "4.1.0 through before 4.1.9 (semver); 4.2.0-alpha through before 4.2.0-beta (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows authenticated users without admin rights to view restricted data. Attackers with any activated account can request /admin/index.php/ to read unpublished FAQ questions, admin edit URLs, recent user identities, and site statistics.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-4378-pcwq-fc29", "https://www.vulncheck.com/advisories/phpmyfaq-4.1.0-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-missing-authorization-via-admin-dashboard" ], "timeline": [ { "at": "2026-10-17T19:16:30.237", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111889" } ] }, { "id": "CVE-2026-111888", "vendor": "thorsten", "product": "phpMyFAQ", "title": "phpMyFAQ vulnerability", "summary": "phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWS_DELETE instead of NEWS_EDIT. Attackers holding addnews and delnews can read the update-news CSRF token from their own cookie and rewrite any news item's header, body, author, link and active flag shown on the public front page.", "updated_at": "2026-10-17T19:16:30.197", "published_at": "2026-10-17T19:16:30.080", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "4.0.0 through before 4.1.9 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-863", "what_happened": "phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWS_DELETE instead of NEWS_EDIT. Attackers holding addnews and delnews can read the update-news CSRF token from their own cookie and rewrite any news item's header, body, author, link and active flag shown on the public front page.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-287v-6c6j-x9f7", "https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-incorrect-authorization-via-news-update-api" ], "timeline": [ { "at": "2026-10-17T19:16:30.080", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111888" } ] }, { "id": "CVE-2026-111887", "vendor": "thorsten", "product": "phpMyFAQ", "title": "phpMyFAQ vulnerability", "summary": "phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to confirm registered display names and emails via a distinct HTTP 409 response. Attackers can submit guest comments to the comment create endpoint with candidate user and mail values to link names to emails for targeted phishing.", "updated_at": "2026-10-17T19:16:30.040", "published_at": "2026-10-17T19:16:29.930", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 4.1.9 (semver); 4.2.0-alpha through before 4.2.0-beta (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-204", "what_happened": "phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to confirm registered display names and emails via a distinct HTTP 409 response. Attackers can submit guest comments to the comment create endpoint with candidate user and mail values to link names to emails for targeted phishing.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pgxw-7c68-83w7", "https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-account-enumeration-via-guest-comment-endpoint" ], "timeline": [ { "at": "2026-10-17T19:16:29.930", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111887" } ] }, { "id": "CVE-2026-111886", "vendor": "thorsten", "product": "phpMyFAQ", "title": "phpMyFAQ vulnerability", "summary": "phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpoint, allowing authenticated attackers to guess TOTP codes without limit. Attackers holding a hijacked session and CSRF token can repeatedly POST guesses to /api/user/remove-twofactor to permanently disable the victim's 2FA.", "updated_at": "2026-10-17T19:16:29.883", "published_at": "2026-10-17T19:16:29.770", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "4.2.0-alpha.2 through before 4.2.0-beta (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-307", "what_happened": "phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpoint, allowing authenticated attackers to guess TOTP codes without limit. Attackers holding a hijacked session and CSRF token can repeatedly POST guesses to /api/user/remove-twofactor to permanently disable the victim's 2FA.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7pjw-6v4g-f837", "https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha.2-before-4.2.0-beta-2fa-brute-force-via-remove-twofactor-endpoint" ], "timeline": [ { "at": "2026-10-17T19:16:29.770", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111886" } ] }, { "id": "CVE-2026-111885", "vendor": "thorsten", "product": "phpMyFAQ", "title": "phpMyFAQ vulnerability", "summary": "phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target groups. Authenticated non-SuperAdmin administrators holding GROUP_DELETE can send a crafted groupId to /admin/api/group/delete to permanently destroy higher-privileged groups and strip members' inherited rights.", "updated_at": "2026-10-17T19:16:29.723", "published_at": "2026-10-17T19:16:29.610", "cvss": 7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "4.2.0-alpha through before 4.2.0-beta (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-1220", "what_happened": "phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target groups. Authenticated non-SuperAdmin administrators holding GROUP_DELETE can send a crafted groupId to /admin/api/group/delete to permanently destroy higher-privileged groups and strip members' inherited rights.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-crh2-cv2j-cpjh", "https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-missing-authorization-via-deletegroup-api" ], "timeline": [ { "at": "2026-10-17T19:16:29.610", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111885" } ] }, { "id": "CVE-2026-111884", "vendor": "thorsten", "product": "phpMyFAQ", "title": "phpMyFAQ vulnerability", "summary": "phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF token. An attacker with a hijacked session can set the e-mail to their own mailbox and use the password-reset flow to take over non-2FA accounts, including superadmin.", "updated_at": "2026-10-17T19:16:29.563", "published_at": "2026-10-17T19:16:29.450", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 4.1.9 (semver); 4.2.0-alpha through before 4.2.0-beta (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-308", "what_happened": "phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF token. An attacker with a hijacked session can set the e-mail to their own mailbox and use the password-reset flow to take over non-2FA accounts, including superadmin.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7554-gx6g-xx77", "https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-missing-current-password-step-up-on-e-mail-change-enables-account-takeover" ], "timeline": [ { "at": "2026-10-17T19:16:29.450", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111884" } ] }, { "id": "CVE-2026-111882", "vendor": "thorsten", "product": "phpMyFAQ", "title": "phpMyFAQ vulnerability", "summary": "phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked to a 2FA-enabled account can complete the OIDC flow and obtain a fully authenticated session, including administrator accounts.", "updated_at": "2026-10-17T19:16:29.360", "published_at": "2026-10-17T19:16:29.240", "cvss": 8.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "3.2.0-alpha through before 4.1.9 (semver); 4.2.0-alpha through before 4.2.0-beta (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-287", "what_happened": "phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked to a 2FA-enabled account can complete the OIDC flow and obtain a fully authenticated session, including administrator accounts.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-43g3-pp5p-fg96", "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-8fvf-747v-qjr6", "https://www.vulncheck.com/advisories/phpmyfaq-3.2.0-alpha-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-totp-2fa-bypass-via-sso-callbacks" ], "timeline": [ { "at": "2026-10-17T19:16:29.240", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111882" } ] }, { "id": "CVE-2026-111881", "vendor": "FreeRDP", "product": "FreeRDP", "title": "FreeRDP vulnerability", "summary": "FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboard_synthesize_image_format_to_bmp for CF_DIB/CF_DIBV5, crashing the client or causing an out-of-bounds write.", "updated_at": "2026-10-17T19:16:29.103", "published_at": "2026-10-17T19:16:29.103", "cvss": 7.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "3.14.1 through before 3.32.0 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-191", "what_happened": "FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboard_synthesize_image_format_to_bmp for CF_DIB/CF_DIBV5, crashing the client or causing an out-of-bounds write.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-27m7-gwhh-6hhf", "https://www.vulncheck.com/advisories/freerdp-3.14.1-before-3.32.0-integer-underflow-in-bmp-writer-via-clipboard" ], "timeline": [ { "at": "2026-10-17T19:16:29.103", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111881" } ] }, { "id": "CVE-2026-111880", "vendor": "FreeRDP", "product": "FreeRDP", "title": "FreeRDP vulnerability", "summary": "FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATE_MESSAGE with a backward session-key offset and MIC offset to write 16 zero bytes beyond the allocation.", "updated_at": "2026-10-17T19:16:28.960", "published_at": "2026-10-17T19:16:28.960", "cvss": 8.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "2.0.0 through before 3.32.0 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-787", "what_happened": "FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATE_MESSAGE with a backward session-key offset and MIC offset to write 16 zero bytes beyond the allocation.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cmgx-558f-vh67", "https://www.vulncheck.com/advisories/freerdp-2.0.0-before-3.32.0-heap-out-of-bounds-write-via-ntlm-mic-offset" ], "timeline": [ { "at": "2026-10-17T19:16:28.960", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111880" } ] }, { "id": "CVE-2026-111877", "vendor": "dext34-morgan", "product": "Books4Cash", "title": "Books4Cash vulnerability", "summary": "A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571. This affects an unknown part of the file search.php. Executing a manipulation of the argument Search can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The code repository of the project has not been active for many years.", "updated_at": "2026-10-18T07:16:53.033", "published_at": "2026-10-18T07:16:53.033", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571. This affects an unknown part of the file search.php. Executing a manipulation of the argument Search can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The code repository of the project has not been active for many years.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://vuldb.com/cve/CVE-2026-111877", "https://vuldb.com/submit/1005404", "https://vuldb.com/vuln/421589", "https://vuldb.com/vuln/421589/cti" ], "timeline": [ { "at": "2026-10-18T07:16:53.033", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111877" } ] }, { "id": "CVE-2026-111876", "vendor": "alexpasmantier", "product": "television", "title": "television vulnerability", "summary": "A vulnerability was found in alexpasmantier television up to 0.15.9. Affected by this issue is the function Entry::output of the file television/channels/entry.rs. Performing a manipulation of the argument raw results in command injection. The attack requires a local approach. The reported GitHub issue was closed with the label \"not planned\".", "updated_at": "2026-10-18T06:16:57.047", "published_at": "2026-10-18T06:16:57.047", "cvss": 1.9, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0.15.0; 0.15.1; 0.15.2; 0.15.3; 0.15.4; 0.15.5; 0.15.6; 0.15.7; 0.15.8; 0.15.9", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-74", "what_happened": "A vulnerability was found in alexpasmantier television up to 0.15.9. Affected by this issue is the function Entry::output of the file television/channels/entry.rs. Performing a manipulation of the argument raw results in command injection. The attack requires a local approach. The reported GitHub issue was closed with the label \"not planned\".", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/alexpasmantier/television/", "https://github.com/alexpasmantier/television/issues/1124", "https://github.com/alexpasmantier/television/pull/1125", "https://vuldb.com/cve/CVE-2026-111876", "https://vuldb.com/submit/1005368", "https://vuldb.com/vuln/421588", "https://vuldb.com/vuln/421588/cti" ], "timeline": [ { "at": "2026-10-18T06:16:57.047", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111876" } ] }, { "id": "CVE-2026-111875", "vendor": "David-Crty", "product": "Databasement", "title": "Databasement vulnerability", "summary": "A vulnerability has been found in David-Crty Databasement up to 1.8.1. Affected by this vulnerability is an unknown functionality of the file app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php of the component Scheduled Restore. Such manipulation of the argument schema_name leads to missing authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.8.2 addresses this issue. It is suggested to upgrade the affected component.", "updated_at": "2026-10-18T06:16:57.003", "published_at": "2026-10-18T06:16:56.840", "cvss": 2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "1.8.0; 1.8.1", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-862", "what_happened": "A vulnerability has been found in David-Crty Databasement up to 1.8.1. Affected by this vulnerability is an unknown functionality of the file app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php of the component Scheduled Restore. Such manipulation of the argument schema_name leads to missing authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.8.2 addresses this issue. It is suggested to upgrade the affected component.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/David-Crty/databasement/", "https://github.com/David-Crty/databasement/releases/tag/v1.8.2", "https://github.com/David-Crty/databasement/security/advisories/GHSA-3rjj-69wh-r95f", "https://vuldb.com/cve/CVE-2026-111875", "https://vuldb.com/submit/1005220", "https://vuldb.com/vuln/421587", "https://vuldb.com/vuln/421587/cti" ], "timeline": [ { "at": "2026-10-18T06:16:56.840", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111875" } ] }, { "id": "CVE-2026-111874", "vendor": "n/a", "product": "OpenCATS", "title": "OpenCATS vulnerability", "summary": "A flaw has been found in OpenCATS 0.10.0. Affected is the function processLogin of the file modules/careers/CareersUI.php of the component Career Portal. This manipulation of the argument applyToJobSubAction causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit has been published and may be used. Patch name: 1cf4fa3ee9054314b023be79d404078645c22ade. It is suggested to install a patch to address this issue. The project maintainer explains: \"Candidates will now need to authenticate each time they access the Career Portal and successfully complete the CAPTCHA as part of that authentication flow. The authenticated candidate identity is now maintained server-side rather than relying on the previous persistent client-side cats…cw cookie mechanism. Application-level rate limiting is deliberately not in scope for this change. In my view, request throttling and brute-force protection of that kind are better applied at the network, reverse-proxy or web-server layer, where they can be configured appropriately for each deployment without OpenCATS having to implement and maintain its own rate-limiting framework. I'll update the online documentation to that effect.\"", "updated_at": "2026-10-18T06:16:56.767", "published_at": "2026-10-18T06:16:56.380", "cvss": 2.9, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0.10.0", "fixed": "See vendor advisory", "source_count": 9, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-307", "what_happened": "A flaw has been found in OpenCATS 0.10.0. Affected is the function processLogin of the file modules/careers/CareersUI.php of the component Career Portal. This manipulation of the argument applyToJobSubAction causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit has been published and may be used. Patch name: 1cf4fa3ee9054314b023be79d404078645c22ade. It is suggested to install a patch to address this issue. The project maintainer explains: \"Candidates will now need to authenticate each time they access the Career Portal and successfully complete the CAPTCHA as part of that authentication flow. The authenticated candidate identity is now maintained server-side rather than relying on the previous persistent client-side cats…cw cookie mechanism. Application-level rate limiting is deliberately not in scope for this change. In my view, request throttling and brute-force protection of that kind are better applied at the network, reverse-proxy or web-server layer, where they can be configured appropriately for each deployment without OpenCATS having to implement and maintain its own rate-limiting framework. I'll update the online documentation to that effect.\"", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://gist.github.com/asdfghjkl12345678910111/851e7548613e4ae1b8b246edb2ca7c28", "https://github.com/opencats/OpenCATS/", "https://github.com/opencats/OpenCATS/commit/1cf4fa3ee9054314b023be79d404078645c22ade", "https://github.com/opencats/OpenCATS/issues/905", "https://github.com/opencats/OpenCATS/pull/906", "https://vuldb.com/cve/CVE-2026-111874", "https://vuldb.com/submit/1005051", "https://vuldb.com/vuln/421586", "https://vuldb.com/vuln/421586/cti" ], "timeline": [ { "at": "2026-10-18T06:16:56.380", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111874" } ] }, { "id": "CVE-2026-111873", "vendor": "itsmeravitejak", "product": "Online-Examination-System", "title": "Online-Examination-System vulnerability", "summary": "A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This impacts the function MySQLDB::topicslist of the file exammanger.php of the component AJAX Endpoint. The manipulation of the argument subject results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.", "updated_at": "2026-10-18T05:16:27.920", "published_at": "2026-10-18T05:16:27.920", "cvss": 5.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "e6208e630b14657999bbfe4c9912302d2a1e2449", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-74", "what_happened": "A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This impacts the function MySQLDB::topicslist of the file exammanger.php of the component AJAX Endpoint. The manipulation of the argument subject results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/itsmeravitejak/Online-Examination-System/", "https://github.com/itsmeravitejak/Online-Examination-System/issues/7", "https://vuldb.com/cve/CVE-2026-111873", "https://vuldb.com/submit/1005050", "https://vuldb.com/vuln/421585", "https://vuldb.com/vuln/421585/cti" ], "timeline": [ { "at": "2026-10-18T05:16:27.920", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111873" } ] }, { "id": "CVE-2026-111872", "vendor": "itsmeravitejak", "product": "Online-Examination-System", "title": "Online-Examination-System vulnerability", "summary": "A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::valid/MySQLDB::getresults/MySQLDB::noresults/MySQLDB::getExams/MySQLDB::latestExamID/MySQLDB::getreport of the file results.php/include/database.php. The manipulation of the argument id/user/topic leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.", "updated_at": "2026-10-18T04:16:35.433", "published_at": "2026-10-18T04:16:35.433", "cvss": 5.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "e6208e630b14657999bbfe4c9912302d2a1e2449", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-74", "what_happened": "A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::valid/MySQLDB::getresults/MySQLDB::noresults/MySQLDB::getExams/MySQLDB::latestExamID/MySQLDB::getreport of the file results.php/include/database.php. The manipulation of the argument id/user/topic leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/itsmeravitejak/Online-Examination-System/", "https://github.com/itsmeravitejak/Online-Examination-System/issues/6", "https://vuldb.com/cve/CVE-2026-111872", "https://vuldb.com/submit/1005049", "https://vuldb.com/vuln/421584", "https://vuldb.com/vuln/421584/cti" ], "timeline": [ { "at": "2026-10-18T04:16:35.433", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111872" } ] }, { "id": "CVE-2026-111871", "vendor": "itsmeravitejak", "product": "Online-Examination-System", "title": "Online-Examination-System vulnerability", "summary": "A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is an unknown function of the file qsdb/usersdb/brandb/topicsdb/subjectsdb.php. Executing a manipulation of the argument query/qtype/sortname/sortorder can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.", "updated_at": "2026-10-18T04:16:35.227", "published_at": "2026-10-18T04:16:35.227", "cvss": 5.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "e6208e630b14657999bbfe4c9912302d2a1e2449", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-74", "what_happened": "A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is an unknown function of the file qsdb/usersdb/brandb/topicsdb/subjectsdb.php. Executing a manipulation of the argument query/qtype/sortname/sortorder can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/itsmeravitejak/Online-Examination-System/", "https://github.com/itsmeravitejak/Online-Examination-System/issues/5", "https://vuldb.com/cve/CVE-2026-111871", "https://vuldb.com/submit/1005048", "https://vuldb.com/vuln/421583", "https://vuldb.com/vuln/421583/cti" ], "timeline": [ { "at": "2026-10-18T04:16:35.227", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111871" } ] }, { "id": "CVE-2026-111870", "vendor": "itsmeravitejak", "product": "Online-Examination-System", "title": "Online-Examination-System vulnerability", "summary": "A security flaw has been discovered in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The affected element is the function isAdmin of the file admin/admin.php. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.", "updated_at": "2026-10-18T04:16:31.750", "published_at": "2026-10-18T04:16:31.750", "cvss": 5.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "e6208e630b14657999bbfe4c9912302d2a1e2449", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-287", "what_happened": "A security flaw has been discovered in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The affected element is the function isAdmin of the file admin/admin.php. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/itsmeravitejak/Online-Examination-System/", "https://github.com/itsmeravitejak/Online-Examination-System/issues/4", "https://vuldb.com/cve/CVE-2026-111870", "https://vuldb.com/submit/1005047", "https://vuldb.com/vuln/421582", "https://vuldb.com/vuln/421582/cti" ], "timeline": [ { "at": "2026-10-18T04:16:31.750", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111870" } ] }, { "id": "CVE-2026-111869", "vendor": "makeplane", "product": "plane", "title": "plane vulnerability", "summary": "A vulnerability was identified in makeplane plane up to 1.4.2. Impacted is an unknown function of the component API Endpoint. Such manipulation of the argument X-Forwarded-For leads to reliance on untrusted inputs in a security decision. It is possible to launch the attack remotely. The exploit is publicly available and might be used.", "updated_at": "2026-10-18T03:16:30.107", "published_at": "2026-10-18T03:16:28.970", "cvss": 5.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "1.4.0; 1.4.1; 1.4.2", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-20", "what_happened": "A vulnerability was identified in makeplane plane up to 1.4.2. Impacted is an unknown function of the component API Endpoint. Such manipulation of the argument X-Forwarded-For leads to reliance on untrusted inputs in a security decision. It is possible to launch the attack remotely. The exploit is publicly available and might be used.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/makeplane/plane/", "https://github.com/makeplane/plane/issues/9913", "https://vuldb.com/cve/CVE-2026-111869", "https://vuldb.com/submit/1004923", "https://vuldb.com/submit/1005105", "https://vuldb.com/vuln/421581", "https://vuldb.com/vuln/421581/cti" ], "timeline": [ { "at": "2026-10-18T03:16:28.970", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111869" } ] }, { "id": "CVE-2026-111865", "vendor": "THU-MIG", "product": "yoloe", "title": "yoloe vulnerability", "summary": "A security flaw has been discovered in THU-MIG yoloe up to 40cd606cabdbe2b566d6f14a6b162c89206e9a1b. This affects the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of the argument imgsz/names/kpt_shape results in improper neutralization of directives in dynamically evaluated code. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.", "updated_at": "2026-10-17T21:16:25.793", "published_at": "2026-10-17T21:16:25.793", "cvss": 1.9, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "40cd606cabdbe2b566d6f14a6b162c89206e9a1b", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-94", "what_happened": "A security flaw has been discovered in THU-MIG yoloe up to 40cd606cabdbe2b566d6f14a6b162c89206e9a1b. This affects the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of the argument imgsz/names/kpt_shape results in improper neutralization of directives in dynamically evaluated code. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/THU-MIG/yoloe/", "https://github.com/THU-MIG/yoloe/issues/148", "https://vuldb.com/cve/CVE-2026-111865", "https://vuldb.com/submit/1004883", "https://vuldb.com/vuln/421573", "https://vuldb.com/vuln/421573/cti" ], "timeline": [ { "at": "2026-10-17T21:16:25.793", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111865" } ] }, { "id": "CVE-2026-111823", "vendor": "Mage", "product": "mage-ai", "title": "Exploit for CVE-2026-111823", "summary": "Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.", "updated_at": "2026-10-17T02:17:18.470", "published_at": "2026-10-17T02:17:18.470", "cvss": 9.8, "confidence": 100, "confidence_label": "verified", "affected": "0 through 0.9.80 (semver)", "fixed": "See vendor advisory", "source_count": 28, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-390", "what_happened": "Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for CVE-2026-111823", "summary": "Unauthenticated session issuance in Mage OSS via unknown OAuth provider on /api/sessions.", "what_happened": "Unauthenticated session issuance in Mage OSS via unknown OAuth provider on /api/sessions.", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-390", "references": [ "https://sploitus.com/exploit?id=53C26422-48E5-5368-941E-F626C436A511", "https://github.com/murrez/CVE-2026-111823" ], "repository": "Sploitus", "author": "murrez", "first_seen": "2026-10-17T09:55:01", "confidence": "High", "verification": "verified", "verified": true, "verification_detail": "Sploitus reports working code with at least 90% confidence.", "url": "https://sploitus.com/exploit?id=53C26422-48E5-5368-941E-F626C436A511" }, { "title": "Exploit for CVE-2026-111823", "summary": "Unauthenticated session issuance in Mage OSS via unknown OAuth provider on /api/sessions.", "what_happened": "Unauthenticated session issuance in Mage OSS via unknown OAuth provider on /api/sessions.", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-390", "references": [ "https://sploitus.com/exploit?id=53C26422-48E5-5368-941E-F626C436A511", "https://github.com/murrez/CVE-2026-111823" ], "repository": "murrez/CVE-2026-111823", "author": "murrez", "first_seen": "2026-10-17T09:55:01", "confidence": "High", "verification": "verified", "verified": true, "verification_detail": "Linked by a Sploitus working-code assessment.", "url": "https://github.com/murrez/CVE-2026-111823" } ], "references": [ "https://sploitus.com/exploit?id=53C26422-48E5-5368-941E-F626C436A511", "https://github.com/murrez/CVE-2026-111823", "https://github.com/mage-ai/mage-ai/pull/6204", "https://github.com/mage-ai/mage-ai/pull/6204/changes/76c4f467f3654041d8899b1c4447a985710d26c0", "https://github.com/mage-ai/mage-ai/pull/6205", "https://thecoregroup.net/category/the-core-group/" ], "timeline": [ { "at": "2026-10-17T07:55:01Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=53C26422-48E5-5368-941E-F626C436A511" }, { "at": "2026-10-17T02:17:18.470", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111823" } ], "enrichment_checked_at": "2026-10-17T16:05:28Z", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "id": "CVE-2026-111793", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2026-111793 exploit", "summary": "Exploit for CVE-2026-111793. CVSS 4.3.", "updated_at": "2026-10-16T19:17:05Z", "published_at": "2026-10-16T19:17:05Z", "cvss": 4.3, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 14, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-10-16T19:17:05+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "CVE-2026-111793 exploit", "summary": "Exploit for CVE-2026-111793. CVSS 4.3.", "cvss": 4.3, "url": "https://sploitus.com/exploit?id=NVD%3ACVE-2026-111793" } ], "references": [ "https://sploitus.com/exploit?id=NVD%3ACVE-2026-111793" ], "timeline": [ { "at": "2026-10-16T19:17:05Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=NVD%3ACVE-2026-111793" } ] }, { "id": "CVE-2026-111222", "vendor": "Netgate", "product": "pfSense CE", "title": "pfSense CE vulnerability", "summary": "Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add auto_prepend_file pointing at /var/db/zoneinfo, executing PHP as root after php.ini is regenerated at boot or php-fpm restart.", "updated_at": "2026-10-20T15:37:26.110", "published_at": "2026-10-15T19:17:34.797", "cvss": 7.5, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.9.0 (semver)", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "High", "cwe": "CWE-93", "what_happened": "Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add auto_prepend_file pointing at /var/db/zoneinfo, executing PHP as root after php.ini is regenerated at boot or php-fpm restart.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://abraxaslabs.tech/research/pfsense-ce-leftovers", "https://github.com/abraxas/pfsense-timezone-phpini", "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/system.inc#L2377-L2380", "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/rc.php_ini_setup#L163-L166", "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/rc.php_ini_setup#L220", "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/system.php#L288", "https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-php-ini-injection-via-timezone-setting" ], "timeline": [ { "at": "2026-10-15T19:17:34.797", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111222" } ] }, { "id": "CVE-2026-111221", "vendor": "Netgate", "product": "pfSense CE", "title": "pfSense CE vulnerability", "summary": "Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to vpn_l2tp.php or services_pppoe_edit.php, appending an up-script that executes as root when a session starts.", "updated_at": "2026-10-20T15:37:34.613", "published_at": "2026-10-15T19:17:34.650", "cvss": 7.5, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.9.0 (semver)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "High", "cwe": "CWE-93", "what_happened": "Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to vpn_l2tp.php or services_pppoe_edit.php, appending an up-script that executes as root when a session starts.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://abraxaslabs.tech/research/pfsense-ce-leftovers", "https://github.com/abraxas/pfsense-l2tp-radius-mpd", "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/vpn.inc#L202-L215", "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/vpn.inc#L428-L441", "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/vpn_l2tp.php#L137-L143", "https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-command-injection-via-radius-secret-mpd-conf-injection" ], "timeline": [ { "at": "2026-10-15T19:17:34.650", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111221" } ] }, { "id": "CVE-2026-111219", "vendor": "Netgate", "product": "pfSense CE", "title": "pfSense CE vulnerability", "summary": "Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making mpd5 run commands as root when a PPPoE client authenticates.", "updated_at": "2026-10-20T15:37:57.990", "published_at": "2026-10-15T19:17:34.357", "cvss": 7.5, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.9.0 (semver)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "High", "cwe": "CWE-93", "what_happened": "Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making mpd5 run commands as root when a PPPoE client authenticates.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://abraxaslabs.tech/research/pfsense-ce-leftovers", "https://github.com/abraxas/pfsense-pppoe-secret-bang", "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/vpn.inc#L272-L282", "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/services_pppoe_edit.php#L141-L152", "https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-command-injection-via-pppoe-server-username" ], "timeline": [ { "at": "2026-10-15T19:17:34.357", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111219" } ] }, { "id": "CVE-2026-111218", "vendor": "Netgate", "product": "pfSense CE", "title": "pfSense CE vulnerability", "summary": "Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.", "updated_at": "2026-10-20T15:38:34.380", "published_at": "2026-10-15T19:17:34.210", "cvss": 8.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "2.7.0 through 2.9.0 (semver)", "fixed": "See vendor advisory", "source_count": 8, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-78", "what_happened": "Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "abraxaslabs.tech", "author": "NVD reference", "first_seen": "2026-10-15", "confidence": "High", "verification": "verified", "verified": true, "url": "https://abraxaslabs.tech/research/pfsense-limiter-number" } ], "references": [ "https://abraxaslabs.tech/research/pfsense-ce-leftovers", "https://abraxaslabs.tech/research/pfsense-limiter-number", "https://github.com/abraxas/pfsense-limiter-number", "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/shaper.inc#L3820-L3821", "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/shaper.inc#L3959", "https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.7.0-through-2.9.0-os-command-injection-via-traffic-shaper-limiters" ], "timeline": [ { "at": "2026-10-15T19:17:34.210", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111218" } ] }, { "id": "CVE-2026-111217", "vendor": "Netgate", "product": "pfSense CE", "title": "pfSense CE vulnerability", "summary": "Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface_ipalias_configure() ifconfig calls or get_carp_interface_status() when CARP status is rendered.", "updated_at": "2026-10-20T15:38:40.363", "published_at": "2026-10-15T19:17:34.067", "cvss": 8.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "0 through 2.9.0 (semver)", "fixed": "See vendor advisory", "source_count": 9, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-78", "what_happened": "Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface_ipalias_configure() ifconfig calls or get_carp_interface_status() when CARP status is rendered.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "abraxaslabs.tech", "author": "NVD reference", "first_seen": "2026-10-15", "confidence": "High", "verification": "verified", "verified": true, "url": "https://abraxaslabs.tech/research/pfsense-carp-vhid" } ], "references": [ "https://abraxaslabs.tech/research/pfsense-carp-vhid", "https://abraxaslabs.tech/research/pfsense-ce-leftovers", "https://github.com/abraxas/pfsense-carp-vhid", "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/interfaces.inc#L3236-L3238", "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/pfsense-utils.inc#L794", "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/pfSense/include/www/firewall_virtual_ip.inc#L200", "https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-os-command-injection-via-carp-vhid" ], "timeline": [ { "at": "2026-10-15T19:17:34.067", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111217" } ] }, { "id": "CVE-2026-111125", "vendor": "HEASARC", "product": "cfitsio", "title": "cfitsio vulnerability", "summary": "CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via input_nnybble in fits_hdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS_1 declaring oversized tile geometry to crash applications calling fits_read_pix or disclose limited heap memory.", "updated_at": "2026-10-20T15:38:53.217", "published_at": "2026-10-15T19:17:25.780", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "0 through 4.7.0 (semver)", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-125", "what_happened": "CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via input_nnybble in fits_hdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS_1 declaring oversized tile geometry to crash applications calling fits_read_pix or disclose limited heap memory.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "hackmd.io", "author": "NVD reference", "first_seen": "2026-10-15", "confidence": "High", "verification": "verified", "verified": true, "url": "https://hackmd.io/@haind-pwn/cfitsio-zdither0-dither-seed-oob-read" } ], "references": [ "https://github.com/HEASARC/cfitsio", "https://github.com/HEASARC/cfitsio/blob/d6d27653740864a0483e74cff23c53e34e1dceee/fits_hdecompress.c#L2575-L2633", "https://github.com/HEASARC/cfitsio/blob/d6d27653740864a0483e74cff23c53e34e1dceee/imcompress.c#L6310-L6316", "https://hackmd.io/@haind-pwn/cfitsio-zdither0-dither-seed-oob-read", "https://www.vulncheck.com/advisories/cfitsio-through-4.7.0-heap-out-of-bounds-read-via-hcompress-input-nnybble" ], "timeline": [ { "at": "2026-10-15T19:17:25.780", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111125" } ] }, { "id": "CVE-2026-111124", "vendor": "HEASARC", "product": "cfitsio", "title": "cfitsio vulnerability", "summary": "CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVE_DITHER_1 compressed image, read through fits_open_file() and fits_read_pix(), to cause crashes or leak heap contents in decoded pixels.", "updated_at": "2026-10-20T15:39:00.270", "published_at": "2026-10-15T19:17:25.627", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "0 through 4.7.0 (semver)", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-125", "what_happened": "CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVE_DITHER_1 compressed image, read through fits_open_file() and fits_read_pix(), to cause crashes or leak heap contents in decoded pixels.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "hackmd.io", "author": "NVD reference", "first_seen": "2026-10-15", "confidence": "High", "verification": "verified", "verified": true, "url": "https://hackmd.io/@haind-pwn/cfitsio-zdither0-dither-seed-oob-read" } ], "references": [ "https://github.com/HEASARC/cfitsio", "https://github.com/HEASARC/cfitsio/blob/d6d27653740864a0483e74cff23c53e34e1dceee/imcompress.c#L5353-L5362", "https://github.com/HEASARC/cfitsio/blob/d6d27653740864a0483e74cff23c53e34e1dceee/imcompress.c#L7495-L7516", "https://hackmd.io/@haind-pwn/cfitsio-zdither0-dither-seed-oob-read", "https://www.vulncheck.com/advisories/cfitsio-through-4.7.0-heap-out-of-bounds-read-via-negative-zdither0-seed" ], "timeline": [ { "at": "2026-10-15T19:17:25.627", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111124" } ] }, { "id": "CVE-2026-111110", "vendor": "stiofansisland", "product": "Payment forms, Buy now buttons, and Invoicing System | GetPaid", "title": "Payment forms, Buy now buttons, and Invoicing System | GetPaid vulnerability", "summary": "The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all versions up to, and including, 2.8.61 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required nonce (getpaid_form_nonce) is publicly emitted to all visitors via wp_localize_script as WPInv.formNonce, meaning no authentication or prior nonce leak is needed; the stored payload fires when an administrator views the affected invoice's Payment Form Details metabox.", "updated_at": "2026-10-17T08:16:28.310", "published_at": "2026-10-17T08:16:28.310", "cvss": 7.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.8.61 (semver)", "fixed": "See vendor advisory", "source_count": 8, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all versions up to, and including, 2.8.61 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required nonce (getpaid_form_nonce) is publicly emitted to all visitors via wp_localize_script as WPInv.formNonce, meaning no authentication or prior nonce leak is needed; the stored payload fires when an administrator views the affected invoice's Payment Form Details metabox.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/AyeCode/invoicing/archive/refs/heads/master.zip", "https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.61/includes/admin/meta-boxes/class-mb-payment-form.php#L30", "https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.61/includes/class-wpinv-ajax.php#L359", "https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.61/includes/payments/class-getpaid-checkout.php#L293", "https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.61/includes/payments/class-getpaid-checkout.php#L402", "https://plugins.trac.wordpress.org/browser/invoicing/tags/2.8.61/includes/payments/class-getpaid-payment-form-submission.php#L150", "https://plugins.trac.wordpress.org/changeset/3750463/invoicing/trunk/includes/admin/meta-boxes/class-mb-payment-form.php", "https://www.wordfence.com/threat-intel/vulnerabilities/id/2161ecdc-d3c2-4ede-9c42-28f30fa0f91e?source=cve" ], "timeline": [ { "at": "2026-10-17T08:16:28.310", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111110" } ] }, { "id": "CVE-2026-111105", "vendor": "Telegram", "product": "Telegram", "title": "Telegram vulnerability", "summary": "Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the rlottie library. The issue results from the lack of proper validation of user-supplied data, which can result in a write before the start of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30207.", "updated_at": "2026-10-16T04:18:29.403", "published_at": "2026-10-15T18:17:26.670", "cvss": 7, "cvss_vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "6.6.2", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "High", "cwe": "CWE-197", "what_happened": "Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the rlottie library. The issue results from the lack of proper validation of user-supplied data, which can result in a write before the start of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30207.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.zerodayinitiative.com/advisories/ZDI-26-757/" ], "timeline": [ { "at": "2026-10-15T18:17:26.670", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111105" } ] }, { "id": "CVE-2026-111094", "vendor": "JetBrains", "product": "TeamCity", "title": "TeamCity vulnerability", "summary": "In JetBrains TeamCity before 2026.2, \n2026.1.4, \n2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible", "updated_at": "2026-10-16T04:18:29.190", "published_at": "2026-10-15T16:17:48.993", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "before 2026.2, \n2026.1.4, \n2025.11.8 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-502", "what_happened": "In JetBrains TeamCity before 2026.2, \n2026.1.4, \n2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.jetbrains.com/privacy-security/issues-fixed/" ], "timeline": [ { "at": "2026-10-15T16:17:48.993", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111094" } ] }, { "id": "CVE-2026-111092", "vendor": "JetBrains", "product": "YouTrack", "title": "YouTrack vulnerability", "summary": "In JetBrains YouTrack before 2026.2.19575\n2026.3.16075\n2026.3.16397\n2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands", "updated_at": "2026-10-16T04:18:28.950", "published_at": "2026-10-15T16:17:48.767", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "before 2026.2.19575\n2026.3.16075\n2026.3.16397\n2026.3.16402 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-862", "what_happened": "In JetBrains YouTrack before 2026.2.19575\n2026.3.16075\n2026.3.16397\n2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.jetbrains.com/privacy-security/issues-fixed/" ], "timeline": [ { "at": "2026-10-15T16:17:48.767", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111092" } ] }, { "id": "CVE-2026-111058", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Exploit for CVE-2026-111058", "summary": "Proof-of-concept exploit for CVE-2026-111057 and CVE-2026-111058. CVSS 10.", "updated_at": "2026-10-20T04:38:18Z", "published_at": "2026-10-20T04:38:18Z", "cvss": 10, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-10-20T04:38:18+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "Exploit for CVE-2026-111058", "summary": "Proof-of-concept exploit for CVE-2026-111057 and CVE-2026-111058. CVSS 10.", "cvss": 10, "url": "https://sploitus.com/exploit?id=A461949E-561D-5090-96D7-02BE859B10CC" } ], "references": [ "https://sploitus.com/exploit?id=A461949E-561D-5090-96D7-02BE859B10CC" ], "timeline": [ { "at": "2026-10-20T04:38:18Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=A461949E-561D-5090-96D7-02BE859B10CC" } ] }, { "id": "CVE-2026-111057", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Exploit for CVE-2026-111058", "summary": "Proof-of-concept exploit for CVE-2026-111057 and CVE-2026-111058. CVSS 10.", "updated_at": "2026-10-20T04:38:18Z", "published_at": "2026-10-20T04:38:18Z", "cvss": 10, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-10-20T04:38:18+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "Exploit for CVE-2026-111058", "summary": "Proof-of-concept exploit for CVE-2026-111057 and CVE-2026-111058. CVSS 10.", "cvss": 10, "url": "https://sploitus.com/exploit?id=A461949E-561D-5090-96D7-02BE859B10CC" } ], "references": [ "https://sploitus.com/exploit?id=A461949E-561D-5090-96D7-02BE859B10CC" ], "timeline": [ { "at": "2026-10-20T04:38:18Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=A461949E-561D-5090-96D7-02BE859B10CC" } ] }, { "id": "CVE-2026-111041", "vendor": "Unknown", "product": "AI Engine", "title": "AI Engine vulnerability", "summary": "The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object, allowing users with the Editor role or above to modify, or change the type of, arbitrary posts on the site, including content they are not permitted to edit.", "updated_at": "2026-10-18T07:16:52.920", "published_at": "2026-10-18T07:16:52.920", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "before 3.7.9 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object, allowing users with the Editor role or above to modify, or change the type of, arbitrary posts on the site, including content they are not permitted to edit.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/829fef5b-915c-4762-a90d-47a08d78266b/" ], "timeline": [ { "at": "2026-10-18T07:16:52.920", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111041" } ] }, { "id": "CVE-2026-110981", "vendor": "Unknown", "product": "WP Photo Album Plus", "title": "WP Photo Album Plus vulnerability", "summary": "The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.", "updated_at": "2026-10-18T07:16:52.817", "published_at": "2026-10-18T07:16:52.817", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "before 9.2.11.002 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/8328dd66-924c-4e74-972e-68ce65408159/" ], "timeline": [ { "at": "2026-10-18T07:16:52.817", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110981" } ] }, { "id": "CVE-2026-110976", "vendor": "Unknown", "product": "AI Engine", "title": "AI Engine vulnerability", "summary": "The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor role and above to delete arbitrary posts of any type, including content they cannot otherwise delete such as navigation menus, block templates and global styles.", "updated_at": "2026-10-18T07:16:52.713", "published_at": "2026-10-18T07:16:52.713", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "before 3.7.9 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor role and above to delete arbitrary posts of any type, including content they cannot otherwise delete such as navigation menus, block templates and global styles.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/c42eabbf-f357-46cd-b008-1b18eba83bf7/" ], "timeline": [ { "at": "2026-10-18T07:16:52.713", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110976" } ] }, { "id": "CVE-2026-110936", "vendor": "Siemens", "product": "Siemens Software Center", "title": "Siemens Software Center vulnerability", "summary": "A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.", "updated_at": "2026-10-17T09:16:28.893", "published_at": "2026-10-15T15:17:30.383", "cvss": 8.4, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 55, "confidence_label": "observed", "affected": "before V4.0.9.8 (custom)", "fixed": "See vendor advisory", "source_count": 2, "kev": true, "attack_vector": "Local", "authentication": "High", "complexity": "Low", "cwe": "CWE-427", "what_happened": "A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://cert-portal.siemens.com/productcert/html/ssa-580366.html" ], "timeline": [ { "at": "2026-10-15T15:17:30.383", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110936" }, { "at": "2026-10-20", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-110923", "vendor": "Red Hat", "product": "Red Hat Hardened Images", "title": "Red Hat Hardened Images vulnerability", "summary": "A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a \"..\" basename that sftp uses as the local destination, writing outside the directory the user selected.", "updated_at": "2026-10-20T03:17:14.803", "published_at": "2026-10-15T06:17:01.030", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-22", "what_happened": "A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a \"..\" basename that sftp uses as the local destination, writing outside the directory the user selected.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://access.redhat.com/errata/RHSA-2026:82247", "https://access.redhat.com/security/cve/CVE-2026-110923", "https://bugzilla.redhat.com/show_bug.cgi?id=2553028" ], "timeline": [ { "at": "2026-10-15T06:17:01.030", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110923" } ] }, { "id": "CVE-2026-110912", "vendor": "DragonFlyBSD", "product": "DragonFlyBSD", "title": "DragonFlyBSD vulnerability", "summary": "In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields of incoming ARP packets. in_arpreply() then uses these attacker-controlled values as memcpy lengths when copying from kernel buffers that are only 6 and 4 bytes long, resulting in an out-of-bounds read of kernel heap and stack memory that is copied into the ARP reply sent back to the requester. An unauthenticated attacker on the adjacent network can use a single crafted ARP request to disclose up to roughly 250 bytes of each type of kernel memory, including kernel pointers. This is expected to be fixed in the 6.6 stable release when that is available.", "updated_at": "2026-10-16T04:18:27.093", "published_at": "2026-10-15T04:18:23.010", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "984263bcb83ad82313113c6ac840d99124d8f90c through before 4bb22ffcf2e9fb44995fbfd9945194afc87fb182 (git)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Adjacent", "authentication": "None", "complexity": "Low", "cwe": "CWE-130", "what_happened": "In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields of incoming ARP packets. in_arpreply() then uses these attacker-controlled values as memcpy lengths when copying from kernel buffers that are only 6 and 4 bytes long, resulting in an out-of-bounds read of kernel heap and stack memory that is copied into the ARP reply sent back to the requester. An unauthenticated attacker on the adjacent network can use a single crafted ARP request to disclose up to roughly 250 bytes of each type of kernel memory, including kernel pointers. This is expected to be fixed in the 6.6 stable release when that is available.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/DragonFlyBSD/DragonFlyBSD/commit/4bb22ffcf2e9fb44995fbfd9945194afc87fb182", "https://github.com/dreamfast/CVE-2026-110912" ], "timeline": [ { "at": "2026-10-15T04:18:23.010", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110912" } ] }, { "id": "CVE-2026-110909", "vendor": "Wheels", "product": "Wheels CLI", "title": "Wheels CLI vulnerability", "summary": "Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console also probes common ports when the project server is down. Other commands can perform unintended state-changing operations against a different local application's server and database. Exploitation requires a process listening on a targeted local port and the developer running an affected command. This is fixed in 4.1.1, including changes to the CLI and application template.", "updated_at": "2026-10-20T03:17:14.683", "published_at": "2026-10-15T03:17:10.947", "cvss": 5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "before 4.1.1 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-923", "what_happened": "Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console also probes common ports when the project server is down. Other commands can perform unintended state-changing operations against a different local application's server and database. Exploitation requires a process listening on a targeted local port and the developer running an affected command. This is fixed in 4.1.1, including changes to the CLI and application template.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/wheels-dev/wheels/security/advisories/GHSA-x3cm-2j3q-jgg4" ], "timeline": [ { "at": "2026-10-15T03:17:10.947", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110909" } ] }, { "id": "CVE-2026-110896", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Exploit for CVE-2026-110896", "summary": "Unauthenticated missing authorization in WP Chill — Passster plugin.", "updated_at": "2026-10-16T11:34:39Z", "published_at": "2026-10-16T11:34:39Z", "cvss": 5.3, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 29, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Unauthenticated missing authorization in WP Chill — Passster plugin.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for CVE-2026-110896", "summary": "Unauthenticated missing authorization in WP Chill — Passster plugin.", "what_happened": "Unauthenticated missing authorization in WP Chill — Passster plugin.", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-862", "references": [ "https://sploitus.com/exploit?id=0FF69C3F-B2F7-5E23-AF7B-DBCADA14DEEA", "https://github.com/azqzazq1/CVE-2026-110896" ], "repository": "Sploitus", "author": "azqzazq1", "first_seen": "2026-10-16T13:34:39", "confidence": "High", "verification": "verified", "verified": true, "verification_detail": "Sploitus reports working code with at least 90% confidence.", "url": "https://sploitus.com/exploit?id=0FF69C3F-B2F7-5E23-AF7B-DBCADA14DEEA" }, { "title": "Exploit for CVE-2026-110896", "summary": "Unauthenticated missing authorization in WP Chill — Passster plugin.", "what_happened": "Unauthenticated missing authorization in WP Chill — Passster plugin.", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-862", "references": [ "https://sploitus.com/exploit?id=0FF69C3F-B2F7-5E23-AF7B-DBCADA14DEEA", "https://github.com/azqzazq1/CVE-2026-110896" ], "repository": "azqzazq1/CVE-2026-110896", "author": "azqzazq1", "first_seen": "2026-10-16T13:34:39", "confidence": "High", "verification": "verified", "verified": true, "verification_detail": "Linked by a Sploitus working-code assessment.", "url": "https://github.com/azqzazq1/CVE-2026-110896" } ], "references": [ "https://sploitus.com/exploit?id=0FF69C3F-B2F7-5E23-AF7B-DBCADA14DEEA", "https://github.com/azqzazq1/CVE-2026-110896" ], "timeline": [ { "at": "2026-10-16T11:34:39Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=0FF69C3F-B2F7-5E23-AF7B-DBCADA14DEEA" } ], "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "id": "CVE-2026-110889", "vendor": "Gantry", "product": "Gantry 5 Framework", "title": "Gantry 5 Framework vulnerability", "summary": "Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects Gantry 5 Framework: from n/a through 5.6.4.", "updated_at": "2026-10-17T11:16:32.017", "published_at": "2026-10-17T11:16:32.017", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 5.6.4 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-209", "what_happened": "Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects Gantry 5 Framework: from n/a through 5.6.4.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/gantry5/vulnerability/wordpress-gantry-5-framework-plugin-5-6-4-sensitive-data-exposure-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-10-17T11:16:32.017", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110889" } ] }, { "id": "CVE-2026-110882", "vendor": "Cozy Vision Technologies Pvt. Ltd.", "product": "SMS Alert Order Notifications", "title": "SMS Alert Order Notifications vulnerability", "summary": "Missing Authorization vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Alert Order Notifications: from n/a through 4.0.1.", "updated_at": "2026-10-17T19:16:28.830", "published_at": "2026-10-17T19:16:28.830", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 4.0.1 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Alert Order Notifications: from n/a through 4.0.1.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/sms-alert/vulnerability/wordpress-sms-alert-order-notifications-plugin-4-0-1-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-10-17T19:16:28.830", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110882" } ] }, { "id": "CVE-2026-110871", "vendor": "nodemailer", "product": "nodemailer", "title": "nodemailer vulnerability", "summary": "Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines, blocking the Node.js event loop during DKIM signing.", "updated_at": "2026-10-20T03:17:14.553", "published_at": "2026-10-14T23:17:28.953", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "3.0.0 through before 10.0.10 (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-400", "what_happened": "Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines, blocking the Node.js event loop during DKIM signing.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/nodemailer/nodemailer/security/advisories/GHSA-39m8-27wv-hr27", "https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.0.10-quadratic-dkim-header-unfolding-denial-of-service" ], "timeline": [ { "at": "2026-10-14T23:17:28.953", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110871" } ] }, { "id": "CVE-2026-110866", "vendor": "renovatebot", "product": "renovate", "title": "renovate vulnerability", "summary": "Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before the required release age elapses.", "updated_at": "2026-10-20T03:17:14.423", "published_at": "2026-10-14T23:17:28.253", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 44.61.3 (semver); before 15.5.0 (semver); before 10.5.0 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-693", "what_happened": "Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before the required release age elapses.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h", "https://www.vulncheck.com/advisories/renovate-before-44.61.3-minimumreleaseage-bypass-via-pr-rebase-request" ], "timeline": [ { "at": "2026-10-14T23:17:28.253", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110866" } ] }, { "id": "CVE-2026-110861", "vendor": "better-auth", "product": "drizzle-adapter", "title": "drizzle-adapter vulnerability", "summary": "Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints.", "updated_at": "2026-10-20T03:17:14.297", "published_at": "2026-10-14T23:17:27.490", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "1.6.17 through before 1.7.7 (semver); 1.6.17 through before 1.7.0 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-307", "what_happened": "Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/better-auth/better-auth/security/advisories/GHSA-44jh-23m7-hpcf", "https://www.vulncheck.com/advisories/better-auth-drizzle-adapter-1.6.17-before-1.7.7-rate-limit-bypass-via-race-condition" ], "timeline": [ { "at": "2026-10-14T23:17:27.490", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110861" } ] }, { "id": "CVE-2026-110856", "vendor": "gitpython-developers", "product": "GitPython", "title": "GitPython vulnerability", "summary": "GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch or timezone, causing quadratic backtracking and CPU exhaustion.", "updated_at": "2026-10-20T03:17:14.170", "published_at": "2026-10-14T23:17:26.760", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 3.2.0 (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-1333", "what_happened": "GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch or timezone, causing quadratic backtracking and CPU exhaustion.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-m64x-33q8-m5h7", "https://www.vulncheck.com/advisories/gitpython-before-3.2.0-redos-via-re-actor-epoch-in-parse-actor-and-date" ], "timeline": [ { "at": "2026-10-14T23:17:26.760", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110856" } ] }, { "id": "CVE-2026-110851", "vendor": "n8n-io", "product": "n8n", "title": "n8n vulnerability", "summary": "n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create endpoint, which accepts a caller-supplied Agent ID, checks permissions only against the requested project, and updates an existing Agent without verifying which project owns it. An authenticated user with read-only Agent access to another project can supply an existing Agent ID to move that Agent into their own project and rewrite its name, schema and version.", "updated_at": "2026-10-20T03:17:14.047", "published_at": "2026-10-14T23:17:26.037", "cvss": 6.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 2.41.4 (semver); 2.42.0 through before 2.42.1 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-639", "what_happened": "n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create endpoint, which accepts a caller-supplied Agent ID, checks permissions only against the requested project, and updates an existing Agent without verifying which project owns it. An authenticated user with read-only Agent access to another project can supply an existing Agent ID to move that Agent into their own project and rewrite its name, schema and version.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/n8n-io/n8n/security/advisories/GHSA-2r5r-xgvc-rj4p", "https://www.vulncheck.com/advisories/n8n-before-2.41.4-and-2.42.1-cross-project-agent-ownership-transfer-via-agents-create-endpoint" ], "timeline": [ { "at": "2026-10-14T23:17:26.037", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110851" } ] }, { "id": "CVE-2026-110846", "vendor": "n8n-io", "product": "n8n", "title": "n8n vulnerability", "summary": "n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node reference form. Attackers holding an execution's resume token can approve waiting executions meant for others, running downstream actions under the workflow owner's credentials, potentially including command execution.", "updated_at": "2026-10-20T03:17:13.930", "published_at": "2026-10-14T23:17:25.253", "cvss": 7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 2.41.4 (semver); 2.42.0 through before 2.42.1 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-180", "what_happened": "n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node reference form. Attackers holding an execution's resume token can approve waiting executions meant for others, running downstream actions under the workflow owner's credentials, potentially including command execution.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/n8n-io/n8n/security/advisories/GHSA-728h-pmr2-7cgh", "https://www.vulncheck.com/advisories/n8n-before-2.41.4-and-2.42.1-send-and-wait-hmac-signature-bypass-via-waiting-webhook" ], "timeline": [ { "at": "2026-10-14T23:17:25.253", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110846" } ] }, { "id": "CVE-2026-110841", "vendor": "n8n-io", "product": "n8n", "title": "n8n vulnerability", "summary": "n8n before 2.41.4 and 2.42.0 contains an authorization bypass in the agent chat resume endpoint, which accepts a run identifier from the request body without verifying that the suspended checkpoint belongs to the caller. Authenticated project members can list and read other members' private agent conversations through project-scoped endpoints, then approve their pending tool calls, causing the tools to execute and write results into the victim's conversation.", "updated_at": "2026-10-20T03:17:13.800", "published_at": "2026-10-14T23:17:24.477", "cvss": 6.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 2.41.4 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-639", "what_happened": "n8n before 2.41.4 and 2.42.0 contains an authorization bypass in the agent chat resume endpoint, which accepts a run identifier from the request body without verifying that the suspended checkpoint belongs to the caller. Authenticated project members can list and read other members' private agent conversations through project-scoped endpoints, then approve their pending tool calls, causing the tools to execute and write results into the victim's conversation.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/n8n-io/n8n/security/advisories/GHSA-p3pg-xw4f-m72c", "https://www.vulncheck.com/advisories/n8n-before-2.41.4-and-2.42.0-authorization-bypass-in-agent-chat-resume-tool-approval" ], "timeline": [ { "at": "2026-10-14T23:17:24.477", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110841" } ] }, { "id": "CVE-2026-110836", "vendor": "FreeRDP", "product": "FreeRDP", "title": "FreeRDP vulnerability", "summary": "FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU via crafted Content-Type headers. Attackers controlling a gateway can return a nonzero Content-Length with a semicolon-containing unrecognized Content-Type, pinning a client thread at full CPU indefinitely.", "updated_at": "2026-10-20T03:17:13.653", "published_at": "2026-10-14T23:17:23.593", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "3.0.0 through before 3.32.0 (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-835", "what_happened": "FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU via crafted Content-Type headers. Attackers controlling a gateway can return a nonzero Content-Length with a semicolon-containing unrecognized Content-Type, pinning a client thread at full CPU indefinitely.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h7fx-22wv-4cg8", "https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.0-infinite-loop-dos-via-gateway-content-type" ], "timeline": [ { "at": "2026-10-14T23:17:23.593", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110836" } ] }, { "id": "CVE-2026-110831", "vendor": "FreeRDP", "product": "FreeRDP", "title": "FreeRDP vulnerability", "summary": "FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive_process_irp_create, which registers an opened local file in the drive dictionary before applying the allocation size and does not remove it when that operation fails. A malicious RDP server connected to a client with drive redirection enabled can send IRP_MJ_CREATE with AllocationSize set to UINT64_MAX, forcing the seek to fail and leaking the file object and operating-system handle until drive teardown.", "updated_at": "2026-10-20T03:17:13.510", "published_at": "2026-10-14T23:17:22.880", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "3.13.0 through before 3.32.0 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-775", "what_happened": "FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive_process_irp_create, which registers an opened local file in the drive dictionary before applying the allocation size and does not remove it when that operation fails. A malicious RDP server connected to a client with drive redirection enabled can send IRP_MJ_CREATE with AllocationSize set to UINT64_MAX, forcing the seek to fail and leaking the file object and operating-system handle until drive teardown.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jgw9-wqvx-j495", "https://www.vulncheck.com/advisories/freerdp-3.13.0-before-3.32.0-resource-leak-via-drive-redirection-irp-mj-create" ], "timeline": [ { "at": "2026-10-14T23:17:22.880", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110831" } ] }, { "id": "CVE-2026-110773", "vendor": "growchief", "product": "growchief", "title": "growchief vulnerability", "summary": "GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authenticated user to list users across all organizations because the IsSuperAdmin guard is absent. Attackers with a self-registered low-privilege account can send an empty or short search value to GET /users/all-users to enumerate user ids, emails, names and organization IDs of every tenant.", "updated_at": "2026-10-20T02:17:11.153", "published_at": "2026-10-14T19:17:13.500", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 0.3.0 (semver)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authenticated user to list users across all organizations because the IsSuperAdmin guard is absent. Attackers with a self-registered low-privilege account can send an empty or short search value to GET /users/all-users to enumerate user ids, emails, names and organization IDs of every tenant.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/growchief/growchief", "https://github.com/growchief/growchief/blob/abb1e37a6f5595d8d105aef5871a2eeb0c22a1dc/apps/backend/src/controllers/users.controller.ts#L98-L101", "https://hackmd.io/@hieuPenguinnn/growchief-all-users-missing-authz-cross-tenant-disclosure", "https://www.vulncheck.com/advisories/growchief-through-0.3.0-missing-authorization-via-users-all-users-endpoint" ], "timeline": [ { "at": "2026-10-14T19:17:13.500", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110773" } ] }, { "id": "CVE-2026-110768", "vendor": "holaboss-ai", "product": "holaOS", "title": "holaOS vulnerability", "summary": "holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed in allowFrom can submit turns to the bound workspace agent, which runs configured tools on the operator's machine.", "updated_at": "2026-10-20T02:17:11.020", "published_at": "2026-10-14T19:17:12.763", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2026.822.1 (custom)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-290", "what_happened": "holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed in allowFrom can submit turns to the bound workspace agent, which runs configured tools on the operator's machine.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/holaboss-ai/holaOS", "https://github.com/holaboss-ai/holaOS/blob/4684714ee133794cdbb86630e42b7d93447fb2e2/runtime/channel-gateway/src/connectors/telegram.ts#L491", "https://hackmd.io/@hieuPenguinnn/holaos-channel-gateway-allow-all-sender-default", "https://www.vulncheck.com/advisories/holaos-through-2026.822.1-authorization-bypass-via-telegram-connector-username-allowlist" ], "timeline": [ { "at": "2026-10-14T19:17:12.763", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110768" } ] }, { "id": "CVE-2026-110763", "vendor": "zuihou", "product": "lamp-boot", "title": "lamp-boot vulnerability", "summary": "lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's department membership within the tenant.", "updated_at": "2026-10-20T02:17:10.890", "published_at": "2026-10-14T19:17:12.037", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "4.16.0-java17 through 4.21.2-java17 (custom)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-639", "what_happened": "lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's department membership within the tenant.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/zuihou/lamp-boot", "https://github.com/zuihou/lamp-boot/blob/ddef8c71de970b915ba1b15e0e9c2dd7414074de/lamp-oauth/lamp-oauth-controller/src/main/java/top/tangyh/lamp/oauth/controller/UserInfoController.java#L167", "https://hackmd.io/@hieuPenguinnn/lamp-boot-finddeptbycompany-employee-idor", "https://www.vulncheck.com/advisories/lamp-boot-4.16.0-java17-through-4.21.2-java17-idor-via-anyone-finddeptbycompany" ], "timeline": [ { "at": "2026-10-14T19:17:12.037", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110763" } ] }, { "id": "CVE-2026-110735", "vendor": "godotengine", "product": "Godot Engine", "title": "Godot Engine vulnerability", "summary": "Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/resource_format_binary.cpp, ResourceLoaderBinary::get_unicode_string). A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size with a signed comparison, which conditionally resizes the buffer. A negative length value skips the resize; the same value is then passed to the copy routine as an unsigned byte count, where it sign-extends to a huge value, copying file-controlled data far past the undersized heap allocation. The defect is reached when the product or an exported game loads a crafted binary resource file (.res). NOTE: the Supplier's position is that the research has identified \"no security issues\" because the required attacker access is outside of the current Godot Engine threat model.", "updated_at": "2026-10-20T02:17:10.757", "published_at": "2026-10-14T16:17:44.467", "cvss": 2.5, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "1.0.0 through 4.7.2 (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "High", "cwe": "CWE-195", "what_happened": "Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/resource_format_binary.cpp, ResourceLoaderBinary::get_unicode_string). A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size with a signed comparison, which conditionally resizes the buffer. A negative length value skips the resize; the same value is then passed to the copy routine as an unsigned byte count, where it sign-extends to a huge value, copying file-controlled data far past the undersized heap allocation. The defect is reached when the product or an exported game loads a crafted binary resource file (.res). NOTE: the Supplier's position is that the research has identified \"no security issues\" because the required attacker access is outside of the current Godot Engine threat model.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://axeghost.offprint.app/a/3mvs6zo4blo23-three-memory-safety-bugs-in-godots-untrusted-file-parsers", "https://github.com/godotengine/godot/issues/123608", "http://www.openwall.com/lists/oss-security/2026/10/15/3" ], "timeline": [ { "at": "2026-10-14T16:17:44.467", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110735" } ] }, { "id": "CVE-2026-110719", "vendor": "Portkey-AI", "product": "gateway", "title": "gateway vulnerability", "summary": "Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTED_CUSTOM_HOSTS is unset. Attackers can send /v1 requests with a crafted x-portkey-custom-host header, such as via the ollama provider, to make the gateway call internal services and return their responses.", "updated_at": "2026-10-20T02:17:10.627", "published_at": "2026-10-14T16:17:44.183", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "1.14.0 through 1.15.2 (semver)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-918", "what_happened": "Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTED_CUSTOM_HOSTS is unset. Attackers can send /v1 requests with a crafted x-portkey-custom-host header, such as via the ollama provider, to make the gateway call internal services and return their responses.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/Portkey-AI/gateway", "https://github.com/Portkey-AI/gateway/blob/ca7712947ec8c0887803990b746740d36011c697/src/middlewares/requestValidator/index.ts#L289", "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/BJypv-aiMg", "https://www.vulncheck.com/advisories/portkey-ai-gateway-1.14.0-through-1.15.2-ssrf-via-x-portkey-custom-host-header" ], "timeline": [ { "at": "2026-10-14T16:17:44.183", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110719" } ] }, { "id": "CVE-2026-110714", "vendor": "sahlberg", "product": "libsmb2", "title": "libsmb2 vulnerability", "summary": "libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERY_INFO reply, bypassing ACE bounds checks and crashing the client.", "updated_at": "2026-10-20T02:17:10.497", "published_at": "2026-10-14T16:17:43.473", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 6.2 (custom)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-191", "what_happened": "libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERY_INFO reply, bypassing ACE bounds checks and crashing the client.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/sahlberg/libsmb2", "https://github.com/sahlberg/libsmb2/blob/d67e213a5c4e7e4969fd81f0b95e4ca5831fbba1/lib/smb2-data-security-descriptor.c#L266", "https://github.com/sahlberg/libsmb2/commit/523abe20be3207011a936db47f1d3bab79c05450", "https://hackmd.io/@haind-pwn/libsmb2-query-info-reply-oob-read", "https://www.vulncheck.com/advisories/libsmb2-through-6.2-heap-out-of-bounds-read-via-decode-acl-integer-underflow" ], "timeline": [ { "at": "2026-10-14T16:17:43.473", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110714" } ] }, { "id": "CVE-2026-110698", "vendor": "n/a", "product": "Praat", "title": "Praat vulnerability", "summary": "A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whisper_model_load of the file external/whispercpp/whisper.cpp of the component Model Loader. The manipulation of the argument n_dims leads to out-of-bounds write. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is a910d21a2705ef4cd16d91f29cdc8da1ab1a7221. To fix this issue, it is recommended to deploy a patch. The project maintainer confirms: \"We did a quick fix (suggested fix 1) for Praat version 7.0.03, and scheduled a better fix (suggested fix 2).\"", "updated_at": "2026-10-20T03:17:13.360", "published_at": "2026-10-14T22:17:23.050", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "7.0.02", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-119", "what_happened": "A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whisper_model_load of the file external/whispercpp/whisper.cpp of the component Model Loader. The manipulation of the argument n_dims leads to out-of-bounds write. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is a910d21a2705ef4cd16d91f29cdc8da1ab1a7221. To fix this issue, it is recommended to deploy a patch. The project maintainer confirms: \"We did a quick fix (suggested fix 1) for Praat version 7.0.03, and scheduled a better fix (suggested fix 2).\"", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/PaulBoersma/praat/commit/a910d21a2705ef4cd16d91f29cdc8da1ab1a7221", "https://github.com/praat/praat.github.io/issues/3348", "https://vuldb.com/cve/CVE-2026-110698", "https://vuldb.com/submit/1004713", "https://vuldb.com/vuln/419892", "https://vuldb.com/vuln/419892/cti" ], "timeline": [ { "at": "2026-10-14T22:17:23.050", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110698" } ] }, { "id": "CVE-2026-110689", "vendor": "OpenClaw", "product": "ClawScan", "title": "ClawScan vulnerability", "summary": "A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6. This impacts the function shouldSkipTargetPath of the file internal/runner/runner.go of the component Static Scanner. Performing a manipulation results in protection mechanism failure. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.1.7 will fix this issue. The patch is named 9f6a6fbb9f1137345566d0ab44c73893dfe112fa. The affected component should be upgraded.", "updated_at": "2026-10-20T03:17:13.190", "published_at": "2026-10-14T21:17:36.433", "cvss": 1.9, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0.1.0; 0.1.1; 0.1.2; 0.1.3; 0.1.4; 0.1.5; 0.1.6", "fixed": "See vendor advisory", "source_count": 10, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-693", "what_happened": "A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6. This impacts the function shouldSkipTargetPath of the file internal/runner/runner.go of the component Static Scanner. Performing a manipulation results in protection mechanism failure. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.1.7 will fix this issue. The patch is named 9f6a6fbb9f1137345566d0ab44c73893dfe112fa. The affected component should be upgraded.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/nedlir/skills-scanner-bypass", "https://github.com/openclaw/clawscan/", "https://github.com/openclaw/clawscan/commit/9f6a6fbb9f1137345566d0ab44c73893dfe112fa", "https://github.com/openclaw/clawscan/issues/39", "https://github.com/openclaw/clawscan/pull/41", "https://github.com/openclaw/clawscan/releases/tag/v0.1.7", "https://vuldb.com/cve/CVE-2026-110689", "https://vuldb.com/submit/1003915", "https://vuldb.com/vuln/419836", "https://vuldb.com/vuln/419836/cti" ], "timeline": [ { "at": "2026-10-14T21:17:36.433", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110689" } ] }, { "id": "CVE-2026-110668", "vendor": "cemtan", "product": "sar2html", "title": "sar2html vulnerability", "summary": "A weakness has been identified in cemtan sar2html 4.0.0. Affected by this issue is the function index of the file sar2html.py. This manipulation of the argument sort causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.", "updated_at": "2026-10-20T03:17:13.047", "published_at": "2026-10-14T20:17:30.997", "cvss": 5.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "4.0.0", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-74", "what_happened": "A weakness has been identified in cemtan sar2html 4.0.0. Affected by this issue is the function index of the file sar2html.py. This manipulation of the argument sort causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/cemtan/sar2html/", "https://github.com/cemtan/sar2html/issues/20", "https://vuldb.com/cve/CVE-2026-110668", "https://vuldb.com/submit/1003762", "https://vuldb.com/vuln/419828", "https://vuldb.com/vuln/419828/cti" ], "timeline": [ { "at": "2026-10-14T20:17:30.997", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110668" } ] }, { "id": "CVE-2026-110659", "vendor": "serge1", "product": "ELFIO", "title": "ELFIO vulnerability", "summary": "ELFIO through 3.12 contains a NULL pointer dereference vulnerability in relocation_section_accessor get_entry() that allows attackers to crash applications via an unvalidated sh_link index. Attackers can supply a crafted ELF file whose SHT_REL or SHT_RELA section has a dangling sh_link, causing find_hash_section() to dereference null and deny service.", "updated_at": "2026-10-20T02:17:10.363", "published_at": "2026-10-14T16:17:42.780", "cvss": 6.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 3.12 (custom)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-476", "what_happened": "ELFIO through 3.12 contains a NULL pointer dereference vulnerability in relocation_section_accessor get_entry() that allows attackers to crash applications via an unvalidated sh_link index. Attackers can supply a crafted ELF file whose SHT_REL or SHT_RELA section has a dangling sh_link, causing find_hash_section() to dereference null and deny service.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/serge1/ELFIO", "https://github.com/serge1/ELFIO/blob/8ae6cec5d60495822ecd57d736f66149da9b1830/elfio/elfio_relocation.hpp#L142", "https://hackmd.io/@haind-pwn/elfio-relocation-get-entry-null-deref", "https://www.vulncheck.com/advisories/elfio-through-3.12-null-pointer-dereference-via-relocation-section-accessor-get-entry" ], "timeline": [ { "at": "2026-10-14T16:17:42.780", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110659" } ] }, { "id": "CVE-2026-110654", "vendor": "zapping-vbi", "product": "libzvbi", "title": "libzvbi vulnerability", "summary": "libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application.", "updated_at": "2026-10-20T02:17:10.230", "published_at": "2026-10-14T16:17:42.070", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 0.2.45 (semver)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-787", "what_happened": "libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/zapping-vbi/zvbi", "https://github.com/zapping-vbi/zvbi/blob/d3a5ee9f2b047bf16cd1ee5ccf6ec05ee75409d0/src/packet.c#L447", "https://hackmd.io/@haind-pwn/zvbi-teletext-drcs-mode-oob-write", "https://www.vulncheck.com/advisories/libzvbi-through-0.2.45-out-of-bounds-write-via-teletext-drcs-convert-drcs" ], "timeline": [ { "at": "2026-10-14T16:17:42.070", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110654" } ] }, { "id": "CVE-2026-110646", "vendor": "beganovich", "product": "snappdf", "title": "snappdf vulnerability", "summary": "Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL. Attackers can supply cmd.exe metacharacters such as & in the setUrl() value, which executeOnWindows() passes unescaped to PHP exec(), executing commands as the PHP process.", "updated_at": "2026-10-20T02:17:10.103", "published_at": "2026-10-14T15:17:18.237", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "1.1.0 through before 6.1.0 (semver)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-78", "what_happened": "Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL. Attackers can supply cmd.exe metacharacters such as & in the setUrl() value, which executeOnWindows() passes unescaped to PHP exec(), executing commands as the PHP process.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/beganovich/snappdf/blob/v6.0.0/src/Snappdf.php#L280-L284", "https://github.com/beganovich/snappdf/commit/5197bd3bcc4df44e17246dbceea9ce51eb390eae", "https://github.com/beganovich/snappdf/pull/54", "https://github.com/beganovich/snappdf/releases/tag/v6.1.0", "https://www.vulncheck.com/advisories/beganovich-snappdf-1.1.0-before-6.1.0-os-command-injection-on-windows-via-seturl" ], "timeline": [ { "at": "2026-10-14T15:17:18.237", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110646" } ] }, { "id": "CVE-2026-110641", "vendor": "runnerty", "product": "@runnerty/executor-decompress", "title": "@runnerty/executor-decompress vulnerability", "summary": "@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compress_file. Attackers who can name a file dropped into a watched directory can inject $() substitutions or unquoted shell metacharacters into shelljs exec() calls, running commands with Runnerty process privileges.", "updated_at": "2026-10-20T02:17:09.973", "published_at": "2026-10-14T15:17:17.437", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 3.1.1 (semver)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-78", "what_happened": "@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compress_file. Attackers who can name a file dropped into a watched directory can inject $() substitutions or unquoted shell metacharacters into shelljs exec() calls, running commands with Runnerty process privileges.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/runnerty/executor-decompress/blob/1a625bb84d24550df3b96deeaa6bd9da1c092131/index.js#L106", "https://github.com/runnerty/executor-decompress/blob/1a625bb84d24550df3b96deeaa6bd9da1c092131/index.js#L26", "https://github.com/runnerty/executor-decompress/pull/7", "https://www.vulncheck.com/advisories/runnerty-executor-decompress-through-3.1.1-os-command-injection-via-archive-file-name" ], "timeline": [ { "at": "2026-10-14T15:17:17.437", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110641" } ] }, { "id": "CVE-2026-110636", "vendor": "revolunet", "product": "pypdftk", "title": "pypdftk vulnerability", "summary": "pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths. Attackers controlling pdf_path or out_file can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execute OS commands as the Python process.", "updated_at": "2026-10-20T02:17:09.833", "published_at": "2026-10-14T15:17:16.710", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 0.5 (custom)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-78", "what_happened": "pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths. Attackers controlling pdf_path or out_file can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execute OS commands as the Python process.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/revolunet/pypdftk", "https://github.com/revolunet/pypdftk/blob/1d3b40c3b42fb3cc6b0192d34aba2c21a1efd369/pypdftk.py#L87-L123", "https://github.com/revolunet/pypdftk/issues/56", "https://github.com/revolunet/pypdftk/pull/57", "https://www.vulncheck.com/advisories/pypdftk-through-0.5-os-command-injection-via-pdf-and-output-paths" ], "timeline": [ { "at": "2026-10-14T15:17:16.710", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110636" } ] }, { "id": "CVE-2026-110631", "vendor": "moghtech", "product": "komodo", "title": "komodo vulnerability", "summary": "Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to issue Periphery API requests, including terminal sessions and container operations, executing commands on managed hosts typically as root.", "updated_at": "2026-10-20T02:17:09.693", "published_at": "2026-10-14T15:17:15.983", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.3.3 (semver)", "fixed": "See vendor advisory", "source_count": 8, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-1188", "what_happened": "Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to issue Periphery API requests, including terminal sessions and container operations, executing commands on managed hosts typically as root.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/moghtech/komodo/blob/v1.19.5/bin/periphery/src/api/router.rs", "https://github.com/moghtech/komodo/blob/v2.3.3/bin/periphery/src/connection/server.rs", "https://github.com/moghtech/komodo/blob/v2.3.3/bin/periphery/src/state.rs#L82-L88", "https://github.com/moghtech/komodo/blob/v2.3.3/config/periphery.config.toml", "https://github.com/moghtech/komodo/issues/1690", "https://ravindulakmina.pages.dev/advisories/komodo-periphery-fail-open-rce/", "https://www.vulncheck.com/advisories/komodo-through-2.3.3-periphery-agent-unauthenticated-rce-via-default-configuration", "https://ravindulakmina.pages.dev/advisories/cve-2026-110631-komodo-periphery-fail-open-rce/" ], "timeline": [ { "at": "2026-10-14T15:17:15.983", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110631" } ] }, { "id": "CVE-2026-110626", "vendor": "MacWarrior", "product": "clipbucket-v5", "title": "clipbucket-v5 vulnerability", "summary": "ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/language_settings.php via the unencoded edit_language GET parameter. Attackers can send administrators with basic_settings permission a crafted link whose payload is echoed into a hidden input, executing script in the admin panel origin.", "updated_at": "2026-10-20T02:17:09.553", "published_at": "2026-10-14T15:17:15.253", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 5.5.3-#206 (custom)", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/language_settings.php via the unencoded edit_language GET parameter. Attackers can send administrators with basic_settings permission a crafted link whose payload is echoed into a hidden input, executing script in the admin panel origin.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/MacWarrior/clipbucket-v5", "https://github.com/MacWarrior/clipbucket-v5/blob/01990c0fa7baf925d2a4cf6ec1b75b1341b7a486/upload/admin_area/language_settings.php#L32-L37", "https://github.com/MacWarrior/clipbucket-v5/blob/01990c0fa7baf925d2a4cf6ec1b75b1341b7a486/upload/admin_area/styles/cb_2014/layout/blocks/language_edit.html#L40", "https://github.com/MacWarrior/clipbucket-v5/commit/0c1b5878a6135950d8a516975c4585e3b7c8790d", "https://hackmd.io/@leediay/BJR_lh2ifg", "https://www.vulncheck.com/advisories/clipbucket-v5-through-5.5.3-206-reflected-xss-via-edit-language-in-language-settings-php" ], "timeline": [ { "at": "2026-10-14T15:17:15.253", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110626" } ] }, { "id": "CVE-2026-110621", "vendor": "Swetrix", "product": "swetrix", "title": "swetrix vulnerability", "summary": "Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking ID to read analytics, change settings, or delete it.", "updated_at": "2026-10-20T02:17:09.410", "published_at": "2026-10-14T15:17:14.497", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 5.1.0 (semver)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking ID to read analytics, change settings, or delete it.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/Swetrix/swetrix/blob/v5.0.3/backend/apps/cloud/src/project/project.controller.ts#L888-L920", "https://github.com/Swetrix/swetrix/commit/63eb76edcb446402ad1db5ff870920773f5ff588", "https://github.com/Swetrix/swetrix/issues/477", "https://github.com/Swetrix/swetrix/releases/tag/v5.1.0", "https://www.vulncheck.com/advisories/swetrix-cloud-before-5.1.0-missing-authorization-via-post-project-organisation-orgid" ], "timeline": [ { "at": "2026-10-14T15:17:14.497", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110621" } ] }, { "id": "CVE-2026-110616", "vendor": "nullclaw", "product": "NullHub", "title": "NullHub vulnerability", "summary": "NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback listeners can control agent instances, rewrite configurations including provider credentials, and manage cron jobs and MCP servers.", "updated_at": "2026-10-20T02:17:09.270", "published_at": "2026-10-14T15:17:13.767", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2026.5.29 (custom)", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-306", "what_happened": "NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback listeners can control agent instances, rewrite configurations including provider credentials, and manage cron jobs and MCP servers.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/nullclaw/nullhub", "https://github.com/nullclaw/nullhub/blob/v2026.5.29/Dockerfile#L69-L71", "https://github.com/nullclaw/nullhub/blob/v2026.5.29/src/api/settings.zig#L29-L54", "https://github.com/nullclaw/nullhub/blob/v2026.5.29/src/server.zig#L546-L556", "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/rJrLma3izg", "https://www.vulncheck.com/advisories/nullhub-through-2026.5.29-missing-authentication-for-api-management-api" ], "timeline": [ { "at": "2026-10-14T15:17:13.767", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110616" } ] }, { "id": "CVE-2026-110611", "vendor": "getrebuild", "product": "rebuild", "title": "rebuild vulnerability", "summary": "REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. Authenticated low-privilege users can supply another user's chatid to chat-init, chat-delete, chat-feedback, or chat-stream-stop to read, delete, exfiltrate, or interrupt AI assistant conversations.", "updated_at": "2026-10-20T02:17:09.137", "published_at": "2026-10-14T15:17:13.053", "cvss": 6, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 4.5.0 (semver)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "High", "cwe": "CWE-639", "what_happened": "REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. Authenticated low-privilege users can supply another user's chatid to chat-init, chat-delete, chat-feedback, or chat-stream-stop to read, delete, exfiltrate, or interrupt AI assistant conversations.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/getrebuild/rebuild/blob/48c6cc42f9c331cc57c057fa9c66d6cbda990131/src/main/java/com/rebuild/core/aibot2/ChatManager.java#L99-L101", "https://github.com/getrebuild/rebuild/blob/48c6cc42f9c331cc57c057fa9c66d6cbda990131/src/main/java/com/rebuild/web/aibot/AiBot2Controller.java#L151-L203", "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/getrebuild-rebuild-aibot-chat-idor", "https://www.vulncheck.com/advisories/rebuild-through-4.5.0-authorization-bypass-via-aibot2-chat-endpoints-chatid" ], "timeline": [ { "at": "2026-10-14T15:17:13.053", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110611" } ] }, { "id": "CVE-2026-110606", "vendor": "LibreCAD", "product": "libdxfrw", "title": "libdxfrw vulnerability", "summary": "LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the decrypted header to read adjacent stack memory and crash the process.", "updated_at": "2026-10-20T02:17:08.997", "published_at": "2026-10-14T15:17:12.303", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through LC2.2.0 (custom); 0 through 2.2.1.5 (custom)", "fixed": "See vendor advisory", "source_count": 8, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-125", "what_happened": "LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the decrypted header to read adjacent stack memory and crash the process.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/LibreCAD/LibreCAD/blob/v2.2.1.5/libraries/libdxfrw/src/intern/dwgreader18.cpp#L248", "https://github.com/LibreCAD/LibreCAD/commit/abd1f4a8e32dbd871c986086227502217200cd4b", "https://github.com/LibreCAD/LibreCAD/issues/2554", "https://github.com/LibreCAD/libdxfrw/blob/LC2.2.0/src/intern/dwgreader18.cpp#L248", "https://github.com/LibreCAD/libdxfrw/commit/0c5595930b20917a40ed7c188475eaca624b8ce9", "https://hackmd.io/@haind-pwn/libdxfrw-dwg-header-oob-read", "https://www.vulncheck.com/advisories/librecad-libdxfrw-through-lc2-2.0-stack-out-of-bounds-read-via-dwgreader18-readfileheader" ], "timeline": [ { "at": "2026-10-14T15:17:12.303", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110606" } ] }, { "id": "CVE-2026-110253", "vendor": "boldgrid", "product": "weForms – Easy Drag & Drop Contact Form Builder For WordPress", "title": "weForms – Easy Drag & Drop Contact Form Builder For WordPress vulnerability", "summary": "The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weforms_delete_entry_attachments function in all versions up to, and including, 1.6.28 This makes it possible for unauthenticated attackers to delete arbitrary media files on the server. This requires an administrator to permanently delete the poisoned form entry, a routine moderation action for spam-looking submissions that an attacker can prompt through social engineering.", "updated_at": "2026-10-17T08:16:28.167", "published_at": "2026-10-17T08:16:28.167", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.6.28 (semver)", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-22", "what_happened": "The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weforms_delete_entry_attachments function in all versions up to, and including, 1.6.28 This makes it possible for unauthenticated attackers to delete arbitrary media files on the server. This requires an administrator to permanently delete the poisoned form entry, a routine moderation action for spam-looking submissions that an attacker can prompt through social engineering.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/BoldGrid/weforms/tree/1.6.29", "https://plugins.trac.wordpress.org/browser/weforms/tags/1.6.28/includes/class-ajax.php#L1056", "https://plugins.trac.wordpress.org/browser/weforms/tags/1.6.28/includes/class-ajax.php#L627", "https://plugins.trac.wordpress.org/browser/weforms/tags/1.6.28/includes/class-ajax.php#L711", "https://plugins.trac.wordpress.org/browser/weforms/tags/1.6.28/includes/fields/class-field-image.php#L138", "https://plugins.trac.wordpress.org/browser/weforms/tags/1.6.28/includes/functions.php#L362", "https://www.wordfence.com/threat-intel/vulnerabilities/id/cb7478fa-418d-43ce-8db7-b7ede06574df?source=cve" ], "timeline": [ { "at": "2026-10-17T08:16:28.167", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110253" } ] }, { "id": "CVE-2026-110237", "vendor": "vifm", "product": "vifm", "title": "vifm vulnerability", "summary": "Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that execute with the victim's privileges.", "updated_at": "2026-10-17T02:17:18.340", "published_at": "2026-10-13T19:18:48.917", "cvss": 7, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0.8.1-beta through 0.14.4 (semver)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-283", "what_happened": "Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that execute with the victim's privileges.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/vifm/vifm/blob/v0.14.4/src/ipc.c#L394-L443", "https://github.com/vifm/vifm/blob/v0.14.4/src/ipc.c#L866-L874", "https://github.com/vifm/vifm/releases/tag/v0.14.4", "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/SkX7Pmiofg", "https://www.vulncheck.com/advisories/vifm-0.8.1-beta-through-0.14.4-unverified-ipc-fifo-ownership-allows-cross-user-command-execution" ], "timeline": [ { "at": "2026-10-13T19:18:48.917", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110237" } ] }, { "id": "CVE-2026-110232", "vendor": "Fossify", "product": "Fossify File Manager", "title": "Fossify File Manager vulnerability", "summary": "Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check. Attackers can supply archive entries like ../_x/file to create or overwrite files in sibling folders when a user extracts the archive.", "updated_at": "2026-10-17T02:17:18.207", "published_at": "2026-10-13T19:18:48.180", "cvss": 4.6, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.6.2 (semver)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-22", "what_happened": "Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check. Attackers can supply archive entries like ../_x/file to create or overwrite files in sibling folders when a user extracts the archive.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/FossifyOrg/File-Manager/blob/82b3c98c9a7b90d8af2c2ff0c39c87f5917e1b08/app/src/main/kotlin/org/fossify/filemanager/activities/DecompressActivity.kt#L161-L189", "https://github.com/FossifyOrg/File-Manager/releases/tag/1.6.2", "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/Hk2woGjsze", "https://www.vulncheck.com/advisories/fossify-file-manager-through-1.6.2-zip-slip-path-traversal-via-decompressactivity" ], "timeline": [ { "at": "2026-10-13T19:18:48.180", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110232" } ] }, { "id": "CVE-2026-110112", "vendor": "Finsys", "product": "dockhand", "title": "dockhand vulnerability", "summary": "Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate the mapped admin group and log in as Dockhand administrators.", "updated_at": "2026-10-17T02:17:18.083", "published_at": "2026-10-13T19:18:43.257", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 1.0.50 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-863", "what_happened": "Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate the mapped admin group and log in as Dockhand administrators.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/Finsys/dockhand/security/advisories/GHSA-h4vc-h76x-c279", "https://www.vulncheck.com/advisories/dockhand-before-1.0.50-oidc-privilege-escalation-via-missing-token-claim-validation" ], "timeline": [ { "at": "2026-10-13T19:18:43.257", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110112" } ] }, { "id": "CVE-2026-110083", "vendor": "Adobe", "product": "Adobe Experience Manager 6.5", "title": "Adobe Experience Manager 6.5 vulnerability", "summary": "Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.", "updated_at": "2026-10-17T02:17:17.947", "published_at": "2026-10-13T20:17:27.090", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 6.5.25 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-89", "what_happened": "Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://helpx.adobe.com/security/products/experience-manager/apsb26-152.html" ], "timeline": [ { "at": "2026-10-13T20:17:27.090", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110083" } ] }, { "id": "CVE-2026-110078", "vendor": "Adobe", "product": "Adobe Experience Manager 6.5", "title": "Adobe Experience Manager 6.5 vulnerability", "summary": "Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.", "updated_at": "2026-10-17T02:17:17.817", "published_at": "2026-10-13T20:17:26.503", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 6.5.25 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://helpx.adobe.com/security/products/experience-manager/apsb26-152.html" ], "timeline": [ { "at": "2026-10-13T20:17:26.503", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110078" } ] }, { "id": "CVE-2026-110073", "vendor": "Adobe", "product": "Adobe Experience Manager 6.5", "title": "Adobe Experience Manager 6.5 vulnerability", "summary": "Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.", "updated_at": "2026-10-17T02:17:17.683", "published_at": "2026-10-13T20:17:25.890", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 6.5.25 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://helpx.adobe.com/security/products/experience-manager/apsb26-152.html" ], "timeline": [ { "at": "2026-10-13T20:17:25.890", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110073" } ] }, { "id": "CVE-2026-110070", "vendor": "Unknown", "product": "Modern Events Calendar Lite", "title": "Modern Events Calendar Lite vulnerability", "summary": "The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types created by other users.", "updated_at": "2026-10-18T07:16:52.610", "published_at": "2026-10-18T07:16:52.610", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "before 7.36.4 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types created by other users.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/4c7ff021-da5b-44ff-ac99-142b5bdc0790/" ], "timeline": [ { "at": "2026-10-18T07:16:52.610", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110070" } ] }, { "id": "CVE-2026-110069", "vendor": "Unknown", "product": "Modern Events Calendar Lite", "title": "Modern Events Calendar Lite vulnerability", "summary": "The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment amounts of every booking on the site.", "updated_at": "2026-10-18T07:16:52.500", "published_at": "2026-10-18T07:16:52.500", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "before 7.37.0 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment amounts of every booking on the site.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/5d5a24fe-1fb9-48ae-bd5c-de95b04c5f21/" ], "timeline": [ { "at": "2026-10-18T07:16:52.500", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110069" } ] }, { "id": "CVE-2026-110035", "vendor": "Unknown", "product": "Salon Booking System", "title": "Salon Booking System vulnerability", "summary": "The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated user, such as a subscriber, to retrieve every discount coupon configured on the site, including coupons the administrator has chosen to hide from customers, together with their amounts, validity dates and usage limits.", "updated_at": "2026-10-18T07:16:52.397", "published_at": "2026-10-18T07:16:52.397", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "before 10.31.11 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated user, such as a subscriber, to retrieve every discount coupon configured on the site, including coupons the administrator has chosen to hide from customers, together with their amounts, validity dates and usage limits.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/146eaa60-08e8-43b2-8d87-74e79261d422/" ], "timeline": [ { "at": "2026-10-18T07:16:52.397", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110035" } ] }, { "id": "CVE-2026-110033", "vendor": "Unknown", "product": "Salon Booking System", "title": "Salon Booking System vulnerability", "summary": "The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it server-side and writing the response to a publicly accessible location under an attacker-chosen filename, allowing users with the Salon Staff role or higher to force the server to read internal-only resources and disclose them, and to store a malicious SVG that runs arbitrary scripts in the site's origin for anyone who opens it.", "updated_at": "2026-10-18T07:16:52.287", "published_at": "2026-10-18T07:16:52.287", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "before 10.31.11 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it server-side and writing the response to a publicly accessible location under an attacker-chosen filename, allowing users with the Salon Staff role or higher to force the server to read internal-only resources and disclose them, and to store a malicious SVG that runs arbitrary scripts in the site's origin for anyone who opens it.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/6c8f3d74-7aa6-4b4e-96d0-ee89fc47a255/" ], "timeline": [ { "at": "2026-10-18T07:16:52.287", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110033" } ] }, { "id": "CVE-2026-110032", "vendor": "Unknown", "product": "Salon Booking System", "title": "Salon Booking System vulnerability", "summary": "The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edit through the customers management screen, allowing users with the Salon Staff or Salon Worker role to reset any other user's role, including administrators, to a customer and to overwrite arbitrary profile fields on any account, leading to loss of administrative access and potential site lockout.", "updated_at": "2026-10-18T07:16:52.183", "published_at": "2026-10-18T07:16:52.183", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "before 10.31.11 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edit through the customers management screen, allowing users with the Salon Staff or Salon Worker role to reset any other user's role, including administrators, to a customer and to overwrite arbitrary profile fields on any account, leading to loss of administrative access and potential site lockout.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/07310082-5ccc-4703-9344-2bd6e823b245/" ], "timeline": [ { "at": "2026-10-18T07:16:52.183", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110032" } ] }, { "id": "CVE-2026-110031", "vendor": "Unknown", "product": "Salon Booking System", "title": "Salon Booking System vulnerability", "summary": "The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escalate any account to administrator and take over the site.", "updated_at": "2026-10-18T07:16:52.077", "published_at": "2026-10-18T07:16:52.077", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "10.17 through before 10.31.11 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escalate any account to administrator and take over the site.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/8d24ad5b-2d50-467b-9c40-45e86e53dafb/" ], "timeline": [ { "at": "2026-10-18T07:16:52.077", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110031" } ] }, { "id": "CVE-2026-110026", "vendor": "Unknown", "product": "Tasty Recipes Lite", "title": "Tasty Recipes Lite vulnerability", "summary": "The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renaming and deleting taxonomy terms, allowing users with a role as low as Contributor to add, rename and permanently delete terms in any taxonomy on the site, including categories, tags and navigation menus.", "updated_at": "2026-10-18T07:16:51.967", "published_at": "2026-10-18T07:16:51.967", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "1.2 through before 1.2.11 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renaming and deleting taxonomy terms, allowing users with a role as low as Contributor to add, rename and permanently delete terms in any taxonomy on the site, including categories, tags and navigation menus.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/fc8fc746-9ee1-4364-881f-28ff598f007c/" ], "timeline": [ { "at": "2026-10-18T07:16:51.967", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110026" } ] }, { "id": "CVE-2026-109983", "vendor": "wssoffice21", "product": "YMC Filter", "title": "YMC Filter vulnerability", "summary": "The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'post_title' parameter in all versions up to, and including, 3.12.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The autocomplete REST endpoint is registered with a permission callback that unconditionally returns true, meaning any site visitor — including unauthenticated users — can trigger the payload simply by typing in the YMC filter search box, while only Author-level access is required to store it.", "updated_at": "2026-10-17T08:16:28.020", "published_at": "2026-10-17T08:16:28.020", "cvss": 6.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 3.12.19 (semver)", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'post_title' parameter in all versions up to, and including, 3.12.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The autocomplete REST endpoint is registered with a permission callback that unconditionally returns true, meaning any site visitor — including unauthenticated users — can trigger the payload simply by typing in the YMC filter search box, while only Author-level access is required to store it.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://plugins.trac.wordpress.org/browser/ymc-smart-filter/tags/3.12.19/ymc2/assets/js/frontend/ymc-public.min.js#L10", "https://plugins.trac.wordpress.org/browser/ymc-smart-filter/tags/3.12.19/ymc2/src/api/abstracts/FG_REST_Abstract_Controller.php#L66", "https://plugins.trac.wordpress.org/browser/ymc-smart-filter/tags/3.12.19/ymc2/src/api/controllers/frontend/FG_REST_Frontend_Search_Controller.php#L135", "https://plugins.trac.wordpress.org/browser/ymc-smart-filter/tags/3.12.19/ymc2/src/api/controllers/frontend/FG_REST_Frontend_Search_Controller.php#L148", "https://plugins.trac.wordpress.org/browser/ymc-smart-filter/tags/3.12.20/ymc2/src/api/controllers/frontend/FG_REST_Frontend_Search_Controller.php", "https://wordpress.org/plugins/ymc-smart-filter", "https://www.wordfence.com/threat-intel/vulnerabilities/id/27cfa62d-ba16-4344-be0c-82cac4d21d1c?source=cve" ], "timeline": [ { "at": "2026-10-17T08:16:28.020", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109983" } ] }, { "id": "CVE-2026-109938", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2026-109938 exploit", "summary": "Exploit for CVE-2026-109938. CVSS 7.1.", "updated_at": "2026-10-16T18:55:49Z", "published_at": "2026-10-16T18:55:49Z", "cvss": 7.1, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 14, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-10-16T18:55:49+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "CVE-2026-109938 exploit", "summary": "Exploit for CVE-2026-109938. CVSS 7.1.", "cvss": 7.1, "url": "https://sploitus.com/exploit?id=RH%3ACVE-2026-109938" } ], "references": [ "https://sploitus.com/exploit?id=RH%3ACVE-2026-109938" ], "timeline": [ { "at": "2026-10-16T18:55:49Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=RH%3ACVE-2026-109938" } ] }, { "id": "CVE-2026-109937", "vendor": "Unknown", "product": "Otter Blocks", "title": "Otter Blocks vulnerability", "summary": "The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary external URL.", "updated_at": "2026-10-18T07:16:50.927", "published_at": "2026-10-18T07:16:50.927", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "before 3.2.3 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary external URL.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/9765313d-c879-457f-851f-dab74b8d90a0/" ], "timeline": [ { "at": "2026-10-18T07:16:50.927", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109937" } ] }, { "id": "CVE-2026-109701", "vendor": "PAYCOMET", "product": "PAYCOMET for WooCommerce", "title": "PAYCOMET for WooCommerce vulnerability", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PAYCOMET PAYCOMET for WooCommerce paytpv-for-woocommerce allows Reflected XSS.This issue affects PAYCOMET for WooCommerce: from n/a through 5.45.", "updated_at": "2026-10-17T17:16:28.973", "published_at": "2026-10-17T17:16:28.973", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 5.45 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PAYCOMET PAYCOMET for WooCommerce paytpv-for-woocommerce allows Reflected XSS.This issue affects PAYCOMET for WooCommerce: from n/a through 5.45.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/paytpv-for-woocommerce/vulnerability/wordpress-paycomet-for-woocommerce-plugin-5-45-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-10-17T17:16:28.973", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109701" } ] }, { "id": "CVE-2026-109527", "vendor": "modelcontextprotocol", "product": "python-sdk", "title": "python-sdk vulnerability", "summary": "The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP request bodies without enforcing a maximum size. An unauthenticated remote client able to reach an affected endpoint can send a large declared or streamed request body that consumes multiple times the body size in process memory and can repeatedly exhaust memory or terminate the server. Stdio-only servers and deployments with an effective upstream request-size limit are not affected, and applications that use StreamableHTTPServerTransport directly remain responsible for enforcing their own limit. The standard SDK server applications and session managers are fixed in versions 1.29.1 and 2.1.0.", "updated_at": "2026-10-20T02:17:08.867", "published_at": "2026-10-14T18:17:33.447", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "confidence": 35, "confidence_label": "observed", "affected": "< 1.29.1; >= 2.0.0a1, < 2.1.0", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-770", "what_happened": "The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP request bodies without enforcing a maximum size. An unauthenticated remote client able to reach an affected endpoint can send a large declared or streamed request body that consumes multiple times the body size in process memory and can repeatedly exhaust memory or terminate the server. Stdio-only servers and deployments with an effective upstream request-size limit are not affected, and applications that use StreamableHTTPServerTransport directly remain responsible for enforcing their own limit. The standard SDK server applications and session managers are fixed in versions 1.29.1 and 2.1.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/modelcontextprotocol/python-sdk/commit/03aaebd3aadb2567878dd811cb1f141454e8a080", "https://github.com/modelcontextprotocol/python-sdk/commit/4dc224fab201bdef2fd5a065976b7ca31420187c", "https://github.com/modelcontextprotocol/python-sdk/commit/57394b0548d1e2dc2dce8d67d84985769df3b8bb", "https://github.com/modelcontextprotocol/python-sdk/commit/5f0b6af9f2b0aad3be3ba5cbfe80a9e4ea32e189", "https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.29.1", "https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.1.0", "https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-fmmv-w9g8-j3gc" ], "timeline": [ { "at": "2026-10-14T18:17:33.447", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109527" } ] }, { "id": "CVE-2026-109430", "vendor": "Ellucian", "product": "WebAdvisor", "title": "WebAdvisor vulnerability", "summary": "Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can exploit this flaw to force the server into SSRF requests, coerce NTLMv2 hash disclosure via attacker-controlled SMB shares, and read arbitrary files from the underlying Windows host through an out-of-band error-based channel. WebAdvisor entered end-of-support status in June 2022 and users are encouraged to migrate to Colleague Self-Service.", "updated_at": "2026-10-20T03:17:12.903", "published_at": "2026-10-15T02:18:37.150", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "3.2 (custom)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-611", "what_happened": "Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can exploit this flaw to force the server into SSRF requests, coerce NTLMv2 hash disclosure via attacker-controlled SMB shares, and read arbitrary files from the underlying Windows host through an out-of-band error-based channel. WebAdvisor entered end-of-support status in June 2022 and users are encouraged to migrate to Colleague Self-Service.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.ellucian.com/", "https://www.vulncheck.com/advisories/ellucian-webadvisor-unauthenticated-xxe-injection" ], "timeline": [ { "at": "2026-10-15T02:18:37.150", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109430" } ] }, { "id": "CVE-2026-108985", "vendor": "sahlberg", "product": "libnfs", "title": "libnfs vulnerability", "summary": "ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). The caller-supplied maxsize value is not honored.", "updated_at": "2026-10-12T03:17:18.837", "published_at": "2026-10-12T03:17:18.837", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "confidence": 35, "confidence_label": "observed", "affected": "before 7613236464317bee2d9636f087f995148de4db27 (git); 0 through 6.0.2 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-787", "what_happened": "ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). The caller-supplied maxsize value is not honored.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/sahlberg/libnfs/commit/7613236464317bee2d9636f087f995148de4db27" ], "timeline": [ { "at": "2026-10-12T03:17:18.837", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108985" } ] }, { "id": "CVE-2026-108982", "vendor": "IDRIX", "product": "VeraCrypt", "title": "VeraCrypt vulnerability", "summary": "VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data. It does not terminate the FUSE-T auxiliary service (go-nfsv4) and its associated VeraCrypt core-service helper processes when a volume is dismounted. After VeraCrypt reports the volume as dismounted, the auxiliary mount continues to serve the decrypted volume image (volume.dmg) over a loopback SMB session, and the leaked processes retain an open handle to the underlying raw device. A local user or process can therefore remount and access the decrypted volume without the passphrase, e.g., by reopening a previously accessed path (such as through a macOS Open Recent menu) or by attaching volume.dmg from the stale auxiliary mount. (The macFUSE build of VeraCrypt is not affected.)", "updated_at": "2026-10-12T03:17:18.667", "published_at": "2026-10-12T03:17:18.667", "cvss": 7.2, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "1.26.29 (semver)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-459", "what_happened": "VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data. It does not terminate the FUSE-T auxiliary service (go-nfsv4) and its associated VeraCrypt core-service helper processes when a volume is dismounted. After VeraCrypt reports the volume as dismounted, the auxiliary mount continues to serve the decrypted volume image (volume.dmg) over a loopback SMB session, and the leaked processes retain an open handle to the underlying raw device. A local user or process can therefore remount and access the decrypted volume without the passphrase, e.g., by reopening a previously accessed path (such as through a macOS Open Recent menu) or by attaching volume.dmg from the stale auxiliary mount. (The macFUSE build of VeraCrypt is not affected.)", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/veracrypt/VeraCrypt/issues/1779", "https://github.com/veracrypt/VeraCrypt/issues/1845", "https://github.com/veracrypt/VeraCrypt/pull/1866", "https://github.com/veracrypt/VeraCrypt/releases/tag/VeraCrypt_1.26.29", "https://sourceforge.net/p/veracrypt/discussion/general/thread/57f938df8b/" ], "timeline": [ { "at": "2026-10-12T03:17:18.667", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108982" } ] }, { "id": "CVE-2026-108981", "vendor": "denji", "product": "ngx_cache_purge", "title": "ngx_cache_purge vulnerability", "summary": "ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symlink created at an arbitrary earlier time, but does not resolve an applicable TOCTOU race condition. (The ngx_cache_purge module follows symlinks while walking the cache directory tree during purge operations. The module relies on nginx's ngx_walk_tree(), which relies on stat() and therefore follows symlinks.)", "updated_at": "2026-10-12T03:17:18.503", "published_at": "2026-10-12T03:17:18.503", "cvss": 3.6, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "2.4.0 through 2.5.6 (semver); 3.0.0 through before 3.0.4 (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "High", "cwe": "CWE-61", "what_happened": "ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symlink created at an arbitrary earlier time, but does not resolve an applicable TOCTOU race condition. (The ngx_cache_purge module follows symlinks while walking the cache directory tree during purge operations. The module relies on nginx's ngx_walk_tree(), which relies on stat() and therefore follows symlinks.)", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/nginx-modules/ngx_cache_purge/commit/a6da1352f52a8a02dd6828e88c39ed42fddcee96", "https://github.com/nginx-modules/ngx_cache_purge/pull/72", "https://github.com/nginx-modules/ngx_cache_purge/releases/tag/3.0.4" ], "timeline": [ { "at": "2026-10-12T03:17:18.503", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108981" } ] }, { "id": "CVE-2026-108980", "vendor": "Blinko", "product": "Blinko", "title": "Blinko vulnerability", "summary": "Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerTrpc/plugin.ts, and the plugin.installPlugin tRPC procedure is open to any authenticated user. Thus, a name containing ../ sequences writes the downloaded plugin files outside the plugins directory. Because the official Docker image runs as root, an authenticated attacker overwrites a root-owned startup file and achieves remote code execution as root. Self-registration for an account may be possible.", "updated_at": "2026-10-12T02:16:57.297", "published_at": "2026-10-12T02:16:57.297", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.8.8 (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-24", "what_happened": "Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerTrpc/plugin.ts, and the plugin.installPlugin tRPC procedure is open to any authenticated user. Thus, a name containing ../ sequences writes the downloaded plugin files outside the plugins directory. Because the official Docker image runs as root, an authenticated attacker overwrites a root-owned startup file and achieves remote code execution as root. Self-registration for an account may be possible.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/blinkospace/blinko/blob/178e4b3538a21823a50ac2481e653d56cb1ffa86/app/src/pages/signin.tsx#L238-L243", "https://github.com/blinkospace/blinko/blob/178e4b3538a21823a50ac2481e653d56cb1ffa86/server/routerTrpc/plugin.ts#L273", "https://github.com/kashishtopi/blinko-plugin-path-traversal-rce" ], "timeline": [ { "at": "2026-10-12T02:16:57.297", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108980" } ] }, { "id": "CVE-2026-108805", "vendor": "krupalshah", "product": "EmployeeRecruitmentSystem", "title": "EmployeeRecruitmentSystem vulnerability", "summary": "A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysql_query of the file source/loginprocessing.php of the component Login Handler. This manipulation of the argument email/password causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.", "updated_at": "2026-10-12T06:16:59.687", "published_at": "2026-10-12T06:16:59.687", "cvss": 5.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "922ff6d208278282e7c8e36d70d9ae356adec9fe", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-74", "what_happened": "A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysql_query of the file source/loginprocessing.php of the component Login Handler. This manipulation of the argument email/password causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/xiaotian2023/CVE/issues/1", "https://vuldb.com/cve/CVE-2026-108805", "https://vuldb.com/submit/963376", "https://vuldb.com/vuln/416582", "https://vuldb.com/vuln/416582/cti" ], "timeline": [ { "at": "2026-10-12T06:16:59.687", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108805" } ] }, { "id": "CVE-2026-108804", "vendor": "TRENDnet", "product": "TEW-751DR", "title": "TEW-751DR vulnerability", "summary": "A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fwrite of the file pigwidgeon.cgi of the component Web Management Backend. The manipulation of the argument service results in os command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor confirms: \"As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product.\" This vulnerability only affects products that are no longer supported by the maintainer.", "updated_at": "2026-10-12T06:16:59.457", "published_at": "2026-10-12T06:16:59.457", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "1.03B01; 1.03B03", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-77", "what_happened": "A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fwrite of the file pigwidgeon.cgi of the component Web Management Backend. The manipulation of the argument service results in os command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor confirms: \"As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product.\" This vulnerability only affects products that are no longer supported by the maintainer.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/dacj4n/TRENDNetExploits", "https://github.com/dacj4n/TRENDNetExploits/tree/main/exploit", "https://vuldb.com/cve/CVE-2026-108804", "https://vuldb.com/submit/962770", "https://vuldb.com/vuln/416581", "https://vuldb.com/vuln/416581/cti" ], "timeline": [ { "at": "2026-10-12T06:16:59.457", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108804" } ] }, { "id": "CVE-2026-108803", "vendor": "y_project", "product": "RuoYi", "title": "RuoYi vulnerability", "summary": "A security vulnerability has been detected in y_project RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config/add of the component Disable API. The manipulation leads to session expiration. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.", "updated_at": "2026-10-12T06:16:59.410", "published_at": "2026-10-12T06:16:59.223", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "4.8.0; 4.8.1; 4.8.2; 4.8.3", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-613", "what_happened": "A security vulnerability has been detected in y_project RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config/add of the component Disable API. The manipulation leads to session expiration. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/Bob-wentao/security-report-for-ruoyi-csrf-get-delete/blob/main/security-report-ruoyi-4.8.3-insufficient-session-expiration.md", "https://vuldb.com/cve/CVE-2026-108803", "https://vuldb.com/submit/962567", "https://vuldb.com/vuln/416580", "https://vuldb.com/vuln/416580/cti" ], "timeline": [ { "at": "2026-10-12T06:16:59.223", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108803" } ] }, { "id": "CVE-2026-108802", "vendor": "y_project", "product": "RuoYi", "title": "RuoYi vulnerability", "summary": "A weakness has been identified in y_project RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview. Executing a manipulation of the argument cssClass can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.", "updated_at": "2026-10-12T06:16:59.153", "published_at": "2026-10-12T06:16:58.937", "cvss": 2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "4.8.0; 4.8.1; 4.8.2; 4.8.3", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "A weakness has been identified in y_project RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview. Executing a manipulation of the argument cssClass can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/Bob-wentao/security-report-for-ruoyi-dictionary-preview-stored-xss", "https://github.com/Bob-wentao/security-report-for-ruoyi-dictionary-preview-stored-xss/tree/main/poc", "https://vuldb.com/cve/CVE-2026-108802", "https://vuldb.com/submit/962540", "https://vuldb.com/vuln/416579", "https://vuldb.com/vuln/416579/cti" ], "timeline": [ { "at": "2026-10-12T06:16:58.937", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108802" } ] }, { "id": "CVE-2026-108801", "vendor": "prasathmani", "product": "TinyFileManager", "title": "TinyFileManager vulnerability", "summary": "A security flaw has been discovered in prasathmani TinyFileManager up to 2.6. The impacted element is the function move_uploaded_file of the file tinyfilemanager.php. Performing a manipulation of the argument fullpath results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.", "updated_at": "2026-10-12T05:16:59.630", "published_at": "2026-10-12T05:16:59.630", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "2.0; 2.1; 2.2; 2.3; 2.4; 2.5; 2.6", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-284", "what_happened": "A security flaw has been discovered in prasathmani TinyFileManager up to 2.6. The impacted element is the function move_uploaded_file of the file tinyfilemanager.php. Performing a manipulation of the argument fullpath results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://gist.github.com/stoic-crawler/db2649f1df9c4b8a231122eafc92fc9d", "https://vuldb.com/cve/CVE-2026-108801", "https://vuldb.com/submit/962457", "https://vuldb.com/vuln/416578", "https://vuldb.com/vuln/416578/cti" ], "timeline": [ { "at": "2026-10-12T05:16:59.630", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108801" } ] }, { "id": "CVE-2026-108800", "vendor": "yangzongzhuan", "product": "RuoYi", "title": "RuoYi vulnerability", "summary": "A vulnerability was identified in yangzongzhuan RuoYi 4.8.3. The affected element is an unknown function. Such manipulation leads to cross-site request forgery. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.", "updated_at": "2026-10-12T05:16:59.573", "published_at": "2026-10-12T05:16:59.423", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "4.8.3", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-352", "what_happened": "A vulnerability was identified in yangzongzhuan RuoYi 4.8.3. The affected element is an unknown function. Such manipulation leads to cross-site request forgery. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/Bob-wentao/security-report-for-ruoyi-csrf-get-delete", "https://vuldb.com/cve/CVE-2026-108800", "https://vuldb.com/submit/962009", "https://vuldb.com/vuln/416577", "https://vuldb.com/vuln/416577/cti" ], "timeline": [ { "at": "2026-10-12T05:16:59.423", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108800" } ] }, { "id": "CVE-2026-108799", "vendor": "jackq", "product": "XCMS", "title": "XCMS vulnerability", "summary": "A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function PublicController::sendFindPwdMail of the file Admin/Home/Controller/PublicController.class.php of the component Password Recovery Mail Endpoint. This manipulation of the argument email causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.", "updated_at": "2026-10-12T05:16:59.173", "published_at": "2026-10-12T05:16:59.173", "cvss": 5.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "3fab5342cc509945a7ce1b8ec39d19f701b89261", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-74", "what_happened": "A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function PublicController::sendFindPwdMail of the file Admin/Home/Controller/PublicController.class.php of the component Password Recovery Mail Endpoint. This manipulation of the argument email causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/wawyw/cve_report/blob/main/xcms_2.md", "https://vuldb.com/cve/CVE-2026-108799", "https://vuldb.com/submit/961602", "https://vuldb.com/vuln/416576", "https://vuldb.com/vuln/416576/cti" ], "timeline": [ { "at": "2026-10-12T05:16:59.173", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108799" } ] }, { "id": "CVE-2026-108798", "vendor": "ZKTeco", "product": "BioTime", "title": "BioTime vulnerability", "summary": "A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key\r . The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.", "updated_at": "2026-10-12T04:16:48.903", "published_at": "2026-10-12T04:16:48.903", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "9.5.6 Build 20260130.3206", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-320", "what_happened": "A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key\r . The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://vuldb.com/cve/CVE-2026-108798", "https://vuldb.com/submit/961812", "https://vuldb.com/vuln/416575", "https://vuldb.com/vuln/416575/cti" ], "timeline": [ { "at": "2026-10-12T04:16:48.903", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108798" } ] }, { "id": "CVE-2026-108797", "vendor": "ZKTeco", "product": "BioTime", "title": "BioTime vulnerability", "summary": "A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation leads to authorization bypass. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.", "updated_at": "2026-10-12T04:16:48.563", "published_at": "2026-10-12T04:16:48.563", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "9.5.6 Build 20260130.3206", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-285", "what_happened": "A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation leads to authorization bypass. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://vuldb.com/cve/CVE-2026-108797", "https://vuldb.com/submit/961748", "https://vuldb.com/vuln/416574", "https://vuldb.com/vuln/416574/cti" ], "timeline": [ { "at": "2026-10-12T04:16:48.563", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108797" } ] }, { "id": "CVE-2026-108796", "vendor": "ZKTeco", "product": "BioTime", "title": "BioTime vulnerability", "summary": "A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/finger_data/ of the component Biometric Data Endpoint. Executing a manipulation of the argument emp_code can lead to authorization bypass. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.", "updated_at": "2026-10-12T04:16:48.173", "published_at": "2026-10-12T04:16:48.173", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "9.5.6 Build 20260130.3206", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-285", "what_happened": "A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/finger_data/ of the component Biometric Data Endpoint. Executing a manipulation of the argument emp_code can lead to authorization bypass. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://vuldb.com/cve/CVE-2026-108796", "https://vuldb.com/submit/961689", "https://vuldb.com/vuln/416573", "https://vuldb.com/vuln/416573/cti" ], "timeline": [ { "at": "2026-10-12T04:16:48.173", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108796" } ] }, { "id": "CVE-2026-108795", "vendor": "ZKTeco", "product": "BioTime", "title": "BioTime vulnerability", "summary": "A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.", "updated_at": "2026-10-12T04:16:43.580", "published_at": "2026-10-12T04:16:43.580", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "9.5.6 Build 20260130.3206", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-266", "what_happened": "A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://vuldb.com/cve/CVE-2026-108795", "https://vuldb.com/submit/961121", "https://vuldb.com/vuln/416572", "https://vuldb.com/vuln/416572/cti" ], "timeline": [ { "at": "2026-10-12T04:16:43.580", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108795" } ] }, { "id": "CVE-2026-108794", "vendor": "ZKTeco", "product": "BioTime", "title": "BioTime vulnerability", "summary": "A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this vulnerability is an unknown functionality of the file /base/api/v1.0/systemSettings/db_migrate_setting/ of the component Database Migration Functionality. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.", "updated_at": "2026-10-12T03:17:18.343", "published_at": "2026-10-12T03:17:18.343", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "9.5.6 Build 20260130.3206", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-74", "what_happened": "A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this vulnerability is an unknown functionality of the file /base/api/v1.0/systemSettings/db_migrate_setting/ of the component Database Migration Functionality. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://vuldb.com/cve/CVE-2026-108794", "https://vuldb.com/submit/961112", "https://vuldb.com/vuln/416571", "https://vuldb.com/vuln/416571/cti" ], "timeline": [ { "at": "2026-10-12T03:17:18.343", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108794" } ] }, { "id": "CVE-2026-108791", "vendor": "westboy", "product": "CicadasCMS", "title": "CicadasCMS vulnerability", "summary": "A weakness has been identified in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. Affected is the function TemplateController.input of the file /system/cms/template/input of the component Template Management. This manipulation of the argument filePath causes path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.", "updated_at": "2026-10-12T03:17:18.177", "published_at": "2026-10-12T03:17:18.177", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "2431154dac8d0735e04f1fd2a3c3556668fc8dab", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-22", "what_happened": "A weakness has been identified in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. Affected is the function TemplateController.input of the file /system/cms/template/input of the component Template Management. This manipulation of the argument filePath causes path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/wawyw/cve_report/blob/main/CicadasCMS_2.md", "https://vuldb.com/cve/CVE-2026-108791", "https://vuldb.com/submit/959848", "https://vuldb.com/vuln/416570", "https://vuldb.com/vuln/416570/cti" ], "timeline": [ { "at": "2026-10-12T03:17:18.177", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108791" } ] }, { "id": "CVE-2026-108790", "vendor": "westboy", "product": "CicadasCMS", "title": "CicadasCMS vulnerability", "summary": "A security flaw has been discovered in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. This impacts the function TemplateController.save of the file /system/cms/template/save of the component Backend Template Editor. The manipulation results in path traversal. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.", "updated_at": "2026-10-12T03:17:18.003", "published_at": "2026-10-12T03:17:18.003", "cvss": 2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "2431154dac8d0735e04f1fd2a3c3556668fc8dab", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-22", "what_happened": "A security flaw has been discovered in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. This impacts the function TemplateController.save of the file /system/cms/template/save of the component Backend Template Editor. The manipulation results in path traversal. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/wawyw/cve_report/blob/main/CicadasCMS_1.md", "https://vuldb.com/cve/CVE-2026-108790", "https://vuldb.com/submit/959802", "https://vuldb.com/vuln/416569", "https://vuldb.com/vuln/416569/cti" ], "timeline": [ { "at": "2026-10-12T03:17:18.003", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108790" } ] }, { "id": "CVE-2026-108789", "vendor": "deepseek-ai", "product": "deepseek-harness", "title": "deepseek-harness vulnerability", "summary": "A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.1-rc.2. This affects the function agent of the component dsh-workflow-worker-thread. The manipulation leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.", "updated_at": "2026-10-12T03:17:17.820", "published_at": "2026-10-12T03:17:17.820", "cvss": 2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0.1.1-rc.0; 0.1.1-rc.1; 0.1.1-rc.2", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-840", "what_happened": "A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.1-rc.2. This affects the function agent of the component dsh-workflow-worker-thread. The manipulation leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/deepseek-ai/deepseek-harness/", "https://github.com/deepseek-ai/deepseek-harness/discussions/243", "https://mcniyfj5bw9b.feishu.cn/docx/M5H6d9AbioNftYxwk9CchJgGnHc", "https://vuldb.com/cve/CVE-2026-108789", "https://vuldb.com/submit/959699", "https://vuldb.com/vuln/416568", "https://vuldb.com/vuln/416568/cti" ], "timeline": [ { "at": "2026-10-12T03:17:17.820", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108789" } ] }, { "id": "CVE-2026-108788", "vendor": "deepseek-ai", "product": "deepseek-harness", "title": "deepseek-harness vulnerability", "summary": "A vulnerability was determined in deepseek-ai deepseek-harness up to 0.1.1-rc.2. The impacted element is the function spawn of the component Sandbox. Executing a manipulation of the argument Profile can lead to sandbox issue. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.", "updated_at": "2026-10-12T02:16:57.090", "published_at": "2026-10-12T02:16:57.090", "cvss": 1.9, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0.1.1-rc.0; 0.1.1-rc.1; 0.1.1-rc.2", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-264", "what_happened": "A vulnerability was determined in deepseek-ai deepseek-harness up to 0.1.1-rc.2. The impacted element is the function spawn of the component Sandbox. Executing a manipulation of the argument Profile can lead to sandbox issue. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://mcniyfj5bw9b.feishu.cn/docx/EMBrd1Ak3oJDFjx48F9cYH0Snnb", "https://vuldb.com/cve/CVE-2026-108788", "https://vuldb.com/submit/959696", "https://vuldb.com/vuln/416567", "https://vuldb.com/vuln/416567/cti" ], "timeline": [ { "at": "2026-10-12T02:16:57.090", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108788" } ] }, { "id": "CVE-2026-108787", "vendor": "houtini-ai", "product": "voice-analyser-mcp", "title": "voice-analyser-mcp vulnerability", "summary": "A vulnerability was found in houtini-ai voice-analyser-mcp up to 2.1.1. The affected element is the function fetch of the file src/utils/crawler.ts of the component collect_corpus. Performing a manipulation of the argument sitemap_url results in server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.", "updated_at": "2026-10-12T02:16:56.923", "published_at": "2026-10-12T02:16:56.923", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "2.1.0; 2.1.1", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-918", "what_happened": "A vulnerability was found in houtini-ai voice-analyser-mcp up to 2.1.1. The affected element is the function fetch of the file src/utils/crawler.ts of the component collect_corpus. Performing a manipulation of the argument sitemap_url results in server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/Net-defense/public_exp/issues/2", "https://vuldb.com/cve/CVE-2026-108787", "https://vuldb.com/submit/968459", "https://vuldb.com/vuln/416566", "https://vuldb.com/vuln/416566/cti" ], "timeline": [ { "at": "2026-10-12T02:16:56.923", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108787" } ] }, { "id": "CVE-2026-108786", "vendor": "houtini-ai", "product": "seo-crawler-mcp", "title": "seo-crawler-mcp vulnerability", "summary": "A vulnerability has been found in houtini-ai seo-crawler-mcp up to 2.1.5. Impacted is the function run_seo_audit of the file src/core/CrawlOrchestrator.ts of the component Crawler. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", "updated_at": "2026-10-12T02:16:56.753", "published_at": "2026-10-12T02:16:56.753", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-918", "what_happened": "A vulnerability has been found in houtini-ai seo-crawler-mcp up to 2.1.5. Impacted is the function run_seo_audit of the file src/core/CrawlOrchestrator.ts of the component Crawler. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/Net-defense/public_exp/issues/1", "https://vuldb.com/cve/CVE-2026-108786", "https://vuldb.com/submit/959331", "https://vuldb.com/vuln/416565", "https://vuldb.com/vuln/416565/cti" ], "timeline": [ { "at": "2026-10-12T02:16:56.753", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108786" } ] }, { "id": "CVE-2026-108785", "vendor": "macrozheng", "product": "mall", "title": "mall vulnerability", "summary": "A flaw has been found in macrozheng mall up to 1.0.3. This issue affects the function JwtTokenUtil.refreshHeadToken of the file /admin/refreshToken of the component JwtAuthenticationTokenFilter. This manipulation of the argument token causes session expiration. The attack may be initiated remotely. The exploit has been published and may be used. Patch name: 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a. To fix this issue, it is recommended to deploy a patch.", "updated_at": "2026-10-12T02:16:56.573", "published_at": "2026-10-12T02:16:56.573", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "1.0.0; 1.0.1; 1.0.2; 1.0.3", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-613", "what_happened": "A flaw has been found in macrozheng mall up to 1.0.3. This issue affects the function JwtTokenUtil.refreshHeadToken of the file /admin/refreshToken of the component JwtAuthenticationTokenFilter. This manipulation of the argument token causes session expiration. The attack may be initiated remotely. The exploit has been published and may be used. Patch name: 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a. To fix this issue, it is recommended to deploy a patch.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/macrozheng/mall/", "https://github.com/macrozheng/mall/commit/9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a", "https://github.com/macrozheng/mall/issues/997", "https://vuldb.com/cve/CVE-2026-108785", "https://vuldb.com/submit/959284", "https://vuldb.com/vuln/416564", "https://vuldb.com/vuln/416564/cti" ], "timeline": [ { "at": "2026-10-12T02:16:56.573", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108785" } ] }, { "id": "CVE-2026-108784", "vendor": "macrozheng", "product": "mall", "title": "mall vulnerability", "summary": "A vulnerability was detected in macrozheng mall up to 1.0.3. This vulnerability affects the function AlipayServiceImpl.pay of the file com/macro/mall/portal/service/impl/AlipayServiceImpl.java of the component Payment Endpoint. The manipulation of the argument total_amount results in business logic errors. The attack can be launched remotely. The exploit is now public and may be used. The patch is identified as dcaa93b3150352e5044708d7211b5bed0af4509f. A patch should be applied to remediate this issue.", "updated_at": "2026-10-12T02:16:56.390", "published_at": "2026-10-12T02:16:56.390", "cvss": 5.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "1.0.0; 1.0.1; 1.0.2; 1.0.3", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-840", "what_happened": "A vulnerability was detected in macrozheng mall up to 1.0.3. This vulnerability affects the function AlipayServiceImpl.pay of the file com/macro/mall/portal/service/impl/AlipayServiceImpl.java of the component Payment Endpoint. The manipulation of the argument total_amount results in business logic errors. The attack can be launched remotely. The exploit is now public and may be used. The patch is identified as dcaa93b3150352e5044708d7211b5bed0af4509f. A patch should be applied to remediate this issue.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/macrozheng/mall/", "https://github.com/macrozheng/mall/commit/dcaa93b3150352e5044708d7211b5bed0af4509f", "https://github.com/macrozheng/mall/issues/998", "https://vuldb.com/cve/CVE-2026-108784", "https://vuldb.com/submit/959283", "https://vuldb.com/vuln/416563", "https://vuldb.com/vuln/416563/cti" ], "timeline": [ { "at": "2026-10-12T02:16:56.390", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108784" } ] }, { "id": "CVE-2026-108783", "vendor": "PRVTPRO", "product": "Amnezia-Web-Panel", "title": "Amnezia-Web-Panel vulnerability", "summary": "A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2. This affects an unknown part of the file app.py of the component Backup Download. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", "updated_at": "2026-10-12T02:16:56.213", "published_at": "2026-10-12T02:16:56.213", "cvss": 5.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "1.6.0; 1.6.1; 1.6.2; 1.7.0; 1.7.1; 1.7.2", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-1392", "what_happened": "A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2. This affects an unknown part of the file app.py of the component Backup Download. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/ASantsSec/CVE/issues/27", "https://vuldb.com/cve/CVE-2026-108783", "https://vuldb.com/submit/959275", "https://vuldb.com/vuln/416562", "https://vuldb.com/vuln/416562/cti" ], "timeline": [ { "at": "2026-10-12T02:16:56.213", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108783" } ] }, { "id": "CVE-2026-108782", "vendor": "erzhongxmu", "product": "JEEWMS", "title": "JEEWMS vulnerability", "summary": "A weakness has been identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this issue is the function CommonServiceImpl.getAutoList of the file src/main/java/org/jeecgframework/core/common/service/impl/CommonServiceImpl.java of the component Autocomplete Handler. Executing a manipulation of the argument trem/searchField/entityName can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.", "updated_at": "2026-10-12T02:16:56.040", "published_at": "2026-10-12T02:16:56.040", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "2026.09.27-W39", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-74", "what_happened": "A weakness has been identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this issue is the function CommonServiceImpl.getAutoList of the file src/main/java/org/jeecgframework/core/common/service/impl/CommonServiceImpl.java of the component Autocomplete Handler. Executing a manipulation of the argument trem/searchField/entityName can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://vuldb.com/cve/CVE-2026-108782", "https://vuldb.com/submit/959650", "https://vuldb.com/vuln/416561", "https://vuldb.com/vuln/416561/cti" ], "timeline": [ { "at": "2026-10-12T02:16:56.040", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108782" } ] }, { "id": "CVE-2026-108708", "vendor": "WuKongOpenSource", "product": "Wukong_HRM", "title": "Wukong_HRM vulnerability", "summary": "Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards and personal data, edit bank cards, and delete employees, departments and contracts company-wide.", "updated_at": "2026-10-11T02:16:39.650", "published_at": "2026-10-11T02:16:39.650", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 186115e1a5a0b827ad9596ff8c2f3a876fb0cc55 (git)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards and personal data, edit bank cards, and delete employees, departments and contracts company-wide.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_payroll_card_social_security.py", "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_salary_archives_history.py", "https://github.com/WuKongOpenSource/Wukong_HRM/blob/186115e1a5a0b827ad9596ff8c2f3a876fb0cc55/hrm/hrm-web/src/main/java/com/kakarote/hrm/common/EmployeeAspect.java#L28-L45", "https://github.com/WuKongOpenSource/Wukong_HRM/blob/186115e1a5a0b827ad9596ff8c2f3a876fb0cc55/hrm/hrm-web/src/main/java/com/kakarote/hrm/utils/EmployeeUtil.java#L33-L132", "https://www.vulncheck.com/advisories/wukong-hrm-through-commit-186115e-missing-authorization-via-employeeaspect-and-employeeutil" ], "timeline": [ { "at": "2026-10-11T02:16:39.650", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108708" } ] }, { "id": "CVE-2026-108707", "vendor": "WuKongOpenSource", "product": "Wukong_HRM", "title": "Wukong_HRM vulnerability", "summary": "Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records.", "updated_at": "2026-10-11T02:16:39.477", "published_at": "2026-10-11T02:16:39.477", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 186115e1a5a0b827ad9596ff8c2f3a876fb0cc55 (git)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-287", "what_happened": "Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_attachment_download_idor.py", "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_employee_export_pii.py", "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_salary_slip_detail_read.py", "https://github.com/WuKongOpenSource/Wukong_HRM/blob/186115e1a5a0b827ad9596ff8c2f3a876fb0cc55/common/common-web/src/main/java/com/kakarote/core/config/ParamAspect.java#L35-L55", "https://github.com/WuKongOpenSource/Wukong_HRM/blob/186115e1a5a0b827ad9596ff8c2f3a876fb0cc55/hrm/hrm-web/src/main/java/com/kakarote/hrm/common/EmployeeAspect.java#L28-L45", "https://www.vulncheck.com/advisories/wukong-hrm-through-commit-186115e-authentication-bypass-via-paramaspect" ], "timeline": [ { "at": "2026-10-11T02:16:39.477", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108707" } ] }, { "id": "CVE-2026-108706", "vendor": "elunez", "product": "eladmin", "title": "eladmin vulnerability", "summary": "eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated user to retrieve stored object URLs without storage permissions. Attackers can enumerate sequential ids against GET /api/s3Storage/download/{id} to collect URLs of all uploaded objects, exposing file contents on publicly readable buckets.", "updated_at": "2026-10-11T02:16:39.330", "published_at": "2026-10-11T02:16:39.330", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 55fbf705956949697dbd68bf9003776609d3d029 (git)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated user to retrieve stored object URLs without storage permissions. Attackers can enumerate sequential ids against GET /api/s3Storage/download/{id} to collect URLs of all uploaded objects, exposing file contents on publicly readable buckets.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/eladmin/poc_s3Storage_download.py", "https://github.com/elunez/eladmin/blob/55fbf705956949697dbd68bf9003776609d3d029/eladmin-tools/src/main/java/me/zhengjie/rest/S3StorageController.java#L80-L94", "https://www.vulncheck.com/advisories/eladmin-through-commit-55fbf70-missing-authorization-via-s3-storage-download-endpoint" ], "timeline": [ { "at": "2026-10-11T02:16:39.330", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108706" } ] }, { "id": "CVE-2026-108705", "vendor": "1Panel-dev", "product": "CordysCRM", "title": "CordysCRM vulnerability", "summary": "CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data into any custom form by customFormId. Low-privileged attackers can upload Excel files with importType ADD or UPDATE to create records in, or overwrite existing records of, custom forms they cannot manage.", "updated_at": "2026-10-11T02:16:39.273", "published_at": "2026-10-11T02:16:39.160", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.9.3 (custom)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data into any custom form by customFormId. Low-privileged attackers can upload Excel files with importType ADD or UPDATE to create records in, or overwrite existing records of, custom forms they cannot manage.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/1Panel-dev/CordysCRM/blob/0d7ae06fe94f4ce33ec7f65b9d82a07ae05c2d94/backend/crm/src/main/java/cn/cordys/crm/form/controller/CustomFormDataController.java#L148-L154", "https://github.com/1Panel-dev/CordysCRM/blob/0d7ae06fe94f4ce33ec7f65b9d82a07ae05c2d94/backend/crm/src/main/java/cn/cordys/crm/form/service/CustomFormDataService.java#L874-L893", "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/CordysCRM/poc_custom_form_data_import.py", "https://www.vulncheck.com/advisories/cordyscrm-through-1.9.3-missing-authorization-via-custom-form-data-import" ], "timeline": [ { "at": "2026-10-11T02:16:39.160", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108705" } ] }, { "id": "CVE-2026-108704", "vendor": "1Panel-dev", "product": "CordysCRM", "title": "CordysCRM vulnerability", "summary": "CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission checks by setting the owner field to their own user id. Attackers can send requests to the follow/record/add endpoints to add follow-up records and overwrite follow_time and follower on any known customer, clue or opportunity.", "updated_at": "2026-10-11T02:16:39.107", "published_at": "2026-10-11T02:16:38.980", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.9.3 (custom)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-639", "what_happened": "CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission checks by setting the owner field to their own user id. Attackers can send requests to the follow/record/add endpoints to add follow-up records and overwrite follow_time and follower on any known customer, clue or opportunity.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/1Panel-dev/CordysCRM/blob/0d7ae06fe94f4ce33ec7f65b9d82a07ae05c2d94/backend/crm/src/main/java/cn/cordys/crm/clue/controller/ClueFollowRecordController.java#L33-L39", "https://github.com/1Panel-dev/CordysCRM/blob/0d7ae06fe94f4ce33ec7f65b9d82a07ae05c2d94/backend/crm/src/main/java/cn/cordys/crm/customer/controller/CustomerFollowRecordController.java#L35-L41", "https://github.com/1Panel-dev/CordysCRM/blob/0d7ae06fe94f4ce33ec7f65b9d82a07ae05c2d94/backend/crm/src/main/java/cn/cordys/crm/follow/controller/FollowUpRecordController.java#L85-L91", "https://github.com/1Panel-dev/CordysCRM/blob/0d7ae06fe94f4ce33ec7f65b9d82a07ae05c2d94/backend/crm/src/main/java/cn/cordys/crm/follow/service/BaseFollowUpService.java#L198-L204", "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/CordysCRM/poc_follow_record_add.py", "https://www.vulncheck.com/advisories/cordyscrm-through-1.9.3-authorization-bypass-via-follow-up-record-add-endpoints" ], "timeline": [ { "at": "2026-10-11T02:16:38.980", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108704" } ] }, { "id": "CVE-2026-108703", "vendor": "1Panel-dev", "product": "CordysCRM", "title": "CordysCRM vulnerability", "summary": "CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authenticated users to submit any resource for approval without ownership checks. Low-privileged attackers can supply arbitrary resourceId values for contracts, invoices, quotations or orders to alter their approval status and read approval details.", "updated_at": "2026-10-11T02:16:38.937", "published_at": "2026-10-11T02:16:38.803", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.9.3 (custom)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authenticated users to submit any resource for approval without ownership checks. Low-privileged attackers can supply arbitrary resourceId values for contracts, invoices, quotations or orders to alter their approval status and read approval details.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/1Panel-dev/CordysCRM/blob/0d7ae06fe94f4ce33ec7f65b9d82a07ae05c2d94/backend/crm/src/main/java/cn/cordys/crm/approval/controller/ApprovalResourceController.java#L32-L43", "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/CordysCRM/poc_approval_resource_push.py", "https://www.vulncheck.com/advisories/cordyscrm-through-1.9.3-missing-authorization-via-approval-resource-push" ], "timeline": [ { "at": "2026-10-11T02:16:38.803", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108703" } ] }, { "id": "CVE-2026-108702", "vendor": "1Panel-dev", "product": "CordysCRM", "title": "CordysCRM vulnerability", "summary": "1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval-flow/webhook/test, allowing any authenticated user to trigger server-side requests to attacker-supplied URLs. Attackers can redirect GET requests from a controlled host to bypass SSRFValidator and probe internal addresses through success or failure results.", "updated_at": "2026-10-11T02:16:38.750", "published_at": "2026-10-11T02:16:38.627", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.9.3 (custom)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval-flow/webhook/test, allowing any authenticated user to trigger server-side requests to attacker-supplied URLs. Attackers can redirect GET requests from a controlled host to bypass SSRFValidator and probe internal addresses through success or failure results.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/1Panel-dev/CordysCRM/blob/0d7ae06fe94f4ce33ec7f65b9d82a07ae05c2d94/backend/crm/src/main/java/cn/cordys/crm/approval/controller/ApprovalFlowController.java#L101-L105", "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/CordysCRM/poc_approval_flow_webhook_test_ssrf.py", "https://www.vulncheck.com/advisories/cordyscrm-through-1.9.3-missing-authorization-and-blind-ssrf-via-webhook-test" ], "timeline": [ { "at": "2026-10-11T02:16:38.627", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108702" } ] }, { "id": "CVE-2026-108701", "vendor": "1Panel-dev", "product": "CordysCRM", "title": "CordysCRM vulnerability", "summary": "1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule handler for POST /contract/sort, which lacks any permission annotation. Authenticated users without contract update permission can supply a dragNodeId, stage and field values to modify any contract, including contracts in other organizations.", "updated_at": "2026-10-11T02:16:38.580", "published_at": "2026-10-11T02:16:38.437", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 1.9.2 (custom)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule handler for POST /contract/sort, which lacks any permission annotation. Authenticated users without contract update permission can supply a dragNodeId, stage and field values to modify any contract, including contracts in other organizations.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/1Panel-dev/CordysCRM/blob/a0ef69d31fd98c338199579353840f34ef679197/backend/crm/src/main/java/cn/cordys/crm/contract/controller/ContractController.java#L279-L283", "https://github.com/1Panel-dev/CordysCRM/commit/98e2615569b402063bc02f369274a05f40217d6e", "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/CordysCRM/poc_contract_sort_write_bfla.py", "https://www.vulncheck.com/advisories/1panel-dev-cordyscrm-before-1.9.2-missing-authorization-via-post-contract-sort" ], "timeline": [ { "at": "2026-10-11T02:16:38.437", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108701" } ] }, { "id": "CVE-2026-108700", "vendor": "1Panel-dev", "product": "CordysCRM", "title": "CordysCRM vulnerability", "summary": "1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-title without permission checks. Users lacking CONTRACT_BUSINESS_TITLE_READ can retrieve organization invoicing entities, exposing tax identification numbers, bank account numbers, opening banks, registration addresses, and phone numbers.", "updated_at": "2026-10-11T02:16:38.397", "published_at": "2026-10-11T02:16:38.277", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 1.9.2 (custom)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-title without permission checks. Users lacking CONTRACT_BUSINESS_TITLE_READ can retrieve organization invoicing entities, exposing tax identification numbers, bank account numbers, opening banks, registration addresses, and phone numbers.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/1Panel-dev/CordysCRM/blob/a0ef69d31fd98c338199579353840f34ef679197/backend/crm/src/main/java/cn/cordys/crm/system/controller/ModuleFieldController.java#L253-L257", "https://github.com/1Panel-dev/CordysCRM/commit/a31fa16fb2dc86ab6b0fdc1ee58a204af424f38d", "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/CordysCRM/poc_field_source_family.py", "https://www.vulncheck.com/advisories/1panel-dev-cordyscrm-before-1.9.2-missing-authorization-via-field-source-business-title" ], "timeline": [ { "at": "2026-10-11T02:16:38.277", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108700" } ] }, { "id": "CVE-2026-108696", "vendor": "CoreUnion", "product": "CoreShop", "title": "CoreShop vulnerability", "summary": "CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated customers to act on other customers' orders by supplying user-controlled ids. Attackers can omit the data field in OrderConfirm or supply another reshipId to SendReship to confirm receipt of others' orders and overwrite return tracking details.", "updated_at": "2026-10-11T02:16:38.123", "published_at": "2026-10-11T02:16:38.123", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.5.5 (semver)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-639", "what_happened": "CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated customers to act on other customers' orders by supplying user-controlled ids. Attackers can omit the data field in OrderConfirm or supply another reshipId to SendReship to confirm receipt of others' orders and overwrite return tracking details.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/CoreUnion/CoreShop", "https://github.com/CoreUnion/CoreShop/blob/ca7408b025bc5f3fd5957a79618ffe991c4e91ab/CoreCms.Net.Services/Order/CoreCmsOrderServices.cs#L2048-L2060", "https://github.com/CoreUnion/CoreShop/blob/ca7408b025bc5f3fd5957a79618ffe991c4e91ab/CoreCms.Net.Web.WebApi/Controllers/OrderController.cs#L281-L294", "https://github.com/CoreUnion/CoreShop/blob/ca7408b025bc5f3fd5957a79618ffe991c4e91ab/CoreCms.Net.Web.WebApi/Controllers/OrderController.cs#L422-L458", "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/SkVjopPsGe", "https://www.vulncheck.com/advisories/coreshop-through-1.5.5-authorization-bypass-via-ordercontroller-orderconfirm-and-sendreship" ], "timeline": [ { "at": "2026-10-11T02:16:38.123", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108696" } ] }, { "id": "CVE-2026-108695", "vendor": "multivendorx", "product": "MultiVendorX", "title": "MultiVendorX vulnerability", "summary": "MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the store_owner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only by edit_stores, to overwrite commission, payout, and onboarding settings.", "updated_at": "2026-10-11T02:16:37.957", "published_at": "2026-10-11T02:16:37.957", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 5.0.19 (semver)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-863", "what_happened": "MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the store_owner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only by edit_stores, to overwrite commission, payout, and onboarding settings.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/multivendorx/multivendorx", "https://github.com/multivendorx/multivendorx/blob/8a717799b02f698e4b2b61a282062a41fbe15183/plugins/multivendorx/classes/RestAPI/Controllers/Settings.php#L157-L172", "https://github.com/multivendorx/multivendorx/blob/8a717799b02f698e4b2b61a282062a41fbe15183/plugins/multivendorx/classes/RestAPI/Controllers/Settings.php#L77-L80", "https://github.com/multivendorx/multivendorx/issues/2375", "https://wordpress.org/plugins/dc-woocommerce-multi-vendor/", "https://www.vulncheck.com/advisories/multivendorx-through-5.0.19-incorrect-authorization-via-settings-rest-endpoint" ], "timeline": [ { "at": "2026-10-11T02:16:37.957", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108695" } ] }, { "id": "CVE-2026-108694", "vendor": "C4illin", "product": "ConvertX", "title": "ConvertX vulnerability", "summary": "ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path, convert it, and download output containing the referenced file's contents.", "updated_at": "2026-10-11T02:16:37.777", "published_at": "2026-10-11T02:16:37.777", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 0.19.0 (semver)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-73", "what_happened": "ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path, convert it, and download output containing the referenced file's contents.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/C4illin/ConvertX", "https://github.com/C4illin/ConvertX/blob/710bc7c71712af04198a39f003e3ea1aa5168a31/src/converters/pandoc.ts#L123-L152", "https://github.com/C4illin/ConvertX/issues/668", "https://www.vulncheck.com/advisories/convertx-through-0.19.0-arbitrary-file-read-via-pandoc-converter" ], "timeline": [ { "at": "2026-10-11T02:16:37.777", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108694" } ] }, { "id": "CVE-2026-108693", "vendor": "ImageMagick", "product": "ImageMagick", "title": "ImageMagick vulnerability", "summary": "ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE() that launches gswin64c.exe by bare name when Ghostscript is unregistered. Attackers can plant a malicious gswin64c.exe in the working directory to execute code with ImageMagick privileges when PDF, PostScript, or EPS files are converted.", "updated_at": "2026-10-11T02:16:37.607", "published_at": "2026-10-11T02:16:37.607", "cvss": 7.3, "cvss_vector": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "7.0.0-0 through 7.1.2-33 (custom); 0 through 6.9.13-58 (custom)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "High", "cwe": "CWE-427", "what_happened": "ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE() that launches gswin64c.exe by bare name when Ghostscript is unregistered. Attackers can plant a malicious gswin64c.exe in the working directory to execute code with ImageMagick privileges when PDF, PostScript, or EPS files are converted.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/ImageMagick/ImageMagick", "https://github.com/ImageMagick/ImageMagick/blob/211e5b975a0019a88dcef5f84c1193f46738d815/MagickCore/nt-base.c#L1469-L1511", "https://github.com/ImageMagick/ImageMagick/blob/211e5b975a0019a88dcef5f84c1193f46738d815/MagickCore/nt-base.c#L2829-L2832", "https://github.com/ghostx-86/exploitarium/tree/main/imagemagick-gs-delegate-hijack-poc", "https://www.vulncheck.com/advisories/imagemagick-through-7.1.2-33-and-6.9.13-58-uncontrolled-search-path-via-ghostscript-delegate" ], "timeline": [ { "at": "2026-10-11T02:16:37.607", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108693" } ] }, { "id": "CVE-2026-108692", "vendor": "1Panel-dev", "product": "CordysCRM", "title": "CordysCRM vulnerability", "summary": "1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source endpoints lacking permission checks. Authenticated users denied module permission can page through organization-wide leads, contacts, quotations, contracts, payment plans, payment records, orders and invoices owned by other users.", "updated_at": "2026-10-11T02:16:37.490", "published_at": "2026-10-11T02:16:37.360", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "1.9.0 through before 1.9.2 (custom)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source endpoints lacking permission checks. Authenticated users denied module permission can page through organization-wide leads, contacts, quotations, contracts, payment plans, payment records, orders and invoices owned by other users.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/1Panel-dev/CordysCRM/blob/a0ef69d31fd98c338199579353840f34ef679197/backend/crm/src/main/java/cn/cordys/common/service/DataScopeService.java#L100-L110", "https://github.com/1Panel-dev/CordysCRM/blob/a0ef69d31fd98c338199579353840f34ef679197/backend/crm/src/main/java/cn/cordys/crm/system/controller/ModuleFieldController.java#L133-L266", "https://github.com/1Panel-dev/CordysCRM/commit/a31fa16fb2dc86ab6b0fdc1ee58a204af424f38d", "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/CordysCRM/poc_field_source_family.py", "https://www.vulncheck.com/advisories/1panel-dev-cordyscrm-1.9.0-before-1.9.2-missing-authorization-via-field-source-endpoints" ], "timeline": [ { "at": "2026-10-11T02:16:37.360", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108692" } ] }, { "id": "CVE-2026-108691", "vendor": "gz-yami", "product": "mall4j", "title": "mall4j vulnerability", "summary": "mall4j through 4.0 contains an improper authorization vulnerability that allows authenticated storefront customers to delete other shoppers' cart items through an operator precedence error in the cleanExpiryProdList SQL statement. Attackers can send one DELETE request to /p/shopCart/cleanExpiryProdList to remove every user's cart entries for off-shelf products, which do not return when products are restocked.", "updated_at": "2026-10-11T02:16:37.210", "published_at": "2026-10-11T02:16:37.210", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 4.0 (custom)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-783", "what_happened": "mall4j through 4.0 contains an improper authorization vulnerability that allows authenticated storefront customers to delete other shoppers' cart items through an operator precedence error in the cleanExpiryProdList SQL statement. Attackers can send one DELETE request to /p/shopCart/cleanExpiryProdList to remove every user's cart entries for off-shelf products, which do not return when products are restocked.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/mall4j/poc_shopcart_clean_expiry_prodlist.py", "https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-api/src/main/java/com/yami/shop/api/controller/ShopCartController.java#L188-L194", "https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-service/src/main/resources/mapper/BasketMapper.xml#L49-L62", "https://www.vulncheck.com/advisories/mall4j-through-4.0-operator-precedence-error-deletes-other-users-cart-items-via-p-shopcart-cleanexpiryprodlist" ], "timeline": [ { "at": "2026-10-11T02:16:37.210", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108691" } ] }, { "id": "CVE-2026-108690", "vendor": "gz-yami", "product": "mall4j", "title": "mall4j vulnerability", "summary": "mall4j through 4.0 contains an information disclosure vulnerability that allows authenticated customers to read other shoppers' cart items due to an operator precedence error in the getShopCartExpiryItems SQL filter. Attackers with any storefront account can request GET /p/shopCart/expiryProdList to retrieve off-shelf product basket entries including product, SKU, quantity, shop, and promoter card numbers.", "updated_at": "2026-10-11T02:16:37.057", "published_at": "2026-10-11T02:16:37.057", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 4.0 (custom)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-783", "what_happened": "mall4j through 4.0 contains an information disclosure vulnerability that allows authenticated customers to read other shoppers' cart items due to an operator precedence error in the getShopCartExpiryItems SQL filter. Attackers with any storefront account can request GET /p/shopCart/expiryProdList to retrieve off-shelf product basket entries including product, SKU, quantity, shop, and promoter card numbers.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/mall4j/poc_shopcart_expiry_prodlist.py", "https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-api/src/main/java/com/yami/shop/api/controller/ShopCartController.java#L162-L186", "https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-service/src/main/resources/mapper/BasketMapper.xml#L41-L48", "https://www.vulncheck.com/advisories/mall4j-through-4.0-operator-precedence-error-exposes-other-users-cart-items-via-p-shopcart-expiryprodlist" ], "timeline": [ { "at": "2026-10-11T02:16:37.057", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108690" } ] }, { "id": "CVE-2026-108689", "vendor": "WuKongOpenSource", "product": "Wukong AICRM", "title": "Wukong AICRM vulnerability", "summary": "Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant replies built from the victim's last 20 messages, disclosing conversation content.", "updated_at": "2026-10-11T02:16:36.887", "published_at": "2026-10-11T02:16:36.887", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 20260610 (custom)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-639", "what_happened": "Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant replies built from the victim's last 20 messages, disclosing conversation content.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong-AICRM/poc_chat_send.py", "https://github.com/WuKongOpenSource/Wukong-AICRM/blob/cdd1fbc3187d2bcbf2cdf2be7d50c988959da356/backend/src/main/java/com/kakarote/ai_crm/service/impl/ChatServiceImpl.java#L270-L283", "https://www.vulncheck.com/advisories/wukong-aicrm-through-20260610-authorization-bypass-via-user-controlled-session-id-in-post-chat-send" ], "timeline": [ { "at": "2026-10-11T02:16:36.887", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108689" } ] }, { "id": "CVE-2026-108688", "vendor": "elunez", "product": "eladmin", "title": "eladmin vulnerability", "summary": "Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated users to bypass the storage:add permission. Attackers can send POST requests with image-named files to /api/localStorage/pictures to write files into server local storage and disclose absolute server paths.", "updated_at": "2026-10-11T02:16:35.100", "published_at": "2026-10-11T02:16:35.100", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.7 (custom)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated users to bypass the storage:add permission. Attackers can send POST requests with image-named files to /api/localStorage/pictures to write files into server local storage and disclose absolute server paths.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/eladmin/poc_localStorage_pictures.py", "https://github.com/elunez/eladmin/blob/39d480938d27a9630d632578c3ef60cf3647a79e/eladmin-tools/src/main/java/me/zhengjie/rest/LocalStorageController.java#L72-L82", "https://www.vulncheck.com/advisories/eladmin-through-2.7-missing-authorization-via-api-localstorage-pictures-upload" ], "timeline": [ { "at": "2026-10-11T02:16:35.100", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108688" } ] }, { "id": "CVE-2026-108604", "vendor": "TabularisDB", "product": "tabularis", "title": "tabularis vulnerability", "summary": "Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP run_query safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval, or PostgreSQL query_to_xml with embedded DELETE to modify data without approval prompts.", "updated_at": "2026-10-10T20:16:32.947", "published_at": "2026-10-10T20:16:32.947", "cvss": 5.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 0.27.0 (semver)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-863", "what_happened": "Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP run_query safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval, or PostgreSQL query_to_xml with embedded DELETE to modify data without approval prompts.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/TabularisDB/tabularis", "https://github.com/TabularisDB/tabularis/blob/804c4c3bb6fd8eaa2e36cbe49f6c0d58f373b5e9/src-tauri/src/ai_activity.rs#L357-L416", "https://github.com/TabularisDB/tabularis/blob/804c4c3bb6fd8eaa2e36cbe49f6c0d58f373b5e9/src-tauri/src/mcp/mod.rs#L1136-L1171", "https://hackmd.io/@haind/S1BofaIsMx", "https://www.vulncheck.com/advisories/tabularis-through-0.27.0-read-only-bypass-via-mcp-run-query-select-classification" ], "timeline": [ { "at": "2026-10-10T20:16:32.947", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108604" } ] }, { "id": "CVE-2026-108603", "vendor": "addsumtech", "product": "slide-maker", "title": "slide-maker vulnerability", "summary": "slide-maker through 5.8.0 contains a path traversal vulnerability in generate_images_openai.py that allows attackers to write image files outside the output directory via manifest-supplied filenames. Attackers can influence deck source material so the image prompt manifest contains ../ or symlinked filenames, creating directories and overwriting existing files at arbitrary paths.", "updated_at": "2026-10-10T20:16:32.803", "published_at": "2026-10-10T20:16:32.803", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 5.8.0 (semver)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-22", "what_happened": "slide-maker through 5.8.0 contains a path traversal vulnerability in generate_images_openai.py that allows attackers to write image files outside the output directory via manifest-supplied filenames. Attackers can influence deck source material so the image prompt manifest contains ../ or symlinked filenames, creating directories and overwriting existing files at arbitrary paths.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/addsumtech/slides_maker", "https://github.com/addsumtech/slides_maker/blob/3767cc346d63ef1646082c87f15fbf0be582b152/skills/slide-maker/scripts/generate_images_openai.py#L153-L156", "https://github.com/addsumtech/slides_maker/blob/3767cc346d63ef1646082c87f15fbf0be582b152/skills/slide-maker/scripts/generate_images_openai.py#L270-L285", "https://hackmd.io/@haind/BJnX7pIifx", "https://www.vulncheck.com/advisories/slide-maker-through-5.8.0-path-traversal-via-generate-images-openai-py" ], "timeline": [ { "at": "2026-10-10T20:16:32.803", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108603" } ] }, { "id": "CVE-2026-108602", "vendor": "Helicone", "product": "helicone", "title": "helicone vulnerability", "summary": "Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolve or DNS-rebind to loopback or internal addresses, causing blind POST requests to internal HTTPS services.", "updated_at": "2026-10-10T20:16:32.760", "published_at": "2026-10-10T20:16:32.650", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through v2025.08.21-1 (custom)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-918", "what_happened": "Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolve or DNS-rebind to loopback or internal addresses, causing blind POST requests to internal HTTPS services.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/Helicone/helicone", "https://github.com/Helicone/helicone/blob/067d9290acb4f1fc9320e902fc67b4b399b50363/valhalla/jawn/src/controllers/public/webhookController.ts#L64-L85", "https://github.com/Helicone/helicone/blob/067d9290acb4f1fc9320e902fc67b4b399b50363/valhalla/jawn/src/lib/clients/webhookSender.ts#L11-L76", "https://hackmd.io/@haind/helicone-webhook-dns-ssrf", "https://www.vulncheck.com/advisories/helicone-through-2025.08.21-1-ssrf-via-jawn-webhook-sender-dns-resolution" ], "timeline": [ { "at": "2026-10-10T20:16:32.650", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108602" } ] }, { "id": "CVE-2026-108600", "vendor": "open-multi-agent", "product": "open-multi-agent", "title": "open-multi-agent vulnerability", "summary": "open-multi-agent (@open-multi-agent/core) 1.5.0 through 1.21.2 contains a link following vulnerability in the file_write tool sandbox that allows attackers to create files outside the workspace root by using dangling symlinks. Attackers can plant a dangling symlink in the workspace and steer the agent via prompt injection to write attacker-influenced content anywhere the agent process can write.", "updated_at": "2026-10-10T19:16:58.640", "published_at": "2026-10-10T19:16:58.640", "cvss": 5.7, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "1.5.0 through 1.21.2 (semver)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-59", "what_happened": "open-multi-agent (@open-multi-agent/core) 1.5.0 through 1.21.2 contains a link following vulnerability in the file_write tool sandbox that allows attackers to create files outside the workspace root by using dangling symlinks. Attackers can plant a dangling symlink in the workspace and steer the agent via prompt injection to write attacker-influenced content anywhere the agent process can write.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/open-multi-agent/open-multi-agent", "https://github.com/open-multi-agent/open-multi-agent/blob/6ec5498643c7e431aa66751f17f47a529e7f927c/packages/core/src/tool/built-in/file-write.ts#L67", "https://github.com/open-multi-agent/open-multi-agent/blob/6ec5498643c7e431aa66751f17f47a529e7f927c/packages/core/src/tool/built-in/path-safety.ts#L104-L113", "https://hackmd.io/@haind/open-multi-agent-file-write-dangling-symlink-escape", "https://www.vulncheck.com/advisories/open-multi-agent-1.5.0-through-1.21.2-sandbox-escape-via-file-write-dangling-symlink" ], "timeline": [ { "at": "2026-10-10T19:16:58.640", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108600" } ] }, { "id": "CVE-2026-108599", "vendor": "pulseaiclub", "product": "phi", "title": "phi vulnerability", "summary": "phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that allows malicious repositories to bypass workspace_only_writes by exploiting lexical-only path checks in the permission gate. Attackers can commit symlinks pointing outside the workspace and use prompt injection to make the write tool write attacker-influenced content to external files without approval.", "updated_at": "2026-10-10T19:16:58.487", "published_at": "2026-10-10T19:16:58.487", "cvss": 5.7, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0.1.1 through 0.28.4 (semver)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-59", "what_happened": "phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that allows malicious repositories to bypass workspace_only_writes by exploiting lexical-only path checks in the permission gate. Attackers can commit symlinks pointing outside the workspace and use prompt injection to make the write tool write attacker-influenced content to external files without approval.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/pulseaiclub/phi", "https://github.com/pulseaiclub/phi/blob/5b3cb440a7c58115ef64283a737a43299f2805a4/internal/permission/gate.go#L106-L119", "https://github.com/pulseaiclub/phi/blob/5b3cb440a7c58115ef64283a737a43299f2805a4/internal/tools/writetool/write.go#L64-L68", "https://hackmd.io/@haind/phi-symlink-permission-boundary", "https://www.vulncheck.com/advisories/phi-0.1.1-through-0.28.4-symlink-workspace-write-restriction-bypass" ], "timeline": [ { "at": "2026-10-10T19:16:58.487", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108599" } ] }, { "id": "CVE-2026-108598", "vendor": "floci-io", "product": "floci", "title": "floci vulnerability", "summary": "Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM.", "updated_at": "2026-10-10T19:16:58.347", "published_at": "2026-10-10T19:16:58.347", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 80, "confidence_label": "verified", "affected": "1.1.0 through before 2.2.0 (semver)", "fixed": "See vendor advisory", "source_count": 8, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-94", "what_happened": "Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "Sidesploitx/CVE-2026-108598", "author": "Sidesploitx", "first_seen": "2026-10-15", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "Unauthenticated RCE via Velocity Template Language (VTL) injection in Floci API Gateway mapping templates (versions 1.1.0–2.2.0). CVSS 9.8 Critical.", "summary": "Unauthenticated RCE via Velocity Template Language (VTL) injection in Floci API Gateway mapping templates (versions 1.1.0–2.2.0). CVSS 9.8 Critical.", "url": "https://github.com/Sidesploitx/CVE-2026-108598" } ], "references": [ "https://github.com/floci-io/floci", "https://github.com/floci-io/floci/blob/560b3e4aae61cea3ac7d4d51843bdffd0e3085fd/src/main/java/io/github/hectorvent/floci/services/apigateway/VtlTemplateEngine.java#L74-L114", "https://github.com/floci-io/floci/commit/144b90e6fa861a5ac882e99a090d503da01945c4", "https://github.com/floci-io/floci/releases/tag/2.2.0", "https://github.com/floci-io/floci/security/advisories/GHSA-3p4c-wp7w-mgjx", "https://github.com/ghostx-86/exploitarium/tree/main/floci-apigateway-vtl-rce-poc", "https://www.vulncheck.com/advisories/floci-1.1.0-before-2.2.0-rce-via-api-gateway-vtl-mapping-templates", "https://github.com/Sidesploitx/CVE-2026-108598" ], "timeline": [ { "at": "2026-10-10T19:16:58.347", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108598" } ] }, { "id": "CVE-2026-108597", "vendor": "cohere-ai", "product": "cohere-python", "title": "cohere-python vulnerability", "summary": "Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal (tar slip) vulnerability in _s3_models_dir_to_tarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to overwrite files on the SDK host.", "updated_at": "2026-10-10T19:16:58.210", "published_at": "2026-10-10T19:16:58.210", "cvss": 5.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "5.11.0 through 7.2.0 (semver)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-22", "what_happened": "Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal (tar slip) vulnerability in _s3_models_dir_to_tarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to overwrite files on the SDK host.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/cohere-ai/cohere-python", "https://github.com/cohere-ai/cohere-python/blob/0eacfe77e1710322b355928574cfec18f6791c42/src/cohere/manually_maintained/cohere_aws/client.py#L101-L123", "https://hackmd.io/@haind/cohere-python-sagemaker-s3-archive-path-traversal", "https://www.vulncheck.com/advisories/cohere-python-sdk-5.11.0-through-7.2.0-path-traversal-via-sagemaker-tar-extraction" ], "timeline": [ { "at": "2026-10-10T19:16:58.210", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108597" } ] }, { "id": "CVE-2026-108596", "vendor": "openlit", "product": "openlit", "title": "openlit vulnerability", "summary": "OpenLIT 2.1.0 contains an authorization bypass vulnerability that allows authenticated users to read other projects' telemetry by supplying a forged x-openlit-project-id header. Attackers who know a victim project id and database config id can query the trace read API to obtain traces including LLM prompts and completions.", "updated_at": "2026-10-10T19:16:58.070", "published_at": "2026-10-10T19:16:58.070", "cvss": 6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "2.1.0 through 2.1.0 (semver)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-639", "what_happened": "OpenLIT 2.1.0 contains an authorization bypass vulnerability that allows authenticated users to read other projects' telemetry by supplying a forged x-openlit-project-id header. Attackers who know a victim project id and database config id can query the trace read API to obtain traces including LLM prompts and completions.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/openlit/openlit", "https://github.com/openlit/openlit/blob/9938c66638666ca5d3bcb850350faa82e510924b/src/client/src/lib/telemetry-source.ts#L113-L125", "https://github.com/openlit/openlit/blob/9938c66638666ca5d3bcb850350faa82e510924b/src/client/src/middleware/check-auth.ts#L22-L33", "https://hackmd.io/@haind/openlit-project-context-read", "https://www.vulncheck.com/advisories/openlit-2.1.0-authorization-bypass-via-x-openlit-project-id-header" ], "timeline": [ { "at": "2026-10-10T19:16:58.070", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108596" } ] }, { "id": "CVE-2026-108595", "vendor": "pulseaiclub", "product": "phi", "title": "phi vulnerability", "summary": "Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and readonly mode by supplying an unchecked workdir to agent_spawn. Attackers can plant prompt-injected instructions in processed content so the agent spawns a worker rooted elsewhere, causing unapproved file writes anywhere the user can write.", "updated_at": "2026-10-10T19:16:57.927", "published_at": "2026-10-10T19:16:57.927", "cvss": 6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0.3.0 through 0.28.4 (semver)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-863", "what_happened": "Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and readonly mode by supplying an unchecked workdir to agent_spawn. Attackers can plant prompt-injected instructions in processed content so the agent spawns a worker rooted elsewhere, causing unapproved file writes anywhere the user can write.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/pulseaiclub/phi", "https://github.com/pulseaiclub/phi/blob/5b3cb440a7c58115ef64283a737a43299f2805a4/internal/agent/engine_runner.go#L52-L60", "https://github.com/pulseaiclub/phi/blob/5b3cb440a7c58115ef64283a737a43299f2805a4/internal/tools/agenttool/agent.go#L106-L120", "https://hackmd.io/@haind/phi-subagent-workdir-workspace-escape", "https://www.vulncheck.com/advisories/phi-0.3.0-through-0.28.4-permission-bypass-via-agent-spawn-workdir" ], "timeline": [ { "at": "2026-10-10T19:16:57.927", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108595" } ] }, { "id": "CVE-2026-108594", "vendor": "mealie-recipes", "product": "mealie", "title": "mealie vulnerability", "summary": "Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity provider hostname. Authenticated OIDC users who control their picture URL can make the server send GET requests to arbitrary ports on the provider's internal address on each login.", "updated_at": "2026-10-10T19:16:57.880", "published_at": "2026-10-10T19:16:57.770", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "3.26.0 through 3.28.0 (semver)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-918", "what_happened": "Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity provider hostname. Authenticated OIDC users who control their picture URL can make the server send GET requests to arbitrary ports on the provider's internal address on each login.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/mealie-recipes/mealie", "https://github.com/mealie-recipes/mealie/blob/v3.28.0/mealie/core/security/providers/openid_provider.py#L170-L200", "https://github.com/mealie-recipes/mealie/blob/v3.28.0/mealie/pkgs/safehttp/transport.py#L60-L160", "https://hackmd.io/@haind/mealie-oidc-avatar-ssrf", "https://www.vulncheck.com/advisories/mealie-3.26.0-through-3.28.0-ssrf-via-oidc-picture-claim-avatar-fetch" ], "timeline": [ { "at": "2026-10-10T19:16:57.770", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108594" } ] }, { "id": "CVE-2026-108593", "vendor": "decolua", "product": "9router", "title": "9router vulnerability", "summary": "9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows authenticated dashboard users to inject arbitrary keys into the Hermes Agent config.yaml file. Attackers can submit a baseUrl containing double quotes and newlines to add hooks_auto_accept and a hooks.post_llm_call shell command, which Hermes Agent executes without approval after an LLM call.", "updated_at": "2026-10-10T19:16:57.720", "published_at": "2026-10-10T19:16:57.607", "cvss": 7.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0.4.1 through 0.5.99 (semver)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-94", "what_happened": "9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows authenticated dashboard users to inject arbitrary keys into the Hermes Agent config.yaml file. Attackers can submit a baseUrl containing double quotes and newlines to add hooks_auto_accept and a hooks.post_llm_call shell command, which Hermes Agent executes without approval after an LLM call.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/decolua/9router", "https://github.com/decolua/9router/blob/a99cf57239ff778b61e434c2786009d5ed1c412c/src/app/api/cli-tools/hermes-settings/route.js#L185-L223", "https://github.com/decolua/9router/blob/a99cf57239ff778b61e434c2786009d5ed1c412c/src/app/api/cli-tools/hermes-settings/route.js#L20-L35", "https://hackmd.io/@haind/9router-hermes-config-injection", "https://www.vulncheck.com/advisories/9router-0.4.1-through-0.5.99-config-injection-rce-via-hermes-settings-endpoint" ], "timeline": [ { "at": "2026-10-10T19:16:57.607", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108593" } ] }, { "id": "CVE-2026-108592", "vendor": "SWE-agent", "product": "mini-swe-agent", "title": "mini-swe-agent vulnerability", "summary": "mini-swe-agent 1.10.0 through 2.4.6 contains an information exposure vulnerability in BubblewrapEnvironment because bwrap omits --clearenv, so sandboxed commands inherit the host environment. Attackers using prompt injection in processed task content can make the agent read API keys from the environment and exfiltrate them over the shared network.", "updated_at": "2026-10-10T19:16:57.463", "published_at": "2026-10-10T19:16:57.463", "cvss": 6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "1.10.0 through 2.4.6 (semver)", "fixed": "See vendor advisory", "source_count": 68, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-526", "what_happened": "mini-swe-agent 1.10.0 through 2.4.6 contains an information exposure vulnerability in BubblewrapEnvironment because bwrap omits --clearenv, so sandboxed commands inherit the host environment. Attackers using prompt injection in processed task content can make the agent read API keys from the environment and exfiltrate them over the shared network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "title": "Exploit for CVE-2026-108592", "summary": "Environment-variable exposure in mini-swe-agent BubblewrapEnvironment.", "what_happened": "Environment-variable exposure in mini-swe-agent BubblewrapEnvironment.", "cvss": 6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/SC:N/VI:N/SI:N/VA:N/SA:N", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-526", "references": [ "https://sploitus.com/exploit?id=10E854B2-F7A2-5D62-B73A-AC01D115C73B", "https://github.com/asvorg/CVE-2026-108592-poc" ], "repository": "Sploitus", "author": "asvorg", "first_seen": "2026-10-10T23:45:03", "confidence": "High", "verification": "verified", "verified": true, "verification_detail": "Sploitus reports working code with at least 90% confidence.", "url": "https://sploitus.com/exploit?id=10E854B2-F7A2-5D62-B73A-AC01D115C73B" }, { "title": "Exploit for CVE-2026-108592", "summary": "Environment-variable exposure in mini-swe-agent BubblewrapEnvironment.", "what_happened": "Environment-variable exposure in mini-swe-agent BubblewrapEnvironment.", "cvss": 6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/SC:N/VI:N/SI:N/VA:N/SA:N", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-526", "references": [ "https://sploitus.com/exploit?id=10E854B2-F7A2-5D62-B73A-AC01D115C73B", "https://github.com/asvorg/CVE-2026-108592-poc" ], "repository": "asvorg/CVE-2026-108592-poc", "author": "asvorg", "first_seen": "2026-10-10T23:45:03", "confidence": "High", "verification": "verified", "verified": true, "verification_detail": "Linked by a Sploitus working-code assessment.", "url": "https://github.com/asvorg/CVE-2026-108592-poc" } ], "references": [ "https://github.com/SWE-agent/mini-swe-agent", "https://github.com/SWE-agent/mini-swe-agent/blob/v2.4.6/src/minisweagent/environments/extra/bubblewrap.py#L38-L103", "https://hackmd.io/@haind/minisweagent-bubblewrap-host-environment-leak", "https://www.vulncheck.com/advisories/mini-swe-agent-1.10.0-through-2.4.6-environment-exposure-via-bubblewrapenvironment", "https://sploitus.com/exploit?id=10E854B2-F7A2-5D62-B73A-AC01D115C73B", "https://github.com/asvorg/CVE-2026-108592-poc" ], "timeline": [ { "at": "2026-10-10T19:16:57.463", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108592" } ] }, { "id": "CVE-2026-108591", "vendor": "innocommerce", "product": "InnoShop", "title": "InnoShop vulnerability", "summary": "InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with files_create permission to read server files by abusing the AI Core MCP file_upload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to file_get_contents(), storing contents on the public media disk to expose the .env file with APP_KEY and database credentials.", "updated_at": "2026-10-10T19:16:57.320", "published_at": "2026-10-10T19:16:57.320", "cvss": 5.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0.9.2 through 0.9.2 (semver)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-73", "what_happened": "InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with files_create permission to read server files by abusing the AI Core MCP file_upload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to file_get_contents(), storing contents on the public media disk to expose the .env file with APP_KEY and database credentials.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/innocommerce/innoshop", "https://github.com/innocommerce/innoshop/blob/6af6a9744414d10d2f5aab516ed0b6c3045a2848/innopacks/aicore/src/Tools/FileUploadTool.php#L55-L89", "https://github.com/innocommerce/innoshop/blob/6af6a9744414d10d2f5aab516ed0b6c3045a2848/innopacks/restapi/src/Services/UploadService.php#L33", "https://hackmd.io/@haind/innoshop-mcp-local-file-read", "https://www.vulncheck.com/advisories/innoshop-0.9.2-local-file-disclosure-via-ai-core-mcp-file-upload-tool" ], "timeline": [ { "at": "2026-10-10T19:16:57.320", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108591" } ] }, { "id": "CVE-2026-108586", "vendor": "1mcp-app", "product": "@1mcp/agent", "title": "@1mcp/agent vulnerability", "summary": "1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticated clients to bypass OAuth tag-scope enforcement using negated advanced tag-filter expressions. Attackers holding a single-tag token can send a filter like not to list and invoke tools on backend MCP servers outside their granted scopes.", "updated_at": "2026-10-10T17:17:00.593", "published_at": "2026-10-10T17:17:00.593", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0.20.0 through 0.39.0 (semver)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-863", "what_happened": "1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticated clients to bypass OAuth tag-scope enforcement using negated advanced tag-filter expressions. Attackers holding a single-tag token can send a filter like not to list and invoke tools on backend MCP servers outside their granted scopes.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/1mcp-app/agent", "https://github.com/1mcp-app/agent/blob/v0.39.0/src/sdk/legacy/transport/http/middlewares/scopeAuthMiddleware.ts#L163-L183", "https://github.com/1mcp-app/agent/blob/v0.39.0/src/transport/http/routes/inspectHelpers.ts#L79-L102", "https://hackmd.io/@haind/1mcp-negated-tag-filter-oauth-scope-bypass", "https://www.vulncheck.com/advisories/1mcp-agent-0.20.0-through-0.39.0-oauth-tag-scope-bypass-via-negated-tag-filter" ], "timeline": [ { "at": "2026-10-10T17:17:00.593", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108586" } ] }, { "id": "CVE-2026-108585", "vendor": "argoproj-labs", "product": "argocd-mcp", "title": "argocd-mcp vulnerability", "summary": "argocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path traversal vulnerability in the delete_application tool that allows MCP clients to reach unintended API endpoints via unvalidated applicationName values. Attackers or prompt-injected models can supply dot-segment values like ../repositories/ to send authenticated DELETE requests deleting repositories, clusters, or projects within the token's RBAC permissions.", "updated_at": "2026-10-10T17:17:00.550", "published_at": "2026-10-10T17:17:00.437", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 0.9.0 (semver)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-22", "what_happened": "argocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path traversal vulnerability in the delete_application tool that allows MCP clients to reach unintended API endpoints via unvalidated applicationName values. Attackers or prompt-injected models can supply dot-segment values like ../repositories/ to send authenticated DELETE requests deleting repositories, clusters, or projects within the token's RBAC permissions.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/argoproj-labs/mcp-for-argocd", "https://github.com/argoproj-labs/mcp-for-argocd/blob/28d15ca69b0c31387cc6ec73d201fd13c5d22b6a/src/argocd/client.ts#L115-L139", "https://github.com/argoproj-labs/mcp-for-argocd/blob/28d15ca69b0c31387cc6ec73d201fd13c5d22b6a/src/argocd/http.ts#L86-L91", "https://hackmd.io/@haind/argocd-mcp-delete-application-route-smuggling", "https://www.vulncheck.com/advisories/argocd-mcp-through-0.9.0-path-traversal-via-delete-application-tool" ], "timeline": [ { "at": "2026-10-10T17:17:00.437", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108585" } ] }, { "id": "CVE-2026-108583", "vendor": "54yyyu", "product": "zotero-mcp", "title": "zotero-mcp vulnerability", "summary": "zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerability that allows attackers to reach internal services because _fetch_embedded_metadata fetches URLs without destination validation. Attackers can steer the agent via prompt injection into calling zotero_add_by_url, causing requests to loopback, private, or link-local hosts directly or via redirects, leaking citation meta-tags and error details.", "updated_at": "2026-10-10T16:16:31.667", "published_at": "2026-10-10T16:16:31.667", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0.10.0 through 0.14.1 (semver)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-918", "what_happened": "zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerability that allows attackers to reach internal services because _fetch_embedded_metadata fetches URLs without destination validation. Attackers can steer the agent via prompt injection into calling zotero_add_by_url, causing requests to loopback, private, or link-local hosts directly or via redirects, leaking citation meta-tags and error details.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/54yyyu/zotero-mcp/blob/v0.14.1/src/zotero_mcp/tools/write.py#L2035-L2089", "https://github.com/54yyyu/zotero-mcp/issues/326", "https://hackmd.io/@haind/zotero-mcp-generic-url-metadata-ssrf", "https://www.vulncheck.com/advisories/zotero-mcp-0.10.0-through-0.14.1-ssrf-via-zotero-add-by-url-tool" ], "timeline": [ { "at": "2026-10-10T16:16:31.667", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108583" } ] }, { "id": "CVE-2026-108582", "vendor": "genspark-ai", "product": "GenOffice", "title": "GenOffice vulnerability", "summary": "GenOffice through 0.11.505 contains an incorrect permissions vulnerability in its HTTP MCP server file store that allows local unprivileged users to read uploaded and generated documents. Attackers can list the world-readable genoffice-mcp-http directory under the system temporary directory to read client uploads and converted outputs, bypassing the HTTP bearer token.", "updated_at": "2026-10-10T16:16:31.520", "published_at": "2026-10-10T16:16:31.520", "cvss": 6.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 0.11.505 (semver)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-732", "what_happened": "GenOffice through 0.11.505 contains an incorrect permissions vulnerability in its HTTP MCP server file store that allows local unprivileged users to read uploaded and generated documents. Attackers can list the world-readable genoffice-mcp-http directory under the system temporary directory to read client uploads and converted outputs, bypassing the HTTP bearer token.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/genspark-ai/genoffice/blob/v0.11.505/packages/cli/src/mcp/files.ts#L70-L90", "https://github.com/genspark-ai/genoffice/releases/tag/v0.11.505", "https://hackmd.io/@haind/genoffice-http-mcp-temp-file-disclosure", "https://www.vulncheck.com/advisories/genoffice-through-0.11.505-insecure-permissions-in-http-mcp-server-file-store" ], "timeline": [ { "at": "2026-10-10T16:16:31.520", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108582" } ] }, { "id": "CVE-2026-108581", "vendor": "TencentCloud", "product": "Octop", "title": "Octop vulnerability", "summary": "TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain plaintext LLM and voice provider API keys and abuse the upstream provider accounts.", "updated_at": "2026-10-10T16:16:31.380", "published_at": "2026-10-10T16:16:31.380", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.0.2b6 (custom)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain plaintext LLM and voice provider API keys and abuse the upstream provider accounts.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/TencentCloud/Octop/blob/eb28011249c02cafd389b2d424294c6c1b9cf422/src/octop/api/routers/providers.py#L120-L208", "https://github.com/TencentCloud/Octop/pull/1265", "https://github.com/TencentCloud/Octop/pull/1507", "https://hackmd.io/@haind/octop-provider-key-cross-role-read", "https://www.vulncheck.com/advisories/octop-through-1.0-2b6-missing-authorization-exposes-provider-api-keys-via-api-providers" ], "timeline": [ { "at": "2026-10-10T16:16:31.380", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108581" } ] }, { "id": "CVE-2026-108580", "vendor": "phoenixthrush", "product": "AniWorld Downloader", "title": "AniWorld Downloader vulnerability", "summary": "AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts vulnerability in the WebUI /login POST handler that allows unauthenticated attackers to guess passwords without throttling. Attackers can enumerate usernames through verify_user response timing and brute-force passwords on exposed WebUI instances to take over accounts.", "updated_at": "2026-10-10T16:16:31.240", "published_at": "2026-10-10T16:16:31.240", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 5.3.0 (semver)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-307", "what_happened": "AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts vulnerability in the WebUI /login POST handler that allows unauthenticated attackers to guess passwords without throttling. Attackers can enumerate usernames through verify_user response timing and brute-force passwords on exposed WebUI instances to take over accounts.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/phoenixthrush/AniWorld-Downloader/blob/bb13599d17937fdb4df2df699024bc233f0656f2/src/aniworld/web/auth.py#L239-L256", "https://github.com/phoenixthrush/AniWorld-Downloader/commit/3c070bd10665377308a3092e11933681c18a5fd1", "https://github.com/phoenixthrush/AniWorld-Downloader/issues/334", "https://github.com/phoenixthrush/AniWorld-Downloader/releases/tag/v.5.3.0", "https://hackmd.io/@haind/aniworld-login-brute-force", "https://www.vulncheck.com/advisories/aniworld-downloader-before-5.3.0-webui-login-brute-force-via-login" ], "timeline": [ { "at": "2026-10-10T16:16:31.240", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108580" } ] }, { "id": "CVE-2026-108579", "vendor": "Openpanel-dev", "product": "openpanel", "title": "openpanel vulnerability", "summary": "OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by supplying crafted profile IDs to the /track endpoint. Attackers can send tracking events with profile IDs like =HYPERLINK(...) matching a cohort, so exported cohort CSVs execute formulas that exfiltrate adjacent cell data.", "updated_at": "2026-10-10T16:16:31.193", "published_at": "2026-10-10T16:16:31.080", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.3.0 (semver)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-1236", "what_happened": "OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by supplying crafted profile IDs to the /track endpoint. Attackers can send tracking events with profile IDs like =HYPERLINK(...) matching a cohort, so exported cohort CSVs execute formulas that exfiltrate adjacent cell data.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/Openpanel-dev/openpanel", "https://github.com/Openpanel-dev/openpanel/blob/7c4d22ae4b6b20fb08eb5c94a0cd3cfebb3d32ca/apps/start/src/utils/csv-download.ts#L1-L29", "https://hackmd.io/@haind/openpanel-cohort-csv-formula-injection", "https://www.vulncheck.com/advisories/openpanel-through-2.3.0-csv-formula-injection-via-cohort-member-export" ], "timeline": [ { "at": "2026-10-10T16:16:31.080", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108579" } ] }, { "id": "CVE-2026-108568", "vendor": "InstantSoft", "product": "icms2", "title": "icms2 vulnerability", "summary": "A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The affected element is the function validatePaypalOrder of the file system/controllers/billing/actions/paypal.php of the component Billing Module. Executing a manipulation of the argument bid/sig can lead to insufficient verification of data authenticity. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.", "updated_at": "2026-10-11T10:16:40.340", "published_at": "2026-10-11T10:16:40.340", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "2.18.0; 2.18.1; 2.18.2", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-345", "what_happened": "A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The affected element is the function validatePaypalOrder of the file system/controllers/billing/actions/paypal.php of the component Billing Module. Executing a manipulation of the argument bid/sig can lead to insufficient verification of data authenticity. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://vuldb.com/cve/CVE-2026-108568", "https://vuldb.com/submit/954261", "https://vuldb.com/vuln/416225", "https://vuldb.com/vuln/416225/cti" ], "timeline": [ { "at": "2026-10-11T10:16:40.340", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108568" } ] }, { "id": "CVE-2026-108567", "vendor": "InstantSoft", "product": "icms2", "title": "icms2 vulnerability", "summary": "A vulnerability was found in InstantSoft icms2 up to 2.18.2. Impacted is the function files_delete_file of the file system/fields/image.php of the component Image Handler. Performing a manipulation of the argument size results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. The patch is named 03d70937f1ff97031523222808726994b8b79379. It is recommended to apply a patch to fix this issue.", "updated_at": "2026-10-11T10:16:40.173", "published_at": "2026-10-11T10:16:40.173", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "2.18.0; 2.18.1; 2.18.2", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-22", "what_happened": "A vulnerability was found in InstantSoft icms2 up to 2.18.2. Impacted is the function files_delete_file of the file system/fields/image.php of the component Image Handler. Performing a manipulation of the argument size results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. The patch is named 03d70937f1ff97031523222808726994b8b79379. It is recommended to apply a patch to fix this issue.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/instantsoft/icms2/", "https://github.com/instantsoft/icms2/commit/03d70937f1ff97031523222808726994b8b79379", "https://vuldb.com/cve/CVE-2026-108567", "https://vuldb.com/submit/954260", "https://vuldb.com/vuln/416224", "https://vuldb.com/vuln/416224/cti" ], "timeline": [ { "at": "2026-10-11T10:16:40.173", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108567" } ] }, { "id": "CVE-2026-108566", "vendor": "InstantSoft", "product": "icms2", "title": "icms2 vulnerability", "summary": "A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/index.tpl.php of the component Private Message Handler. Such manipulation of the argument nickname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 3a1ec8fcb073a46d06a2ab83bc2bf68225834281. It is best practice to apply a patch to resolve this issue.", "updated_at": "2026-10-11T10:16:38.727", "published_at": "2026-10-11T10:16:38.727", "cvss": 2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "2.18.0; 2.18.1; 2.18.2", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/index.tpl.php of the component Private Message Handler. Such manipulation of the argument nickname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 3a1ec8fcb073a46d06a2ab83bc2bf68225834281. It is best practice to apply a patch to resolve this issue.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/instantsoft/icms2/", "https://github.com/instantsoft/icms2/commit/3a1ec8fcb073a46d06a2ab83bc2bf68225834281", "https://vuldb.com/cve/CVE-2026-108566", "https://vuldb.com/submit/954247", "https://vuldb.com/vuln/416223", "https://vuldb.com/vuln/416223/cti" ], "timeline": [ { "at": "2026-10-11T10:16:38.727", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108566" } ] }, { "id": "CVE-2026-108555", "vendor": "schlagmichdoch", "product": "PairDrop", "title": "PairDrop vulnerability", "summary": "PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other networks' discovery rooms by supplying a forged cf-connecting-ip header. Attackers who know a victim's public IP can appear as a local device on self-hosted instances not behind Cloudflare to send or receive files.", "updated_at": "2026-10-10T15:16:58.690", "published_at": "2026-10-10T15:16:58.690", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.11.2 (semver)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-348", "what_happened": "PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other networks' discovery rooms by supplying a forged cf-connecting-ip header. Attackers who know a victim's public IP can appear as a local device on self-hosted instances not behind Cloudflare to send or receive files.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/schlagmichdoch/PairDrop", "https://github.com/schlagmichdoch/PairDrop/blob/4862ba3067be1a0f2e0d1e94861dc9200b5bfeea/server/peer.js#L44-L54", "https://github.com/schlagmichdoch/PairDrop/blob/4862ba3067be1a0f2e0d1e94861dc9200b5bfeea/server/ws-server.js#L312-L314", "https://github.com/schlagmichdoch/PairDrop/issues/510", "https://www.vulncheck.com/advisories/pairdrop-through-1.11.2-ip-spoofing-via-cf-connecting-ip-header" ], "timeline": [ { "at": "2026-10-10T15:16:58.690", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108555" } ] }, { "id": "CVE-2026-108554", "vendor": "PDFMathTranslate", "product": "PDFMathTranslate", "title": "PDFMathTranslate vulnerability", "summary": "PDFMathTranslate (pdf2zh) through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translate_file handler passes user URLs to download_with_limit without scheme or address validation, letting attackers reach internal services and cloud metadata endpoints and retrieve returned PDFs.", "updated_at": "2026-10-10T15:16:58.547", "published_at": "2026-10-10T15:16:58.547", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.9.11 (semver)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-918", "what_happened": "PDFMathTranslate (pdf2zh) through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translate_file handler passes user URLs to download_with_limit without scheme or address validation, letting attackers reach internal services and cloud metadata endpoints and retrieve returned PDFs.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/PDFMathTranslate/PDFMathTranslate", "https://github.com/PDFMathTranslate/PDFMathTranslate/blob/0f0618d3303d064d97e7adb77557b21236c6cee0/pdf2zh/gui.py#L149-L179", "https://github.com/PDFMathTranslate/PDFMathTranslate/blob/0f0618d3303d064d97e7adb77557b21236c6cee0/pdf2zh/gui.py#L257-L269", "https://github.com/PDFMathTranslate/PDFMathTranslate/issues/1188", "https://www.vulncheck.com/advisories/pdfmathtranslate-through-1.9.11-ssrf-via-gradio-web-gui-link-input" ], "timeline": [ { "at": "2026-10-10T15:16:58.547", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108554" } ] }, { "id": "CVE-2026-108553", "vendor": "OpenRefine", "product": "OpenRefine", "title": "OpenRefine vulnerability", "summary": "OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating system commands as the OpenRefine user.", "updated_at": "2026-10-10T15:16:58.410", "published_at": "2026-10-10T15:16:58.410", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 3.10.1 (semver)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-352", "what_happened": "OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating system commands as the OpenRefine user.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/OpenRefine/OpenRefine", "https://github.com/OpenRefine/OpenRefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/extensions/jython/src/com/google/refine/jython/JythonEvaluable.java#L142", "https://github.com/OpenRefine/OpenRefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/main/src/com/google/refine/commands/row/GetRowsCommand.java#L174-L186", "https://github.com/OpenRefine/OpenRefine/blob/bde8a36dc188f7846aeafc2910969e7d0fbc8e7c/modules/core/src/main/java/com/google/refine/browsing/facets/ListFacet.java#L327-L339", "https://github.com/OpenRefine/OpenRefine/issues/7999", "https://www.vulncheck.com/advisories/openrefine-through-3.10.1-csrf-to-rce-via-get-rows-command" ], "timeline": [ { "at": "2026-10-10T15:16:58.410", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108553" } ] }, { "id": "CVE-2026-108551", "vendor": "ferdikoomen", "product": "openapi-typescript-codegen", "title": "openapi-typescript-codegen vulnerability", "summary": "openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter names, servers[0].url, or info.version to execute arbitrary JavaScript when generated clients are imported or service methods called.", "updated_at": "2026-10-10T15:16:58.273", "published_at": "2026-10-10T15:16:58.273", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 0.31.0 (semver)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-94", "what_happened": "openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter names, servers[0].url, or info.version to execute arbitrary JavaScript when generated clients are imported or service methods called.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/ferdikoomen/openapi-typescript-codegen", "https://github.com/ferdikoomen/openapi-typescript-codegen/blob/v0.31.0/src/templates/core/OpenAPI.hbs#L20-L23", "https://github.com/ferdikoomen/openapi-typescript-codegen/blob/v0.31.0/src/templates/exportService.hbs#L89-L110", "https://github.com/ferdikoomen/openapi-typescript-codegen/issues/2809", "https://www.vulncheck.com/advisories/openapi-typescript-codegen-through-0.31.0-code-injection-via-handlebars-templates" ], "timeline": [ { "at": "2026-10-10T15:16:58.273", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108551" } ] }, { "id": "CVE-2026-108550", "vendor": "iflytek", "product": "skillhub", "title": "skillhub vulnerability", "summary": "SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim's API tokens, roles and namespace ownership.", "updated_at": "2026-10-10T15:16:58.133", "published_at": "2026-10-10T15:16:58.133", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 0.2.22 (semver)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-863", "what_happened": "SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim's API tokens, roles and namespace ownership.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/iflytek/skillhub", "https://github.com/iflytek/skillhub/blob/v0.2.21/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/merge/AccountMergeService.java#L95-L109", "https://github.com/iflytek/skillhub/commit/45228996c7dd67f9304dba5b221fef15138a7fc4", "https://github.com/iflytek/skillhub/issues/921", "https://github.com/iflytek/skillhub/releases/tag/v0.2.22", "https://www.vulncheck.com/advisories/skillhub-before-0.2.22-account-takeover-via-account-merge-flow" ], "timeline": [ { "at": "2026-10-10T15:16:58.133", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108550" } ] }, { "id": "CVE-2026-108549", "vendor": "chenhg5", "product": "cc-connect", "title": "cc-connect vulnerability", "summary": "cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an allowed or admin user_id to run privileged commands like /shell on the host.", "updated_at": "2026-10-10T15:16:58.087", "published_at": "2026-10-10T15:16:57.973", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.5.0 (semver)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-306", "what_happened": "cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an allowed or admin user_id to run privileged commands like /shell on the host.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/chenhg5/cc-connect", "https://github.com/chenhg5/cc-connect/blob/v1.5.0/platform/max/max.go#L287-L305", "https://github.com/chenhg5/cc-connect/issues/1968", "https://www.vulncheck.com/advisories/cc-connect-through-1.5.0-missing-authentication-via-max-webhook-sender-spoofing" ], "timeline": [ { "at": "2026-10-10T15:16:57.973", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108549" } ] }, { "id": "CVE-2026-108548", "vendor": "iflytek", "product": "astron-rpa", "title": "astron-rpa vulnerability", "summary": "AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof X-User-Id or user_id headers to act as any user.", "updated_at": "2026-10-10T15:16:57.843", "published_at": "2026-10-10T15:16:57.843", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.1.6 (semver)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-287", "what_happened": "AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof X-User-Id or user_id headers to act as any user.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/iflytek/astron-rpa", "https://github.com/iflytek/astron-rpa/blob/v1.1.6/backend/ai-service/app/dependencies/__init__.py#L10-L24", "https://github.com/iflytek/astron-rpa/blob/v1.1.6/docker/volumes/nginx/lua/auth_handler.lua#L21-L35", "https://github.com/iflytek/astron-rpa/issues/886", "https://www.vulncheck.com/advisories/astronrpa-through-1.1.6-authentication-bypass-via-arbitrary-bearer-token" ], "timeline": [ { "at": "2026-10-10T15:16:57.843", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108548" } ] }, { "id": "CVE-2026-108547", "vendor": "iflytek", "product": "astron-rpa", "title": "astron-rpa vulnerability", "summary": "AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint. Attackers can enumerate sequential shared variable IDs and decrypt all-users variables re-encrypted with their own tenant key to recover other tenants' credentials in plaintext.", "updated_at": "2026-10-10T15:16:57.707", "published_at": "2026-10-10T15:16:57.707", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.1.6 (semver)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-639", "what_happened": "AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint. Attackers can enumerate sequential shared variable IDs and decrypt all-users variables re-encrypted with their own tenant key to recover other tenants' credentials in plaintext.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/iflytek/astron-rpa", "https://github.com/iflytek/astron-rpa/blob/v1.1.6/backend/robot-service/src/main/java/com/iflytek/rpa/robot/dao/SharedVarDao.xml#L52-L63", "https://github.com/iflytek/astron-rpa/blob/v1.1.6/backend/robot-service/src/main/java/com/iflytek/rpa/robot/service/impl/SharedVarServiceImpl.java#L197-L255", "https://github.com/iflytek/astron-rpa/issues/884", "https://www.vulncheck.com/advisories/astronrpa-through-1.1.6-cross-tenant-shared-variable-disclosure-via-get-batch-shared-var" ], "timeline": [ { "at": "2026-10-10T15:16:57.707", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108547" } ] }, { "id": "CVE-2026-108546", "vendor": "spotweb", "product": "spotweb", "title": "spotweb vulnerability", "summary": "Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are substituted unescaped for $SPOTTITLE and passed to exec() when a user downloads the spot, running commands as the Spotweb PHP process.", "updated_at": "2026-10-10T15:16:57.573", "published_at": "2026-10-10T15:16:57.573", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.5.8 (semver)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-78", "what_happened": "Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are substituted unescaped for $SPOTTITLE and passed to exec() when a user downloads the spot, running commands as the Spotweb PHP process.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/spotweb/spotweb", "https://github.com/spotweb/spotweb/blob/1.5.8/lib/services/NzbHandler/Services_NzbHandler_Runcommand.php#L41-L45", "https://hackmd.io/@haind/spotweb-runcommand-title-injection", "https://www.vulncheck.com/advisories/spotweb-through-1.5.8-os-command-injection-via-spot-title-in-runcommand-integration" ], "timeline": [ { "at": "2026-10-10T15:16:57.573", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108546" } ] }, { "id": "CVE-2026-108545", "vendor": "SillyTavern", "product": "SillyTavern", "title": "SillyTavern vulnerability", "summary": "SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources because body-parser middleware runs before authentication and whitelist checks. Attackers can send large or compressed JSON or urlencoded bodies up to 500 MB, optionally in parallel, to exhaust memory and CPU and deny service.", "updated_at": "2026-10-10T15:16:57.530", "published_at": "2026-10-10T15:16:57.413", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "1.12.13 through 1.19.0 (semver)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-400", "what_happened": "SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources because body-parser middleware runs before authentication and whitelist checks. Attackers can send large or compressed JSON or urlencoded bodies up to 500 MB, optionally in parallel, to exhaust memory and CPU and deny service.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/SillyTavern/SillyTavern", "https://github.com/SillyTavern/SillyTavern/blob/1.19.0/src/server-main.js#L110-L150", "https://hackmd.io/@haind/sillytavern-preauth-body-parser-dos", "https://www.vulncheck.com/advisories/sillytavern-1.12.13-through-1.19.0-pre-authentication-denial-of-service-via-body-parsing" ], "timeline": [ { "at": "2026-10-10T15:16:57.413", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108545" } ] }, { "id": "CVE-2026-108544", "vendor": "Lippu", "product": "Docx Reader Office Viewer App", "title": "Docx Reader Office Viewer App vulnerability", "summary": "A vulnerability was identified in Lippu Docx Reader Office Viewer App up to 1.4.5 on Android. This affects the function word.office.docxviewer.document.docx.reader.ViewTxt. Such manipulation of the argument _display_name leads to path traversal. The attack may be performed from remote.", "updated_at": "2026-10-11T08:16:33.913", "published_at": "2026-10-11T08:16:33.913", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "1.4.0; 1.4.1; 1.4.2; 1.4.3; 1.4.4; 1.4.5", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-22", "what_happened": "A vulnerability was identified in Lippu Docx Reader Office Viewer App up to 1.4.5 on Android. This affects the function word.office.docxviewer.document.docx.reader.ViewTxt. Such manipulation of the argument _display_name leads to path traversal. The attack may be performed from remote.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/Secsys-FDU/AF_CVEs/issues/31", "https://vuldb.com/cve/CVE-2026-108544", "https://vuldb.com/submit/954042", "https://vuldb.com/vuln/416199", "https://vuldb.com/vuln/416199/cti" ], "timeline": [ { "at": "2026-10-11T08:16:33.913", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108544" } ] }, { "id": "CVE-2026-108543", "vendor": "ag2ai", "product": "ag2", "title": "ag2 vulnerability", "summary": "A vulnerability was determined in ag2ai ag2 up to 0.13.4. Affected by this issue is the function os.path.join of the component UserProxyAgent. This manipulation of the argument filename causes path traversal. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.", "updated_at": "2026-10-11T08:16:33.723", "published_at": "2026-10-11T08:16:33.723", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0.13.0; 0.13.1; 0.13.2; 0.13.3; 0.13.4", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-22", "what_happened": "A vulnerability was determined in ag2ai ag2 up to 0.13.4. Affected by this issue is the function os.path.join of the component UserProxyAgent. This manipulation of the argument filename causes path traversal. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/Ruoyyy/My_vulnerable/blob/main/report_legacy_filename_dockerenv_en.md", "https://vuldb.com/cve/CVE-2026-108543", "https://vuldb.com/submit/953877", "https://vuldb.com/vuln/416198", "https://vuldb.com/vuln/416198/cti" ], "timeline": [ { "at": "2026-10-11T08:16:33.723", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108543" } ] }, { "id": "CVE-2026-108542", "vendor": "021is", "product": "elvix-sdk", "title": "elvix-sdk vulnerability", "summary": "A vulnerability was found in 021is elvix-sdk up to 0.10.1. Affected by this vulnerability is an unknown functionality of the file src/mcp/index.ts of the component MCP Request Handler. The manipulation of the argument path results in server-side request forgery. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.", "updated_at": "2026-10-11T08:16:33.540", "published_at": "2026-10-11T08:16:33.540", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0.10.0; 0.10.1", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-918", "what_happened": "A vulnerability was found in 021is elvix-sdk up to 0.10.1. Affected by this vulnerability is an unknown functionality of the file src/mcp/index.ts of the component MCP Request Handler. The manipulation of the argument path results in server-side request forgery. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/Xh1Xxhg/public_exp/issues/4", "https://vuldb.com/cve/CVE-2026-108542", "https://vuldb.com/submit/949255", "https://vuldb.com/vuln/416197", "https://vuldb.com/vuln/416197/cti" ], "timeline": [ { "at": "2026-10-11T08:16:33.540", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108542" } ] }, { "id": "CVE-2026-108541", "vendor": "highwarden", "product": "Super Store Finder", "title": "Super Store Finder vulnerability", "summary": "A vulnerability has been found in highwarden Super Store Finder up to 3.8. Affected is an unknown function of the file /products/superstorefinder/index.php. The manipulation of the argument lat/lng leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 3.9 is able to address this issue. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.", "updated_at": "2026-10-11T07:17:23.700", "published_at": "2026-10-11T07:17:23.700", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "3.0; 3.1; 3.2; 3.3; 3.4; 3.5; 3.6; 3.7; 3.8", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-74", "what_happened": "A vulnerability has been found in highwarden Super Store Finder up to 3.8. Affected is an unknown function of the file /products/superstorefinder/index.php. The manipulation of the argument lat/lng leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 3.9 is able to address this issue. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://codecanyon.net/item/super-store-finder/3630922", "https://vuldb.com/cve/CVE-2026-108541", "https://vuldb.com/submit/948351", "https://vuldb.com/vuln/416196", "https://vuldb.com/vuln/416196/cti" ], "timeline": [ { "at": "2026-10-11T07:17:23.700", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108541" } ] }, { "id": "CVE-2026-108540", "vendor": "OpenSpug", "product": "Spug", "title": "Spug vulnerability", "summary": "A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", "updated_at": "2026-10-11T07:17:23.643", "published_at": "2026-10-11T07:17:23.303", "cvss": 8.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "3.0; 3.1; 3.2; 3.3; 3.4.0; 4.0.0; 4.0.1", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-77", "what_happened": "A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/SECWG/CVE/issues/10", "https://vuldb.com/cve/CVE-2026-108540", "https://vuldb.com/submit/948328", "https://vuldb.com/vuln/416195", "https://vuldb.com/vuln/416195/cti" ], "timeline": [ { "at": "2026-10-11T07:17:23.303", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108540" } ] }, { "id": "CVE-2026-108539", "vendor": "n/a", "product": "GPAC", "title": "GPAC vulnerability", "summary": "A vulnerability was detected in GPAC up to 26.07.0. This affects the function gf_fq_pop of the file filter_core/filter_queue.c of the component MP4Box. Performing a manipulation results in use after free. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", "updated_at": "2026-10-11T05:16:53.827", "published_at": "2026-10-11T05:16:53.680", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "26.07", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-119", "what_happened": "A vulnerability was detected in GPAC up to 26.07.0. This affects the function gf_fq_pop of the file filter_core/filter_queue.c of the component MP4Box. Performing a manipulation results in use after free. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/user-attachments/files/31288202/PoC.zip", "https://vuldb.com/cve/CVE-2026-108539", "https://vuldb.com/submit/941995", "https://vuldb.com/vuln/416194", "https://vuldb.com/vuln/416194/cti" ], "timeline": [ { "at": "2026-10-11T05:16:53.680", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108539" } ] }, { "id": "CVE-2026-108538", "vendor": "n/a", "product": "GPAC", "title": "GPAC vulnerability", "summary": "A security vulnerability has been detected in GPAC up to 26.07.0. The impacted element is the function gf_mx_v of the file utils/os_thread.c of the component MP4Box. Such manipulation leads to use after free. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", "updated_at": "2026-10-11T05:16:53.620", "published_at": "2026-10-11T05:16:53.477", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "26.07", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-119", "what_happened": "A security vulnerability has been detected in GPAC up to 26.07.0. The impacted element is the function gf_mx_v of the file utils/os_thread.c of the component MP4Box. Such manipulation leads to use after free. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/user-attachments/files/31270809/PoC.zip", "https://vuldb.com/cve/CVE-2026-108538", "https://vuldb.com/submit/941979", "https://vuldb.com/vuln/416193", "https://vuldb.com/vuln/416193/cti" ], "timeline": [ { "at": "2026-10-11T05:16:53.477", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108538" } ] }, { "id": "CVE-2026-108523", "vendor": "Studio-Saelix", "product": "Sencho", "title": "Sencho vulnerability", "summary": "A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown code of the file outboundTarget.ts of the component git-sources Browse API Endpoint. Executing a manipulation of the argument repo_url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The presence of this vulnerability remains uncertain at this time. This patch is called 79b86ddcd4aefdd6941f098e35990ab397b13c72. It is advisable to implement a patch to correct this issue. The vendor explains: \"Git repository access is an intentional, privileged administrative function. Sencho explicitly supports repositories hosted on private LAN, VPC, VPN, CGNAT, and IPv6 ULA networks. The report does not demonstrate a privilege-boundary bypass or access by an unprivileged user. We therefore dispute the CVE characterization of this behavior. As defense in depth, we have nevertheless hardened repository access. Git HTTPS and SSH connections now validate and pin DNS resolution, reject loopback, link-local, multicast, selected special-use and metadata targets, disable redirects and inherited proxy routing, and retain strict SSH host-key verification.\"", "updated_at": "2026-10-11T05:16:52.630", "published_at": "2026-10-11T05:16:52.630", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0.94.0; 0.94.1", "fixed": "See vendor advisory", "source_count": 8, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-918", "what_happened": "A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown code of the file outboundTarget.ts of the component git-sources Browse API Endpoint. Executing a manipulation of the argument repo_url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The presence of this vulnerability remains uncertain at this time. This patch is called 79b86ddcd4aefdd6941f098e35990ab397b13c72. It is advisable to implement a patch to correct this issue. The vendor explains: \"Git repository access is an intentional, privileged administrative function. Sencho explicitly supports repositories hosted on private LAN, VPC, VPN, CGNAT, and IPv6 ULA networks. The report does not demonstrate a privilege-boundary bypass or access by an unprivileged user. We therefore dispute the CVE characterization of this behavior. As defense in depth, we have nevertheless hardened repository access. Git HTTPS and SSH connections now validate and pin DNS resolution, reject loopback, link-local, multicast, selected special-use and metadata targets, disable redirects and inherited proxy routing, and retain strict SSH host-key verification.\"", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://gist.github.com/jovair1994/93446c14d30a16313e830490d71bbd1d", "https://github.com/Studio-Saelix/sencho/", "https://github.com/Studio-Saelix/sencho/commit/79b86ddcd4aefdd6941f098e35990ab397b13c72", "https://github.com/Studio-Saelix/sencho/pull/1877", "https://vuldb.com/cve/CVE-2026-108523", "https://vuldb.com/submit/893367", "https://vuldb.com/vuln/416189", "https://vuldb.com/vuln/416189/cti" ], "timeline": [ { "at": "2026-10-11T05:16:52.630", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108523" } ] }, { "id": "CVE-2026-108522", "vendor": "Studio-Saelix", "product": "Sencho", "title": "Sencho vulnerability", "summary": "A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component Login Endpoint. Performing a manipulation of the argument X-Forwarded-For results in improper authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The patch is named 79b86ddcd4aefdd6941f098e35990ab397b13c72. To fix this issue, it is recommended to deploy a patch. The vendor confirms: \"The login limiter relied on client-supplied X-Forwarded-For data without an explicit trusted-proxy boundary, allowing an attacker to rotate the apparent client address. The remediation now ignores forwarding headers by default, accepts them only from explicitly configured proxy CIDRs, and adds a separate failed-attempt limit keyed by normalized account identity.\"", "updated_at": "2026-10-11T04:17:31.737", "published_at": "2026-10-11T04:17:31.737", "cvss": 5.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0.94.0; 0.94.1", "fixed": "See vendor advisory", "source_count": 8, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-287", "what_happened": "A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component Login Endpoint. Performing a manipulation of the argument X-Forwarded-For results in improper authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The patch is named 79b86ddcd4aefdd6941f098e35990ab397b13c72. To fix this issue, it is recommended to deploy a patch. The vendor confirms: \"The login limiter relied on client-supplied X-Forwarded-For data without an explicit trusted-proxy boundary, allowing an attacker to rotate the apparent client address. The remediation now ignores forwarding headers by default, accepts them only from explicitly configured proxy CIDRs, and adds a separate failed-attempt limit keyed by normalized account identity.\"", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://gist.github.com/jovair1994/839c8aaca1f37567cdd02e107a389f6a", "https://github.com/Studio-Saelix/sencho/", "https://github.com/Studio-Saelix/sencho/commit/79b86ddcd4aefdd6941f098e35990ab397b13c72", "https://github.com/Studio-Saelix/sencho/pull/1877", "https://vuldb.com/cve/CVE-2026-108522", "https://vuldb.com/submit/893366", "https://vuldb.com/vuln/416188", "https://vuldb.com/vuln/416188/cti" ], "timeline": [ { "at": "2026-10-11T04:17:31.737", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108522" } ] }, { "id": "CVE-2026-108521", "vendor": "Studio-Saelix", "product": "Sencho", "title": "Sencho vulnerability", "summary": "A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: \"The node API URL could be configured by an authenticated user with node-management permission and used to initiate server-side requests. [T]he report demonstrates server-side request capability but not arbitrary internal response exfiltration.\"", "updated_at": "2026-10-11T03:16:39.350", "published_at": "2026-10-11T03:16:39.350", "cvss": 2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0.97.0; 0.97.1", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-918", "what_happened": "A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: \"The node API URL could be configured by an authenticated user with node-management permission and used to initiate server-side requests. [T]he report demonstrates server-side request capability but not arbitrary internal response exfiltration.\"", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://gist.github.com/jovair1994/db23594d74428d38606e8000beb867d4", "https://vuldb.com/cve/CVE-2026-108521", "https://vuldb.com/submit/893356", "https://vuldb.com/vuln/416187", "https://vuldb.com/vuln/416187/cti" ], "timeline": [ { "at": "2026-10-11T03:16:39.350", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108521" } ] }, { "id": "CVE-2026-108515", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Exploit for drupal-11.4.9-vuln-lab CVE-2026-108097 CVE-2026-108514 CVE-2026-108515", "summary": "Drupal 11.4.9 vulnerabilities include RCE in field_ui and Stored XSS in link and navigation.", "updated_at": "2026-10-20T05:18:12Z", "published_at": "2026-10-20T05:18:12Z", "cvss": 0, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Drupal 11.4.9 vulnerabilities include RCE in field_ui and Stored XSS in link and navigation.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for drupal-11.4.9-vuln-lab CVE-2026-108097 CVE-2026-108514 CVE-2026-108515", "summary": "Drupal 11.4.9 vulnerabilities include RCE in field_ui and Stored XSS in link and navigation.", "what_happened": "Drupal 11.4.9 vulnerabilities include RCE in field_ui and Stored XSS in link and navigation.", "cvss": 0, "cvss_vector": "NONE", "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=0E7DC195-78D7-52CE-A33C-2FF2320F1405", "https://github.com/0xABCD01/drupal-11.4.9-vuln-lab" ], "repository": "Sploitus", "author": "0xABCD01", "first_seen": "2026-10-20T07:18:12", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=0E7DC195-78D7-52CE-A33C-2FF2320F1405" }, { "title": "Exploit for drupal-11.4.9-vuln-lab CVE-2026-108097 CVE-2026-108514 CVE-2026-108515", "summary": "Drupal 11.4.9 vulnerabilities include RCE in field_ui and Stored XSS in link and navigation.", "what_happened": "Drupal 11.4.9 vulnerabilities include RCE in field_ui and Stored XSS in link and navigation.", "cvss": 0, "cvss_vector": "NONE", "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=0E7DC195-78D7-52CE-A33C-2FF2320F1405", "https://github.com/0xABCD01/drupal-11.4.9-vuln-lab" ], "repository": "0xABCD01/drupal-11.4.9-vuln-lab", "author": "0xABCD01", "first_seen": "2026-10-20T07:18:12", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://github.com/0xABCD01/drupal-11.4.9-vuln-lab" } ], "references": [ "https://sploitus.com/exploit?id=0E7DC195-78D7-52CE-A33C-2FF2320F1405", "https://github.com/0xABCD01/drupal-11.4.9-vuln-lab" ], "timeline": [ { "at": "2026-10-20T05:18:12Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=0E7DC195-78D7-52CE-A33C-2FF2320F1405" } ] }, { "id": "CVE-2026-108514", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Exploit for drupal-11.4.9-vuln-lab CVE-2026-108097 CVE-2026-108514 CVE-2026-108515", "summary": "Drupal 11.4.9 vulnerabilities include RCE in field_ui and Stored XSS in link and navigation.", "updated_at": "2026-10-20T05:18:12Z", "published_at": "2026-10-20T05:18:12Z", "cvss": 0, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Drupal 11.4.9 vulnerabilities include RCE in field_ui and Stored XSS in link and navigation.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for drupal-11.4.9-vuln-lab CVE-2026-108097 CVE-2026-108514 CVE-2026-108515", "summary": "Drupal 11.4.9 vulnerabilities include RCE in field_ui and Stored XSS in link and navigation.", "what_happened": "Drupal 11.4.9 vulnerabilities include RCE in field_ui and Stored XSS in link and navigation.", "cvss": 0, "cvss_vector": "NONE", "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=0E7DC195-78D7-52CE-A33C-2FF2320F1405", "https://github.com/0xABCD01/drupal-11.4.9-vuln-lab" ], "repository": "Sploitus", "author": "0xABCD01", "first_seen": "2026-10-20T07:18:12", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=0E7DC195-78D7-52CE-A33C-2FF2320F1405" }, { "title": "Exploit for drupal-11.4.9-vuln-lab CVE-2026-108097 CVE-2026-108514 CVE-2026-108515", "summary": "Drupal 11.4.9 vulnerabilities include RCE in field_ui and Stored XSS in link and navigation.", "what_happened": "Drupal 11.4.9 vulnerabilities include RCE in field_ui and Stored XSS in link and navigation.", "cvss": 0, "cvss_vector": "NONE", "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=0E7DC195-78D7-52CE-A33C-2FF2320F1405", "https://github.com/0xABCD01/drupal-11.4.9-vuln-lab" ], "repository": "0xABCD01/drupal-11.4.9-vuln-lab", "author": "0xABCD01", "first_seen": "2026-10-20T07:18:12", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://github.com/0xABCD01/drupal-11.4.9-vuln-lab" } ], "references": [ "https://sploitus.com/exploit?id=0E7DC195-78D7-52CE-A33C-2FF2320F1405", "https://github.com/0xABCD01/drupal-11.4.9-vuln-lab" ], "timeline": [ { "at": "2026-10-20T05:18:12Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=0E7DC195-78D7-52CE-A33C-2FF2320F1405" } ] }, { "id": "CVE-2026-108506", "vendor": "ZTE", "product": "Z80 Ultra", "title": "Z80 Ultra vulnerability", "summary": "ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control. Third-party apps may call the interfaces through reflection and retrieve relevant information.", "updated_at": "2026-10-10T10:16:44.087", "published_at": "2026-10-10T10:16:44.087", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "GEN_ZTE_PQ85A01V1.0.0B27 and prior released versions", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-269", "what_happened": "ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control. Third-party apps may call the interfaces through reflection and retrieve relevant information.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/7927166620923281253" ], "timeline": [ { "at": "2026-10-10T10:16:44.087", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108506" } ] }, { "id": "CVE-2026-108505", "vendor": "ZTE", "product": "Z80 Ultra", "title": "Z80 Ultra vulnerability", "summary": "ZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture data returned by system interfaces to obtain device-related information.", "updated_at": "2026-10-10T09:16:39.070", "published_at": "2026-10-10T09:16:39.070", "cvss": 3.3, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "GEN_ZTE_PQ85A01V1.0.0B27 and prior released versions", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-269", "what_happened": "ZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture data returned by system interfaces to obtain device-related information.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/460174866982103317" ], "timeline": [ { "at": "2026-10-10T09:16:39.070", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108505" } ] }, { "id": "CVE-2026-108504", "vendor": "ZTE", "product": "Z80 Ultra", "title": "Z80 Ultra vulnerability", "summary": "ZTE Z80 Ultra has an unauthorized information disclosure vulnerability. The access control for methods within the framework is insufficient. An attacker can exploit this method to read device-related information.", "updated_at": "2026-10-10T08:17:04.510", "published_at": "2026-10-10T08:17:04.510", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "GEN_ZTE_PQ85A01V1.0.0B27 and prior released versions", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-269", "what_happened": "ZTE Z80 Ultra has an unauthorized information disclosure vulnerability. The access control for methods within the framework is insufficient. An attacker can exploit this method to read device-related information.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/7927166620923281234" ], "timeline": [ { "at": "2026-10-10T08:17:04.510", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108504" } ] }, { "id": "CVE-2026-108471", "vendor": "Microsoft", "product": "Windows 10 Version 1809", "title": "Windows 10 Version 1809 vulnerability", "summary": "Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.", "updated_at": "2026-10-16T04:18:26.340", "published_at": "2026-10-13T19:18:07.377", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "10.0.17763.0 through before 10.0.17763.9376 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "what_happened": "Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108471" ], "timeline": [ { "at": "2026-10-13T19:18:07.377", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108471" } ] }, { "id": "CVE-2026-108463", "vendor": "Microsoft", "product": "Windows 11 Version 24H2", "title": "Windows 11 Version 24H2 vulnerability", "summary": "Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network.", "updated_at": "2026-10-16T04:18:24.730", "published_at": "2026-10-13T19:18:06.310", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "10.0.26100.0 through before 10.0.26100.9711 (custom); 10.0.26200.0 through before 10.0.26200.9711 (custom); 10.0.28000.0 through before 10.0.28000.3231 (custom); 10.0.26300.0 through before 10.0.26300.9711 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-41", "what_happened": "Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108463" ], "timeline": [ { "at": "2026-10-13T19:18:06.310", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108463" } ] }, { "id": "CVE-2026-108452", "vendor": "Microsoft", "product": "Microsoft SharePoint Server Subscription Edition", "title": "Microsoft SharePoint Server Subscription Edition vulnerability", "summary": "Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.", "updated_at": "2026-10-17T04:16:51.350", "published_at": "2026-10-15T21:17:10.907", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "16.0.0 through before 16.0.20326.20190 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-22", "what_happened": "Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108452" ], "timeline": [ { "at": "2026-10-15T21:17:10.907", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108452" } ] }, { "id": "CVE-2026-108451", "vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "title": "Microsoft 365 Apps for Enterprise vulnerability", "summary": "Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "updated_at": "2026-10-17T04:16:51.220", "published_at": "2026-10-15T21:17:10.790", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "16.0.1 through before https://aka.ms/OfficeSecurityReleases (custom); 16.0.1 through before 16.0.14334.20974 (custom); 16.0.0 through before 16.0.17932.21056 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-122", "what_happened": "Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108451" ], "timeline": [ { "at": "2026-10-15T21:17:10.790", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108451" } ] }, { "id": "CVE-2026-108450", "vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "title": "Microsoft 365 Apps for Enterprise vulnerability", "summary": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "updated_at": "2026-10-17T04:16:51.097", "published_at": "2026-10-15T21:17:10.673", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "16.0.1 through before https://aka.ms/OfficeSecurityReleases (custom); 16.0.1 through before 16.0.14334.20974 (custom); 16.0.0 through before 16.0.17932.21056 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-122", "what_happened": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108450" ], "timeline": [ { "at": "2026-10-15T21:17:10.673", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108450" } ] }, { "id": "CVE-2026-108449", "vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "title": "Microsoft 365 Apps for Enterprise vulnerability", "summary": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "updated_at": "2026-10-17T04:16:50.973", "published_at": "2026-10-15T21:17:10.553", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "16.0.1 through before https://aka.ms/OfficeSecurityReleases (custom); 1.0.0 through before 16.114.26101123 (custom); 16.0.1 through before 16.0.14334.20974 (custom); 16.0.0 through before 16.0.17932.21056 (custom); 16.0.1 through before 16.114.26101123 (custom); 16.0.0 through before 16.114.26101123 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-122", "what_happened": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108449" ], "timeline": [ { "at": "2026-10-15T21:17:10.553", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108449" } ] }, { "id": "CVE-2026-108448", "vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "title": "Microsoft 365 Apps for Enterprise vulnerability", "summary": "Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.", "updated_at": "2026-10-17T04:16:50.850", "published_at": "2026-10-15T21:17:10.440", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "16.0.1 through before https://aka.ms/OfficeSecurityReleases (custom); 1.0.0 through before 16.114.26101123 (custom); 16.0.1 through before 16.0.14334.20974 (custom); 16.0.0 through before 16.0.17932.21056 (custom); 16.0.1 through before 16.114.26101123 (custom); 16.0.0 through before 16.114.26101123 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-122", "what_happened": "Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108448" ], "timeline": [ { "at": "2026-10-15T21:17:10.440", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108448" } ] }, { "id": "CVE-2026-108447", "vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "title": "Microsoft 365 Apps for Enterprise vulnerability", "summary": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "updated_at": "2026-10-17T04:16:50.723", "published_at": "2026-10-15T21:17:10.317", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "16.0.1 through before https://aka.ms/OfficeSecurityReleases (custom); 16.0.1 through before 16.0.14334.20974 (custom); 16.0.0 through before 16.0.17932.21056 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-122", "what_happened": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108447" ], "timeline": [ { "at": "2026-10-15T21:17:10.317", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108447" } ] }, { "id": "CVE-2026-108446", "vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "title": "Microsoft 365 Apps for Enterprise vulnerability", "summary": "Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.", "updated_at": "2026-10-17T04:16:50.550", "published_at": "2026-10-15T21:17:10.200", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "16.0.1 through before https://aka.ms/OfficeSecurityReleases (custom); 1.0.0 through before 16.114.26101123 (custom); 16.0.1 through before 16.0.14334.20974 (custom); 16.0.0 through before 16.0.17932.21056 (custom); 16.0.1 through before 16.114.26101123 (custom); 16.0.0 through before 16.114.26101123 (custom); 16.0.0.0 through before 16.0.10417.20228 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-416", "what_happened": "Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108446" ], "timeline": [ { "at": "2026-10-15T21:17:10.200", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108446" } ] }, { "id": "CVE-2026-108445", "vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "title": "Microsoft 365 Apps for Enterprise vulnerability", "summary": "Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "updated_at": "2026-10-17T04:16:50.430", "published_at": "2026-10-15T21:17:10.077", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "16.0.1 through before https://aka.ms/OfficeSecurityReleases (custom); 1.0.0 through before 16.114.26101123 (custom); 16.0.1 through before 16.0.14334.20974 (custom); 16.0.0 through before 16.0.17932.21056 (custom); 16.0.1 through before 16.114.26101123 (custom); 16.0.0 through before 16.114.26101123 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-121", "what_happened": "Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108445" ], "timeline": [ { "at": "2026-10-15T21:17:10.077", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108445" } ] }, { "id": "CVE-2026-108444", "vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "title": "Microsoft 365 Apps for Enterprise vulnerability", "summary": "Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.", "updated_at": "2026-10-17T04:16:50.297", "published_at": "2026-10-15T21:17:09.957", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "16.0.1 through before https://aka.ms/OfficeSecurityReleases (custom); 1.0.0 through before 16.114.26101123 (custom); 16.0.1 through before 16.0.14334.20974 (custom); 16.0.0 through before 16.0.17932.21056 (custom); 16.0.1 through before 16.114.26101123 (custom); 16.0.0 through before 16.114.26101123 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-122", "what_happened": "Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108444" ], "timeline": [ { "at": "2026-10-15T21:17:09.957", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108444" } ] }, { "id": "CVE-2026-108443", "vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "title": "Microsoft 365 Apps for Enterprise vulnerability", "summary": "Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "updated_at": "2026-10-17T04:16:50.167", "published_at": "2026-10-15T21:17:09.840", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "16.0.1 through before https://aka.ms/OfficeSecurityReleases (custom); 1.0.0 through before 16.114.26101123 (custom); 16.0.1 through before 16.0.14334.20974 (custom); 16.0.0 through before 16.0.17932.21056 (custom); 16.0.1 through before 16.114.26101123 (custom); 16.0.0 through before 16.114.26101123 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-193", "what_happened": "Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108443" ], "timeline": [ { "at": "2026-10-15T21:17:09.840", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108443" } ] }, { "id": "CVE-2026-108442", "vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "title": "Microsoft 365 Apps for Enterprise vulnerability", "summary": "Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "updated_at": "2026-10-17T04:16:50.037", "published_at": "2026-10-15T21:17:09.727", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "16.0.1 through before https://aka.ms/OfficeSecurityReleases (custom); 1.0.0 through before 16.114.26101123 (custom); 16.0.1 through before 16.0.14334.20974 (custom); 16.0.0 through before 16.0.17932.21056 (custom); 16.0.1 through before 16.114.26101123 (custom); 16.0.0 through before 16.114.26101123 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-416", "what_happened": "Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108442" ], "timeline": [ { "at": "2026-10-15T21:17:09.727", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108442" } ] }, { "id": "CVE-2026-108441", "vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "title": "Microsoft 365 Apps for Enterprise vulnerability", "summary": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "updated_at": "2026-10-17T04:16:49.917", "published_at": "2026-10-15T21:17:09.607", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "16.0.1 through before https://aka.ms/OfficeSecurityReleases (custom); 1.0.0 through before 16.114.26101123 (custom); 16.0.1 through before 16.0.14334.20974 (custom); 16.0.0 through before 16.0.17932.21056 (custom); 16.0.1 through before 16.114.26101123 (custom); 16.0.0 through before 16.114.26101123 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-122", "what_happened": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108441" ], "timeline": [ { "at": "2026-10-15T21:17:09.607", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108441" } ] }, { "id": "CVE-2026-108440", "vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "title": "Microsoft 365 Apps for Enterprise vulnerability", "summary": "Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "updated_at": "2026-10-17T04:16:49.763", "published_at": "2026-10-15T21:17:09.493", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "16.0.1 through before https://aka.ms/OfficeSecurityReleases (custom); 1.0.0 through before 16.114.26101123 (custom); 16.0.1 through before 16.0.14334.20974 (custom); 16.0.0 through before 16.0.17932.21056 (custom); 16.0.1 through before 16.114.26101123 (custom); 16.0.0 through before 16.114.26101123 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-121", "what_happened": "Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108440" ], "timeline": [ { "at": "2026-10-15T21:17:09.493", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108440" } ] }, { "id": "CVE-2026-108439", "vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "title": "Microsoft 365 Apps for Enterprise vulnerability", "summary": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "updated_at": "2026-10-17T04:16:49.643", "published_at": "2026-10-15T21:17:09.377", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "16.0.1 through before https://aka.ms/OfficeSecurityReleases (custom); 1.0.0 through before 16.114.26101123 (custom); 16.0.1 through before 16.0.14334.20974 (custom); 16.0.0 through before 16.0.17932.21056 (custom); 16.0.1 through before 16.114.26101123 (custom); 16.0.0 through before 16.114.26101123 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-122", "what_happened": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108439" ], "timeline": [ { "at": "2026-10-15T21:17:09.377", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108439" } ] }, { "id": "CVE-2026-108437", "vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "title": "Microsoft 365 Apps for Enterprise vulnerability", "summary": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "updated_at": "2026-10-17T04:16:49.517", "published_at": "2026-10-15T21:17:09.140", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "16.0.1 through before https://aka.ms/OfficeSecurityReleases (custom); 16.0.1 through before 16.0.14334.20974 (custom); 16.0.0 through before 16.0.17932.21056 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-122", "what_happened": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108437" ], "timeline": [ { "at": "2026-10-15T21:17:09.140", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108437" } ] }, { "id": "CVE-2026-108436", "vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "title": "Microsoft 365 Apps for Enterprise vulnerability", "summary": "Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.", "updated_at": "2026-10-16T03:17:59.827", "published_at": "2026-10-15T21:17:09.020", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "16.0.1 through before https://aka.ms/OfficeSecurityReleases (custom); 1.0.0 through before 16.114.26101123 (custom); 16.0.1 through before 16.0.14334.20974 (custom); 16.0.0 through before 16.0.17932.21056 (custom); 16.0.1 through before 16.114.26101123 (custom); 16.0.0 through before 16.114.26101123 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-125", "what_happened": "Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108436" ], "timeline": [ { "at": "2026-10-15T21:17:09.020", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108436" } ] }, { "id": "CVE-2026-108435", "vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "title": "Microsoft 365 Apps for Enterprise vulnerability", "summary": "Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.", "updated_at": "2026-10-16T03:17:59.717", "published_at": "2026-10-15T21:17:08.903", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "16.0.1 through before https://aka.ms/OfficeSecurityReleases (custom); 1.0.0 through before 16.114.26101123 (custom); 16.0.1 through before 16.0.14334.20974 (custom); 16.0.0 through before 16.0.17932.21056 (custom); 16.0.1 through before 16.114.26101123 (custom); 16.0.0 through before 16.114.26101123 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-822", "what_happened": "Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108435" ], "timeline": [ { "at": "2026-10-15T21:17:08.903", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108435" } ] }, { "id": "CVE-2026-108434", "vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "title": "Microsoft 365 Apps for Enterprise vulnerability", "summary": "Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.", "updated_at": "2026-10-16T03:17:59.593", "published_at": "2026-10-15T21:17:08.777", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "16.0.1 through before https://aka.ms/OfficeSecurityReleases (custom); 1.0.0 through before 16.114.26101123 (custom); 16.0.1 through before 16.0.14334.20974 (custom); 16.0.0 through before 16.0.17932.21056 (custom); 16.0.1 through before 16.114.26101123 (custom); 16.0.0 through before 16.114.26101123 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-125", "what_happened": "Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108434" ], "timeline": [ { "at": "2026-10-15T21:17:08.777", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108434" } ] }, { "id": "CVE-2026-108433", "vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "title": "Microsoft 365 Apps for Enterprise vulnerability", "summary": "Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.", "updated_at": "2026-10-16T03:17:59.460", "published_at": "2026-10-15T21:17:08.657", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "16.0.1 through before https://aka.ms/OfficeSecurityReleases (custom); 1.0.0 through before 16.114.26101123 (custom); 16.0.1 through before 16.0.14334.20974 (custom); 16.0.0 through before 16.0.17932.21056 (custom); 16.0.1 through before 16.114.26101123 (custom); 16.0.0 through before 16.114.26101123 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-807", "what_happened": "Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108433" ], "timeline": [ { "at": "2026-10-15T21:17:08.657", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108433" } ] }, { "id": "CVE-2026-108432", "vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "title": "Microsoft 365 Apps for Enterprise vulnerability", "summary": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "updated_at": "2026-10-17T04:16:49.383", "published_at": "2026-10-15T21:17:08.540", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "16.0.1 through before https://aka.ms/OfficeSecurityReleases (custom); 1.0.0 through before 16.114.26101123 (custom); 16.0.1 through before 16.0.14334.20974 (custom); 16.0.0 through before 16.0.17932.21056 (custom); 16.0.1 through before 16.114.26101123 (custom); 16.0.0 through before 16.114.26101123 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-122", "what_happened": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108432" ], "timeline": [ { "at": "2026-10-15T21:17:08.540", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108432" } ] }, { "id": "CVE-2026-108431", "vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "title": "Microsoft 365 Apps for Enterprise vulnerability", "summary": "Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "updated_at": "2026-10-17T04:16:49.240", "published_at": "2026-10-15T21:17:08.420", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "16.0.1 through before https://aka.ms/OfficeSecurityReleases (custom); 1.0.0 through before 16.114.26101123 (custom); 16.0.1 through before 16.0.14334.20974 (custom); 16.0.0 through before 16.0.17932.21056 (custom); 16.0.1 through before 16.114.26101123 (custom); 16.0.0 through before 16.114.26101123 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-121", "what_happened": "Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108431" ], "timeline": [ { "at": "2026-10-15T21:17:08.420", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108431" } ] }, { "id": "CVE-2026-108430", "vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "title": "Microsoft 365 Apps for Enterprise vulnerability", "summary": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "updated_at": "2026-10-17T04:16:49.090", "published_at": "2026-10-15T21:17:08.303", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "16.0.1 through before https://aka.ms/OfficeSecurityReleases (custom); 1.0.0 through before 16.114.26101123 (custom); 16.0.1 through before 16.0.14334.20974 (custom); 16.0.0 through before 16.0.17932.21056 (custom); 16.0.1 through before 16.114.26101123 (custom); 16.0.0 through before 16.114.26101123 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-122", "what_happened": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108430" ], "timeline": [ { "at": "2026-10-15T21:17:08.303", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108430" } ] }, { "id": "CVE-2026-108429", "vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "title": "Microsoft 365 Apps for Enterprise vulnerability", "summary": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "updated_at": "2026-10-20T12:35:34.387", "published_at": "2026-10-15T21:17:08.190", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "16.0.1 through before https://aka.ms/OfficeSecurityReleases (custom); 16.0.1 through before 16.0.14334.20974 (custom); 16.0.0 through before 16.0.17932.21056 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-122", "what_happened": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108429" ], "timeline": [ { "at": "2026-10-15T21:17:08.190", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108429" } ] }, { "id": "CVE-2026-108428", "vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "title": "Microsoft 365 Apps for Enterprise vulnerability", "summary": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "updated_at": "2026-10-20T12:35:59.853", "published_at": "2026-10-15T21:17:08.067", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "16.0.1 through before https://aka.ms/OfficeSecurityReleases (custom); 16.0.1 through before 16.0.14334.20974 (custom); 16.0.0 through before 16.0.17932.21056 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-122", "what_happened": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108428" ], "timeline": [ { "at": "2026-10-15T21:17:08.067", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108428" } ] }, { "id": "CVE-2026-108427", "vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "title": "Microsoft 365 Apps for Enterprise vulnerability", "summary": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "updated_at": "2026-10-20T12:36:32.500", "published_at": "2026-10-15T21:17:07.947", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "16.0.1 through before https://aka.ms/OfficeSecurityReleases (custom); 16.0.1 through before 16.0.14334.20974 (custom); 16.0.0 through before 16.0.17932.21056 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-20", "what_happened": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108427" ], "timeline": [ { "at": "2026-10-15T21:17:07.947", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108427" } ] }, { "id": "CVE-2026-108426", "vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "title": "Microsoft 365 Apps for Enterprise vulnerability", "summary": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "updated_at": "2026-10-20T12:36:55.687", "published_at": "2026-10-15T21:17:07.820", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "16.0.1 through before https://aka.ms/OfficeSecurityReleases (custom); 16.0.1 through before 16.0.14334.20974 (custom); 16.0.0 through before 16.0.17932.21056 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-122", "what_happened": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108426" ], "timeline": [ { "at": "2026-10-15T21:17:07.820", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108426" } ] }, { "id": "CVE-2026-108334", "vendor": "Red Hat", "product": "Red Hat Connectivity Link 1.4", "title": "Red Hat Connectivity Link 1.4 vulnerability", "summary": "A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create or modify an HTTPRoute attached to a shared Gateway can provide a crafted path, header, or query match value that causes the predicate to skip those checks. The request is still forwarded to the route’s backend.", "updated_at": "2026-10-17T12:16:28.720", "published_at": "2026-10-15T19:17:20.187", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-917", "what_happened": "A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create or modify an HTTPRoute attached to a shared Gateway can provide a crafted path, header, or query match value that causes the predicate to skip those checks. The request is still forwarded to the route’s backend.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://access.redhat.com/errata/RHSA-2026:83531", "https://access.redhat.com/security/cve/CVE-2026-108334", "https://bugzilla.redhat.com/show_bug.cgi?id=2548768", "https://github.com/Kuadrant/kuadrant-operator/commit/7e667dc216e6ad38feaeadb391da59aa0380057a", "https://github.com/advisories/GHSA-fcw2-f6v9-6ffp" ], "timeline": [ { "at": "2026-10-15T19:17:20.187", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108334" } ] }, { "id": "CVE-2026-108165", "vendor": "immich-app", "product": "immich", "title": "immich vulnerability", "summary": "Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility. Attackers with an active partner relationship can call POST /api/sync/stream with PartnerAssetsV2 and PartnerAssetExifsV1 types to obtain GPS coordinates, capture times, descriptions and camera details.", "updated_at": "2026-10-10T14:16:37.910", "published_at": "2026-10-10T14:16:37.800", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 3.3.1 (semver)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility. Attackers with an active partner relationship can call POST /api/sync/stream with PartnerAssetsV2 and PartnerAssetExifsV1 types to obtain GPS coordinates, capture times, descriptions and camera details.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/immich-app/immich", "https://github.com/immich-app/immich/blob/db6e11ecc851228aec9c525abb0ee026d1f5055e/server/src/repositories/access.repository.ts#L207-L228", "https://github.com/immich-app/immich/blob/db6e11ecc851228aec9c525abb0ee026d1f5055e/server/src/repositories/sync.repository.ts#L662-L722", "https://hackmd.io/@haind/immich-partner-sync-locked-metadata", "https://www.vulncheck.com/advisories/immich-through-3.3.1-missing-authorization-in-partner-sync-exposes-locked-folder-metadata" ], "timeline": [ { "at": "2026-10-10T14:16:37.800", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108165" } ] }, { "id": "CVE-2026-108164", "vendor": "opensource-socialnetwork", "product": "opensource-socialnetwork", "title": "opensource-socialnetwork vulnerability", "summary": "Open Source Social Network (OSSN) through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossn_com.php that allows authenticated users to read other users' private message attachments. Attackers can request the /messages/attachment/{guid} route with sequential or guessed file GUIDs to retrieve attachments from private conversations without sender or recipient verification.", "updated_at": "2026-10-10T14:16:37.663", "published_at": "2026-10-10T14:16:37.663", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 10.1 (custom)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-639", "what_happened": "Open Source Social Network (OSSN) through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossn_com.php that allows authenticated users to read other users' private message attachments. Attackers can request the /messages/attachment/{guid} route with sequential or guessed file GUIDs to retrieve attachments from private conversations without sender or recipient verification.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/opensource-socialnetwork/opensource-socialnetwork", "https://github.com/opensource-socialnetwork/opensource-socialnetwork/blob/48b53f5b95488187715b2d5b5ae46a993267f83d/components/OssnMessages/ossn_com.php#L149-L156", "https://github.com/opensource-socialnetwork/opensource-socialnetwork/commit/2e9733d8eaafccdaef3d9b498348c8332e51f48b", "https://github.com/opensource-socialnetwork/opensource-socialnetwork/issues/2641", "https://hackmd.io/@leediay/ossn-idor-message-attachment", "https://www.vulncheck.com/advisories/open-source-social-network-ossn-through-10.1-idor-via-message-attachment-route" ], "timeline": [ { "at": "2026-10-10T14:16:37.663", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108164" } ] }, { "id": "CVE-2026-108163", "vendor": "smp46", "product": "pingvin-share-x", "title": "pingvin-share-x vulnerability", "summary": "Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are interpreted as milliseconds. Unauthenticated attackers can send effectively unthrottled requests to /api/auth/signIn, /api/auth/signIn/totp and /api/auth/resetPassword to brute-force passwords and TOTP codes.", "updated_at": "2026-10-10T14:16:37.530", "published_at": "2026-10-10T14:16:37.530", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 1.22.0 (semver)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-307", "what_happened": "Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are interpreted as milliseconds. Unauthenticated attackers can send effectively unthrottled requests to /api/auth/signIn, /api/auth/signIn/totp and /api/auth/resetPassword to brute-force passwords and TOTP codes.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/smp46/pingvin-share-x", "https://github.com/smp46/pingvin-share-x/blob/68ebf191fe1362592ffd5517e662f087e36c10b2/backend/src/auth/auth.controller.ts#L45-L50", "https://github.com/smp46/pingvin-share-x/commit/dc0aa5f66287038d5f919e74948462f994b1d6b1", "https://github.com/smp46/pingvin-share-x/releases/tag/v1.22.0", "https://github.com/smp46/pingvin-share-x/security/advisories/GHSA-7gx2-g6x2-7mjg", "https://www.vulncheck.com/advisories/pingvin-share-x-before-1.22.0-ineffective-authentication-rate-limiting-via-throttler-ttl" ], "timeline": [ { "at": "2026-10-10T14:16:37.530", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108163" } ] }, { "id": "CVE-2026-108162", "vendor": "smp46", "product": "pingvin-share-x", "title": "pingvin-share-x vulnerability", "summary": "Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unconditionally trusts proxy headers. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn, /api/auth/signIn/totp, and /api/auth/resetPassword to brute-force passwords and TOTP codes and forge logged client IP addresses.", "updated_at": "2026-10-10T14:16:37.397", "published_at": "2026-10-10T14:16:37.397", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 1.22.0 (semver)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-348", "what_happened": "Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unconditionally trusts proxy headers. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn, /api/auth/signIn/totp, and /api/auth/resetPassword to brute-force passwords and TOTP codes and forge logged client IP addresses.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/smp46/pingvin-share-x", "https://github.com/smp46/pingvin-share-x/blob/68ebf191fe1362592ffd5517e662f087e36c10b2/backend/src/main.ts#L57", "https://github.com/smp46/pingvin-share-x/commit/25e9cee7fb1c155300b5663fc5fedeea32d20954", "https://github.com/smp46/pingvin-share-x/releases/tag/v1.22.0", "https://github.com/smp46/pingvin-share-x/security/advisories/GHSA-7gx2-g6x2-7mjg", "https://www.vulncheck.com/advisories/pingvin-share-x-before-1.22.0-rate-limit-bypass-via-spoofed-x-forwarded-for" ], "timeline": [ { "at": "2026-10-10T14:16:37.397", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108162" } ] }, { "id": "CVE-2026-108161", "vendor": "fusionpbx", "product": "fusionpbx", "title": "fusionpbx vulnerability", "summary": "FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the record_name filename template is enabled, attackers can embed shell metacharacters like $(...) in the Caller-ID name or number, executing commands as the web server user once a privileged user downloads multiple recordings as a ZIP.", "updated_at": "2026-10-10T14:16:37.223", "published_at": "2026-10-10T14:16:37.223", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 5.6.5 (semver)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-78", "what_happened": "FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the record_name filename template is enabled, attackers can embed shell metacharacters like $(...) in the Caller-ID name or number, executing commands as the web server user once a privileged user downloads multiple recordings as a ZIP.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/fusionpbx/fusionpbx", "https://github.com/fusionpbx/fusionpbx/blob/ac4cd29870e3af67506390800904e262fee7e0ec/app/call_recordings/resources/classes/call_recordings.php#L736-L776", "https://github.com/fusionpbx/fusionpbx/commit/074a69310100f95171c67db62643cc2aac4f4d37", "https://www.vulncheck.com/advisories/fusionpbx-through-5.6.5-os-command-injection-via-caller-id-in-recording-zip-download" ], "timeline": [ { "at": "2026-10-10T14:16:37.223", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108161" } ] }, { "id": "CVE-2026-108135", "vendor": "Microsoft", "product": "Windows 10 Version 21H2", "title": "Windows 10 Version 21H2 vulnerability", "summary": "Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.", "updated_at": "2026-10-16T04:18:24.463", "published_at": "2026-10-13T19:18:03.960", "cvss": 7, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "10.0.19044.0 through before 10.0.19044.7807 (custom); 10.0.19045.0 through before 10.0.19044.7807 (custom); 10.0.22631.0 through before 10.0.22631.7652 (custom); 10.0.26100.0 through before 10.0.26100.9711 (custom); 10.0.26200.0 through before 10.0.26200.9711 (custom); 10.0.28000.0 through before 10.0.28000.3231 (custom); 10.0.26300.0 through before 10.0.26300.9711 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "High", "cwe": "CWE-59", "what_happened": "Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108135" ], "timeline": [ { "at": "2026-10-13T19:18:03.960", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108135" } ] }, { "id": "CVE-2026-108115", "vendor": "kortix-ai", "product": "suna", "title": "suna vulnerability", "summary": "Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateIp guard by supplying IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers holding project.connector.write can set connector base_url, OpenAPI, Postman, or MCP URLs to reach internal services and cloud metadata endpoints and read responses.", "updated_at": "2026-10-10T15:16:57.270", "published_at": "2026-10-10T15:16:57.270", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0.10.7 through before 0.13.52 (semver)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "High", "cwe": "CWE-918", "what_happened": "Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateIp guard by supplying IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers holding project.connector.write can set connector base_url, OpenAPI, Postman, or MCP URLs to reach internal services and cloud metadata endpoints and read responses.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/kortix-ai/suna", "https://github.com/kortix-ai/suna/blob/v0.13.45/apps/api/src/shared/ssrf-guard.ts#L98-L113", "https://github.com/kortix-ai/suna/commit/9c949e4d876cd5acf7b23b0a9ee49ca5c53f1332", "https://github.com/kortix-ai/suna/releases/tag/v0.13.52", "https://hackmd.io/@haind/suna-ssrf-6to4-guard-bypass", "https://www.vulncheck.com/advisories/kortix-suna-0.10.7-before-0.13.52-ssrf-guard-bypass-via-ipv6-6to4-addresses" ], "timeline": [ { "at": "2026-10-10T15:16:57.270", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108115" } ] }, { "id": "CVE-2026-108114", "vendor": "strapi", "product": "strapi", "title": "strapi vulnerability", "summary": "Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields, token holders can keep reading content fields an administrator removed from the role.", "updated_at": "2026-10-10T15:16:56.213", "published_at": "2026-10-10T15:16:56.213", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "5.47.0 through 5.57.0 (semver)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-863", "what_happened": "Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields, token holders can keep reading content fields an administrator removed from the role.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/strapi/strapi", "https://github.com/strapi/strapi/blob/v5.57.0/packages/core/admin/server/src/services/api-token.ts#L488-L498", "https://hackmd.io/@haind/strapi-admin-token-field-ceiling", "https://www.vulncheck.com/advisories/strapi-5.47.0-through-5.57.0-improper-authorization-via-admin-api-token-field-permissions" ], "timeline": [ { "at": "2026-10-10T15:16:56.213", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108114" } ] }, { "id": "CVE-2026-108097", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Exploit for drupal-11.4.9-vuln-lab CVE-2026-108097 CVE-2026-108514 CVE-2026-108515", "summary": "Drupal 11.4.9 vulnerabilities include RCE in field_ui and Stored XSS in link and navigation.", "updated_at": "2026-10-20T05:18:12Z", "published_at": "2026-10-20T05:18:12Z", "cvss": 0, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 8, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Drupal 11.4.9 vulnerabilities include RCE in field_ui and Stored XSS in link and navigation.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for drupal-11.4.9-vuln-lab CVE-2026-108097 CVE-2026-108514 CVE-2026-108515", "summary": "Drupal 11.4.9 vulnerabilities include RCE in field_ui and Stored XSS in link and navigation.", "what_happened": "Drupal 11.4.9 vulnerabilities include RCE in field_ui and Stored XSS in link and navigation.", "cvss": 0, "cvss_vector": "NONE", "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=0E7DC195-78D7-52CE-A33C-2FF2320F1405", "https://github.com/0xABCD01/drupal-11.4.9-vuln-lab" ], "repository": "Sploitus", "author": "0xABCD01", "first_seen": "2026-10-20T07:18:12", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=0E7DC195-78D7-52CE-A33C-2FF2320F1405" }, { "title": "Exploit for drupal-11.4.9-vuln-lab CVE-2026-108097 CVE-2026-108514 CVE-2026-108515", "summary": "Drupal 11.4.9 vulnerabilities include RCE in field_ui and Stored XSS in link and navigation.", "what_happened": "Drupal 11.4.9 vulnerabilities include RCE in field_ui and Stored XSS in link and navigation.", "cvss": 0, "cvss_vector": "NONE", "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=0E7DC195-78D7-52CE-A33C-2FF2320F1405", "https://github.com/0xABCD01/drupal-11.4.9-vuln-lab" ], "repository": "0xABCD01/drupal-11.4.9-vuln-lab", "author": "0xABCD01", "first_seen": "2026-10-20T07:18:12", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://github.com/0xABCD01/drupal-11.4.9-vuln-lab" }, { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-10-20T16:59:46+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "Exploit for CVE-2026-108097", "summary": "Proof-of-concept exploit for CVE-2026-108097.", "cvss": 0, "url": "https://sploitus.com/exploit?id=5ED407D4-1552-570F-A808-F93259585705" } ], "references": [ "https://sploitus.com/exploit?id=0E7DC195-78D7-52CE-A33C-2FF2320F1405", "https://github.com/0xABCD01/drupal-11.4.9-vuln-lab", "https://sploitus.com/exploit?id=5ED407D4-1552-570F-A808-F93259585705" ], "timeline": [ { "at": "2026-10-20T05:18:12Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=0E7DC195-78D7-52CE-A33C-2FF2320F1405" } ] }, { "id": "CVE-2026-107813", "vendor": "0xJacky", "product": "nginx-ui", "title": "nginx-ui vulnerability", "summary": "Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx reload or restart operations with AuthRequired but without RequireSecureSession. An authenticated OTP-enabled user possessing a stolen or persisted JWT can therefore perform node CRUD, read or replace node credentials, change namespaces, and invoke nodes/reload_nginx or nodes/restart_nginx without a fresh second-factor step-up. This issue is an incomplete fix for CVE-2026-84315 and is fixed in version 2.5.0.", "updated_at": "2026-10-20T14:32:08.007", "published_at": "2026-10-09T16:17:26.007", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": ">= 2.0.0, < 2.5.0", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx reload or restart operations with AuthRequired but without RequireSecureSession. An authenticated OTP-enabled user possessing a stolen or persisted JWT can therefore perform node CRUD, read or replace node credentials, change namespaces, and invoke nodes/reload_nginx or nodes/restart_nginx without a fresh second-factor step-up. This issue is an incomplete fix for CVE-2026-84315 and is fixed in version 2.5.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/0xJacky/nginx-ui/commit/a3999bd78a3b97ab22e6b5e9fd478ac57598a954", "https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0", "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h246-wpgf-vmq5" ], "timeline": [ { "at": "2026-10-09T16:17:26.007", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107813" } ] }, { "id": "CVE-2026-107812", "vendor": "0xJacky", "product": "nginx-ui", "title": "nginx-ui vulnerability", "summary": "Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates a downloaded binary only with a same-origin digest obtained from the same upgrade mirror. A compromised mirror or network attacker able to alter both responses can supply a malicious executable and matching digest. An operator-triggered upgrade is required, and the application installs and runs the attacker-controlled code in the Nginx UI process context on the next upgrade. This issue is fixed in version 2.5.0.", "updated_at": "2026-10-20T14:48:27.303", "published_at": "2026-10-09T16:17:25.847", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 100, "confidence_label": "verified", "affected": ">= 2.0.0, < 2.5.0", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-494", "what_happened": "Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates a downloaded binary only with a same-origin digest obtained from the same upgrade mirror. A compromised mirror or network attacker able to alter both responses can supply a malicious executable and matching digest. An operator-triggered upgrade is required, and the application installs and runs the attacker-controlled code in the Nginx UI process context on the next upgrade. This issue is fixed in version 2.5.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2026-10-09", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-662p-52hx-cmh2" } ], "references": [ "https://github.com/0xJacky/nginx-ui/commit/580585516dd87a8b176bcdac258db70c3b64b7ec", "https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0", "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-662p-52hx-cmh2" ], "timeline": [ { "at": "2026-10-09T16:17:25.847", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107812" } ] }, { "id": "CVE-2026-107811", "vendor": "0xJacky", "product": "nginx-ui", "title": "nginx-ui vulnerability", "summary": "Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser, allowing the user to impersonate a trusted node against a reachable cluster member. This cross-node authentication bypass can expose sensitive management operations, including configuration synchronization and service restart. This issue is fixed in version 2.5.0.", "updated_at": "2026-10-20T15:07:24.780", "published_at": "2026-10-09T16:17:25.690", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 100, "confidence_label": "verified", "affected": ">= 2.0.0, < 2.5.0", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-200", "what_happened": "Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser, allowing the user to impersonate a trusted node against a reachable cluster member. This cross-node authentication bypass can expose sensitive management operations, including configuration synchronization and service restart. This issue is fixed in version 2.5.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2026-10-09", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-32gc-wf3m-78w9" } ], "references": [ "https://github.com/0xJacky/nginx-ui/commit/0ecbd106c37b5143be14880c9447a66135151512", "https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0", "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-32gc-wf3m-78w9" ], "timeline": [ { "at": "2026-10-09T16:17:25.690", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107811" } ] }, { "id": "CVE-2026-107810", "vendor": "0xJacky", "product": "nginx-ui", "title": "nginx-ui vulnerability", "summary": "Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restore_nginx and restore_nginx_ui flags and permits symlinks targeting the live Nginx configuration path. An authenticated user who can create and restore backups can craft a valid backup that places a symlink in the staging tree and then writes a regular file through that link, even when both restore flags are false. This can persistently inject configuration or cause denial of service when the modified files are later consumed. This issue is fixed in version 2.5.0.", "updated_at": "2026-10-20T15:08:56.990", "published_at": "2026-10-09T16:17:25.540", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "confidence": 100, "confidence_label": "verified", "affected": ">= 2.0.0, < 2.5.0", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-59", "what_happened": "Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restore_nginx and restore_nginx_ui flags and permits symlinks targeting the live Nginx configuration path. An authenticated user who can create and restore backups can craft a valid backup that places a symlink in the staging tree and then writes a regular file through that link, even when both restore flags are false. This can persistently inject configuration or cause denial of service when the modified files are later consumed. This issue is fixed in version 2.5.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2026-10-09", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-p8v3-89rh-jxc7" } ], "references": [ "https://github.com/0xJacky/nginx-ui/commit/a467ed652591fc0cd1b466a1ec751b493faef9f7", "https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0", "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-p8v3-89rh-jxc7" ], "timeline": [ { "at": "2026-10-09T16:17:25.540", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107810" } ] }, { "id": "CVE-2026-107809", "vendor": "0xJacky", "product": "nginx-ui", "title": "nginx-ui vulnerability", "summary": "Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or Referer validation, a remote attacker can induce a logged-in administrator's browser to submit authenticated cross-site state-changing requests, including POST /api/configs. The attack requires an administrator account without OTP/Passkey or a target endpoint that does not require secure-session proof. The attacker cannot read the cross-origin response but can modify Nginx configuration, trigger reloads, or invoke other management operations reachable with the victim's session. This issue is fixed in version 2.5.0.", "updated_at": "2026-10-20T15:15:58.807", "published_at": "2026-10-09T16:17:25.387", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 100, "confidence_label": "verified", "affected": ">= 2.0.0, < 2.5.0", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-352", "what_happened": "Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or Referer validation, a remote attacker can induce a logged-in administrator's browser to submit authenticated cross-site state-changing requests, including POST /api/configs. The attack requires an administrator account without OTP/Passkey or a target endpoint that does not require secure-session proof. The attacker cannot read the cross-origin response but can modify Nginx configuration, trigger reloads, or invoke other management operations reachable with the victim's session. This issue is fixed in version 2.5.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2026-10-09", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-33rr-wq23-g6gg" } ], "references": [ "https://github.com/0xJacky/nginx-ui/commit/a3999bd78a3b97ab22e6b5e9fd478ac57598a954", "https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0", "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-33rr-wq23-g6gg" ], "timeline": [ { "at": "2026-10-09T16:17:25.387", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107809" } ] }, { "id": "CVE-2026-107808", "vendor": "0xJacky", "product": "nginx-ui", "title": "nginx-ui vulnerability", "summary": "Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore issued a session after password verification, despite Enabled2FA reporting that the account has a second factor. An attacker who obtains the password can take over the account and reach administrative functionality without the registered passkey. This issue is fixed in version 2.5.0.", "updated_at": "2026-10-20T15:24:07.787", "published_at": "2026-10-09T16:17:25.237", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "confidence": 100, "confidence_label": "verified", "affected": ">= 2.0.0, < 2.5.0", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-287", "what_happened": "Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore issued a session after password verification, despite Enabled2FA reporting that the account has a second factor. An attacker who obtains the password can take over the account and reach administrative functionality without the registered passkey. This issue is fixed in version 2.5.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2026-10-09", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-45gv-9wjv-xh7p" } ], "references": [ "https://github.com/0xJacky/nginx-ui/commit/95cd21b70814e5d9a48a359aa238aeea1ac97429", "https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0", "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-45gv-9wjv-xh7p" ], "timeline": [ { "at": "2026-10-09T16:17:25.237", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107808" } ] }, { "id": "CVE-2026-107807", "vendor": "0xJacky", "product": "nginx-ui", "title": "nginx-ui vulnerability", "summary": "Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently appear in access logs, proxy logs, browser history, Referer headers, configuration URLs, and deployment environment data. A party that obtains the secret can bypass normal password, JWT, session, and second-factor checks and obtain persistent administrative API access, including access to configuration and secret material. This issue is fixed in version 2.5.0.", "updated_at": "2026-10-20T15:27:19.727", "published_at": "2026-10-09T16:17:25.087", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 100, "confidence_label": "verified", "affected": ">= 2.0.0, < 2.5.0", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-312", "what_happened": "Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently appear in access logs, proxy logs, browser history, Referer headers, configuration URLs, and deployment environment data. A party that obtains the secret can bypass normal password, JWT, session, and second-factor checks and obtain persistent administrative API access, including access to configuration and secret material. This issue is fixed in version 2.5.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2026-10-09", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-pvgv-gcp7-v38g" } ], "references": [ "https://github.com/0xJacky/nginx-ui/commit/a3999bd78a3b97ab22e6b5e9fd478ac57598a954", "https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0", "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-pvgv-gcp7-v38g" ], "timeline": [ { "at": "2026-10-09T16:17:25.087", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107807" } ] }, { "id": "CVE-2026-107806", "vendor": "0xJacky", "product": "nginx-ui", "title": "Exploit for CVE-2026-107806", "summary": "Authenticated RCE in nginx-ui via forged backup restore overwriting app.ini.", "updated_at": "2026-10-09T16:38:57.820", "published_at": "2026-10-09T15:17:10.150", "cvss": 9.4, "confidence": 100, "confidence_label": "verified", "affected": ">= 2.3.8, < 2.5.0", "fixed": "See vendor advisory", "source_count": 79, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-94", "what_happened": "Authenticated RCE in nginx-ui via forged backup restore overwriting app.ini.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for CVE-2026-107806", "summary": "Authenticated RCE in nginx-ui via forged backup restore overwriting app.ini.", "what_happened": "Authenticated RCE in nginx-ui via forged backup restore overwriting app.ini.", "cvss": 9.4, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/SC:H/VI:H/SI:H/VA:H/SA:H", "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-94", "references": [ "https://sploitus.com/exploit?id=F4DD9CD0-A85B-5B88-AA48-873DDEAA98D4", "https://github.com/murrez/CVE-2026-107806" ], "repository": "Sploitus", "author": "murrez", "first_seen": "2026-10-10T08:17:35", "confidence": "High", "verification": "verified", "verified": true, "verification_detail": "Sploitus reports working code with at least 90% confidence.", "url": "https://sploitus.com/exploit?id=F4DD9CD0-A85B-5B88-AA48-873DDEAA98D4" }, { "repository": "murrez/CVE-2026-107806", "author": "murrez", "first_seen": "2026-10-10", "confidence": "High", "verification": "verified", "verified": true, "stars": 5, "title": "CVE-2026-107806 — nginx-ui 2.3.8–2.4.x auth RCE via forged backup restore (TestConfigCmd). PoCbit PoC: GET /api/backup, tamper app.ini, POST /api/restore, POST /api/nginx/test. check/exploit, batch url|JWT. Fixed 2.5.0. https://pocbit.org/pocs/cve-2026-107806", "summary": "CVE-2026-107806 — nginx-ui 2.3.8–2.4.x auth RCE via forged backup restore (TestConfigCmd). PoCbit PoC: GET /api/backup, tamper app.ini, POST /api/restore, POST /api/nginx/test. check/exploit, batch url|JWT. Fixed 2.5.0. https://pocbit.org/pocs/cve-2026-107806", "url": "https://github.com/murrez/CVE-2026-107806" } ], "references": [ "https://sploitus.com/exploit?id=F4DD9CD0-A85B-5B88-AA48-873DDEAA98D4", "https://github.com/murrez/CVE-2026-107806", "https://github.com/0xJacky/nginx-ui/commit/a467ed652591fc0cd1b466a1ec751b493faef9f7", "https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0", "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-p393-cf76-4jmr" ], "timeline": [ { "at": "2026-10-10T06:17:35Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=F4DD9CD0-A85B-5B88-AA48-873DDEAA98D4" }, { "at": "2026-10-09T15:17:10.150", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107806" } ], "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/SC:H/VI:H/SI:H/VA:H/SA:H", "enrichment_checked_at": "2026-10-10T16:05:31Z" }, { "id": "CVE-2026-107795", "vendor": "TP-Link Systems Inc.", "product": "Omada Software Controller", "title": "Omada Software Controller vulnerability", "summary": "Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management operations. \n\nSuccessful exploitation may allow a low-privileged authenticated user to upload or delete the controller's TLS certificate or private key, potentially disrupting secure management access.", "updated_at": "2026-10-16T04:18:24.267", "published_at": "2026-10-14T23:17:22.250", "cvss": 7.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 6.3.0.45 (custom)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-284", "what_happened": "Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management operations. \n\nSuccessful exploitation may allow a low-privileged authenticated user to upload or delete the controller's TLS certificate or private key, potentially disrupting secure management access.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://support.omadanetworks.com/en/download/software/omada-controller/", "https://support.omadanetworks.com/us/document/136188/", "https://support.omadanetworks.com/us/download/software/omada-controller/" ], "timeline": [ { "at": "2026-10-14T23:17:22.250", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107795" } ] }, { "id": "CVE-2026-107791", "vendor": "Unknown", "product": "WP Comment Cleaner", "title": "WP Comment Cleaner vulnerability", "summary": "The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.", "updated_at": "2026-10-12T06:16:58.820", "published_at": "2026-10-12T06:16:58.820", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "6.1 through before 7.2 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/138aae16-6f2c-4477-9518-f120a61577d1/" ], "timeline": [ { "at": "2026-10-12T06:16:58.820", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107791" } ] }, { "id": "CVE-2026-107742", "vendor": "10web", "product": "10Web Booster – Website speed optimization, Cache & Page Speed optimizer", "title": "10Web Booster – Website speed optimization, Cache & Page Speed optimizer vulnerability", "summary": "The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 2.34.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable because a comment author Name value containing ' src=' and an event-handler payload contains no HTML tags or quote characters, allowing it to survive WordPress core's sanitize_text_field and land verbatim inside the alt attribute, where the plugin's own str_replace subsequently injects the single quote that breaks out of the attribute context.", "updated_at": "2026-10-11T13:17:12.960", "published_at": "2026-10-10T07:16:40.843", "cvss": 7.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.34.8 (semver)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 2.34.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable because a comment author Name value containing ' src=' and an event-handler payload contains no HTML tags or quote characters, allowing it to survive WordPress core's sanitize_text_field and land verbatim inside the alt attribute, where the plugin's own str_replace subsequently injects the single quote that breaks out of the attribute context.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.10", "https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.8/includes/OptimizerImages.php#L186", "https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.8/includes/OptimizerImages.php#L310", "https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.8/includes/OptimizerImages.php#L445", "https://plugins.trac.wordpress.org/browser/tenweb-speed-optimizer/tags/2.34.8/tenweb_speed_optimizer.php#L175", "https://www.wordfence.com/threat-intel/vulnerabilities/id/b14945a5-c5e7-45cb-b2cc-8d1a265b6c52?source=cve" ], "timeline": [ { "at": "2026-10-10T07:16:40.843", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107742" } ] }, { "id": "CVE-2026-107694", "vendor": "Unknown", "product": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution", "title": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution vulnerability", "summary": "The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that the vendor a commission calculation is requested for is the requesting vendor, allowing vendors to disclose the commission rate and fixed fee the marketplace administrator configured for other vendors.", "updated_at": "2026-10-11T07:17:23.187", "published_at": "2026-10-11T07:17:23.187", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "before 5.2.0 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that the vendor a commission calculation is requested for is the requesting vendor, allowing vendors to disclose the commission rate and fixed fee the marketplace administrator configured for other vendors.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/ddce69ff-5325-432c-9f3a-66ec9a19bcb4/" ], "timeline": [ { "at": "2026-10-11T07:17:23.187", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107694" } ] }, { "id": "CVE-2026-107674", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2026-107674 exploit", "summary": "Exploit for CVE-2026-107674. CVSS 5.1.", "updated_at": "2026-10-16T19:17:02Z", "published_at": "2026-10-16T19:17:02Z", "cvss": 5.1, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 14, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-10-16T19:17:02+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "CVE-2026-107674 exploit", "summary": "Exploit for CVE-2026-107674. CVSS 5.1.", "cvss": 5.1, "url": "https://sploitus.com/exploit?id=NVD%3ACVE-2026-107674" } ], "references": [ "https://sploitus.com/exploit?id=NVD%3ACVE-2026-107674" ], "timeline": [ { "at": "2026-10-16T19:17:02Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=NVD%3ACVE-2026-107674" } ] }, { "id": "CVE-2026-107657", "vendor": "hivepress", "product": "HivePress – Business Directory, Listings & Classified Ads Plugin", "title": "HivePress – Business Directory, Listings & Classified Ads Plugin vulnerability", "summary": "The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have configured a text-type custom user attribute whose display format places %value% inside an HTML attribute context (e.g., the documented pattern <a href=\"%value%\">Custom link</a>), and for front-end user profiles to be enabled — both of which reflect the plugin's standard, documented configuration.", "updated_at": "2026-10-10T09:16:38.940", "published_at": "2026-10-10T09:16:38.940", "cvss": 7.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.7.31 (semver)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have configured a text-type custom user attribute whose display format places %value% inside an HTML attribute context (e.g., the documented pattern <a href=\"%value%\">Custom link</a>), and for front-end user profiles to be enabled — both of which reflect the plugin's standard, documented configuration.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/hivepress/hivepress/releases/tag/1.7.32", "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/components/class-attribute.php#L1298", "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/fields/class-field.php#L561", "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/fields/class-text.php#L197", "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/helpers.php#L382", "https://www.wordfence.com/threat-intel/vulnerabilities/id/d0e73b59-58d7-4f4b-b7f3-568190be9b09?source=cve" ], "timeline": [ { "at": "2026-10-10T09:16:38.940", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107657" } ] }, { "id": "CVE-2026-107639", "vendor": "ILIAS-eLearning e.V.", "product": "ILIAS", "title": "ILIAS vulnerability", "summary": "ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerability in assImagemapQuestionGUI that allows question authors to inject ImageMagick convert options via uploaded image filenames. Attackers can embed tab-separated options, which escapeshellcmd() does not neutralise, to write a PHP file under the web root and achieve remote code execution.", "updated_at": "2026-10-10T04:18:09.920", "published_at": "2026-10-08T15:17:47.117", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "9.0 through before 9.24 (custom); 10.0 through before 10.12 (custom); 11.0 through before 11.5 (custom)", "fixed": "See vendor advisory", "source_count": 9, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-88", "what_happened": "ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerability in assImagemapQuestionGUI that allows question authors to inject ImageMagick convert options via uploaded image filenames. Attackers can embed tab-separated options, which escapeshellcmd() does not neutralise, to write a PHP file under the web root and achieve remote code execution.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://docu.ilias.de/go/blog/15821/950", "https://docu.ilias.de/go/blog/15821/951", "https://docu.ilias.de/go/blog/15821/952", "https://github.com/ILIAS-eLearning/ILIAS", "https://github.com/ILIAS-eLearning/ILIAS/blob/v10.11/components/ILIAS/TestQuestionPool/classes/class.assImagemapQuestion.php#L290-L306", "https://github.com/ILIAS-eLearning/ILIAS/blob/v10.11/components/ILIAS/TestQuestionPool/classes/class.assImagemapQuestionGUI.php#L130", "https://github.com/ILIAS-eLearning/ILIAS/blob/v10.11/components/ILIAS/TestQuestionPool/classes/class.ilImagemapPreview.php#L208-L238", "https://github.com/ILIAS-eLearning/ILIAS/commit/ad1423c365a7ffd25bac711d995c643ce2af65c6", "https://www.vulncheck.com/advisories/ilias-before-9.24-10.12-and-11.5-argument-injection-via-image-map-question-upload-filename" ], "timeline": [ { "at": "2026-10-08T15:17:47.117", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107639" } ] }, { "id": "CVE-2026-107634", "vendor": "Aorimn", "product": "dislocker", "title": "dislocker vulnerability", "summary": "Dislocker through 0.7.3 contains a heap out-of-bounds read vulnerability in get_dataset() and get_next_datum() that never validate dataset and datum sizes against the metadata allocation. Attackers can craft a BitLocker volume image with inflated dataset or datum sizes that, when opened or mounted, crashes dislocker or discloses adjacent heap memory.", "updated_at": "2026-10-10T04:18:09.720", "published_at": "2026-10-08T15:17:46.160", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 0.7.3 (custom)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-125", "what_happened": "Dislocker through 0.7.3 contains a heap out-of-bounds read vulnerability in get_dataset() and get_next_datum() that never validate dataset and datum sizes against the metadata allocation. Attackers can craft a BitLocker volume image with inflated dataset or datum sizes that, when opened or mounted, crashes dislocker or discloses adjacent heap memory.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/Aorimn/dislocker", "https://github.com/Aorimn/dislocker/blob/v0.7.3/src/metadata/datums.c#L589-L640", "https://github.com/Aorimn/dislocker/blob/v0.7.3/src/metadata/metadata.c#L764-L790", "https://github.com/Aorimn/dislocker/commit/9158e9e41dd669b360cbc53cc18ccae729b67b48", "https://www.vulncheck.com/advisories/dislocker-through-0.7.3-heap-out-of-bounds-read-via-bitlocker-metadata-dataset-size" ], "timeline": [ { "at": "2026-10-08T15:17:46.160", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107634" } ] }, { "id": "CVE-2026-107507", "vendor": "Unknown", "product": "Squadeno", "title": "Squadeno vulnerability", "summary": "The Squadeno WordPress plugin before 1.12.0 does not enforce its restrictions on every way a sport can be saved, allowing users with the lowest-tier Trainer role to change the section, age group, author, password, comment settings and date of a sport they are assigned to.", "updated_at": "2026-10-11T07:17:23.087", "published_at": "2026-10-11T07:17:23.087", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "before 1.12.0 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The Squadeno WordPress plugin before 1.12.0 does not enforce its restrictions on every way a sport can be saved, allowing users with the lowest-tier Trainer role to change the section, age group, author, password, comment settings and date of a sport they are assigned to.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/f02f3608-0809-4a4e-ae5f-5e89d42c4026/" ], "timeline": [ { "at": "2026-10-11T07:17:23.087", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107507" } ] }, { "id": "CVE-2026-107448", "vendor": "Wizards of the Coast", "product": "Magic: The Gathering Arena", "title": "Magic: The Gathering Arena vulnerability", "summary": "Magic: The Gathering Arena (Windows/Steam client; 2026.59.30.12801.127931.6 and certain later 2026.60.x builds) passes a server-supplied URL from a home-screen carousel GoToExternalUrl action directly to the Windows shell via Application.OpenURL/ShellExecuteW without validating the URI scheme or domain. A hypothetical attacker able to control the carousel content delivered to clients can cause arbitrary registered URI-scheme handlers to be invoked on client hosts with no user interaction. For example, one might expect that the carousel content only has https: URIs, not ms-calculator: URIs.", "updated_at": "2026-10-10T03:17:07.040", "published_at": "2026-10-08T04:17:19.640", "cvss": 3.4, "cvss_vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "2026.59.30.12801.127931.6 (custom)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Adjacent Network", "authentication": "None", "complexity": "High", "cwe": "CWE-99", "what_happened": "Magic: The Gathering Arena (Windows/Steam client; 2026.59.30.12801.127931.6 and certain later 2026.60.x builds) passes a server-supplied URL from a home-screen carousel GoToExternalUrl action directly to the Windows shell via Application.OpenURL/ShellExecuteW without validating the URI scheme or domain. A hypothetical attacker able to control the carousel content delivered to clients can cause arbitrary registered URI-scheme handlers to be invoked on client hosts with no user interaction. For example, one might expect that the carousel content only has https: URIs, not ms-calculator: URIs.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/N0tMilk/vulnerability-research/blob/main/Magic/carousel-shellexecute-mtga.md" ], "timeline": [ { "at": "2026-10-08T04:17:19.640", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107448" } ] }, { "id": "CVE-2026-107437", "vendor": "GeoVision Inc.", "product": "GV-E-map Server", "title": "GV-E-map Server vulnerability", "summary": "GV-E-Map\nServer V18.2.0A contains a plaintext database password embedded within an\napplication component. The credential can be recovered through static analysis\nof the distributed binary and may also be exposed in process memory during\nruntime.", "updated_at": "2026-10-12T03:17:17.683", "published_at": "2026-10-12T03:17:17.683", "cvss": 6.2, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "18.2.0A", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-798", "what_happened": "GV-E-Map\nServer V18.2.0A contains a plaintext database password embedded within an\napplication component. The credential can be recovered through static analysis\nof the distributed binary and may also be exposed in process memory during\nruntime.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.geovision.com.tw/cyber_security.php" ], "timeline": [ { "at": "2026-10-12T03:17:17.683", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107437" } ] }, { "id": "CVE-2026-107434", "vendor": "videowhisper", "product": "MicroPayments", "title": "MicroPayments vulnerability", "summary": "Subscriber Bypass Vulnerability in MicroPayments <= 3.2.9 versions.", "updated_at": "2026-10-10T20:16:32.513", "published_at": "2026-10-10T20:16:32.513", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "n/a through 3.2.9 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-1284", "what_happened": "Subscriber Bypass Vulnerability in MicroPayments <= 3.2.9 versions.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/paid-membership/vulnerability/wordpress-micropayments-plugin-3-2-9-bypass-vulnerability-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-10-10T20:16:32.513", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107434" } ] }, { "id": "CVE-2026-107420", "vendor": "Narinder Singh", "product": "Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway", "title": "Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway vulnerability", "summary": "Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway <= 1.7.2 versions.", "updated_at": "2026-10-10T20:16:32.387", "published_at": "2026-10-10T20:16:32.387", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "n/a through 1.7.2 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-345", "what_happened": "Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway <= 1.7.2 versions.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/cryptocurrency-payments-using-metamask-for-woocommerce/vulnerability/wordpress-pay-with-metamask-for-woocommerce-cryptocurrency-payment-gateway-plugin-1-7-2-bypass-vulnerability-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-10-10T20:16:32.387", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107420" } ] }, { "id": "CVE-2026-107419", "vendor": "Cool Plugins", "product": "AI Translation for Polylang", "title": "AI Translation for Polylang vulnerability", "summary": "Missing Authorization vulnerability in Cool Plugins AI Translation for Polylang automatic-translations-for-polylang allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Translation for Polylang: from n/a through 1.6.2.", "updated_at": "2026-10-11T13:17:12.533", "published_at": "2026-10-09T12:17:08.870", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.6.2 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in Cool Plugins AI Translation for Polylang automatic-translations-for-polylang allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Translation for Polylang: from n/a through 1.6.2.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/automatic-translations-for-polylang/vulnerability/wordpress-ai-translation-for-polylang-plugin-1-6-2-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-10-09T12:17:08.870", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107419" } ] }, { "id": "CVE-2026-107406", "vendor": "NetScaler", "product": "ADC", "title": "ADC vulnerability", "summary": "Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC.\n\n\nNetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements:\n\n\n\n \n\n * For the following versions: Applicable only when configured as a SAML IdP:\n * NetScaler ADC and NetScaler Gateway between 14.1-73.37 and 14.1-73.41, inclusive\n * NetScaler ADC 14.1-FIPS between 14.1-73.37 FIPS and 14.1-73.41 FIPS, inclusive\n * NetScaler ADC and NetScaler Gateway between 13.1-64.23 and 13.1-64.28, inclusive\n * NetScaler ADC 13.1-FIPS between 13.1-NDcPP 13.1-37.279 and 13.1- 37.282, inclusive\n\n\n\n\n \n\n\n\nFor the following versions: Applicable only when configured as a SAML SP or SAML IdP:\n\n * NetScaler ADC and NetScaler Gateway before 14.1-73.37 \n * NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS \n * NetScaler ADC and NetScaler Gateway before 13.1-64.23\n * NetScaler ADC 13.1-FIPS before13.1-NDcPP 13.1-37.279", "updated_at": "2026-10-10T04:18:09.503", "published_at": "2026-10-08T22:17:26.847", "cvss": 9.5, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "before 14.1-73.46 (patch); before 13.1-64.29 (patch); before 14.1-73.46 FIPS (patch); before 13.1.37.283 FIPS (patch)", "fixed": "See vendor advisory", "source_count": 170, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-119", "what_happened": "Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC.\n\n\nNetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements:\n\n\n\n \n\n * For the following versions: Applicable only when configured as a SAML IdP:\n * NetScaler ADC and NetScaler Gateway between 14.1-73.37 and 14.1-73.41, inclusive\n * NetScaler ADC 14.1-FIPS between 14.1-73.37 FIPS and 14.1-73.41 FIPS, inclusive\n * NetScaler ADC and NetScaler Gateway between 13.1-64.23 and 13.1-64.28, inclusive\n * NetScaler ADC 13.1-FIPS between 13.1-NDcPP 13.1-37.279 and 13.1- 37.282, inclusive\n\n\n\n\n \n\n\n\nFor the following versions: Applicable only when configured as a SAML SP or SAML IdP:\n\n * NetScaler ADC and NetScaler Gateway before 14.1-73.37 \n * NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS \n * NetScaler ADC and NetScaler Gateway before 13.1-64.23\n * NetScaler ADC 13.1-FIPS before13.1-NDcPP 13.1-37.279", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-10-11T09:11:11+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "Exploit for CVE-2026-107406", "summary": "Proof-of-concept exploit for CVE-2026-107406. CVSS 9.5.", "cvss": 9.5, "url": "https://sploitus.com/exploit?id=88E00D99-4CD3-529F-B652-BE0CFD78CD38" }, { "repository": "ctroy999/CVE-2026-107406", "author": "ctroy999", "first_seen": "2026-10-11", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "CVE-2026-107406 repository", "summary": "", "url": "https://github.com/ctroy999/CVE-2026-107406" }, { "repository": "ApexBreach/CVE-2026-107406-Poc", "author": "ApexBreach", "first_seen": "2026-10-09", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "CVE-2026-107406 repository", "summary": "", "url": "https://github.com/ApexBreach/CVE-2026-107406-Poc" }, { "repository": "techupdate24/citrix-netscaler-rce-cve-2026-107406", "author": "techupdate24", "first_seen": "2026-10-09", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.", "summary": "A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.", "url": "https://github.com/techupdate24/citrix-netscaler-rce-cve-2026-107406" }, { "repository": "ThomasPoppelgaard/netscaler-ctx697096-checker", "author": "ThomasPoppelgaard", "first_seen": "2026-09-28", "confidence": "High", "verification": "verified", "verified": true, "stars": 18, "title": "Am I fixed? Was I hacked? Read-only checker for Citrix NetScaler CTX697096 (CVE-2026-88771–88778), CTX697174 (CVE-2026-88779) and CTX697191 (CVE-2026-107406, SAML RCE): build, CVE preconditions, SAML IdP/SP, Enhanced ISN, upgrade risks + IoC sweep by default with every public IoC (webshells, implants, 132 attacker IPs).", "summary": "Am I fixed? Was I hacked? Read-only checker for Citrix NetScaler CTX697096 (CVE-2026-88771–88778), CTX697174 (CVE-2026-88779) and CTX697191 (CVE-2026-107406, SAML RCE): build, CVE preconditions, SAML IdP/SP, Enhanced ISN, upgrade risks + IoC sweep by default with every public IoC (webshells, implants, 132 attacker IPs).", "url": "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" } ], "references": [ "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697191", "https://community.citrix.com/techzone-blogs/110_security-updates/protecting-customers-immediate-guidance-for-cve-2026-107406-in-netscaler-adc-and-netscaler-gateway-r1631/", "https://sploitus.com/exploit?id=88E00D99-4CD3-529F-B652-BE0CFD78CD38", "https://github.com/ctroy999/CVE-2026-107406", "https://github.com/ApexBreach/CVE-2026-107406-Poc", "https://github.com/techupdate24/citrix-netscaler-rce-cve-2026-107406", "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" ], "timeline": [ { "at": "2026-10-08T22:17:26.847", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107406" } ] }, { "id": "CVE-2026-107350", "vendor": "n/a", "product": "PgBouncer", "title": "PgBouncer vulnerability", "summary": "Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.", "updated_at": "2026-10-16T04:18:23.777", "published_at": "2026-10-14T18:17:25.670", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "1.17.0 through before 1.26.1 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-287", "what_happened": "Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.pgbouncer.org/changelog.html" ], "timeline": [ { "at": "2026-10-14T18:17:25.670", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107350" } ] }, { "id": "CVE-2026-107323", "vendor": "Unknown", "product": "Gallery PhotoBlocks", "title": "Gallery PhotoBlocks vulnerability", "summary": "The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of anyone who views a page containing the gallery, including administrators.", "updated_at": "2026-10-10T12:16:46.690", "published_at": "2026-10-10T06:16:41.167", "cvss": 6.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "1.3.5 through before 1.3.6 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-79", "what_happened": "The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of anyone who views a page containing the gallery, including administrators.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/19a8c2db-fb31-4203-83d6-139b35c93a80/" ], "timeline": [ { "at": "2026-10-10T06:16:41.167", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107323" } ] }, { "id": "CVE-2026-107321", "vendor": "Unknown", "product": "W3 Total Cache", "title": "W3 Total Cache vulnerability", "summary": "The W3 Total Cache WordPress plugin before 2.10.6 does not confine a media-import file copy to the document root, nor enforce an effective file-type restriction on it, allowing users with the Author role or higher to plant content that, once an administrator runs the import, copies an arbitrary server-readable file into a publicly served directory, exposing it to unauthenticated retrieval.", "updated_at": "2026-10-10T12:16:46.530", "published_at": "2026-10-10T06:16:41.017", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "before 2.10.6 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "High", "cwe": "CWE-22", "what_happened": "The W3 Total Cache WordPress plugin before 2.10.6 does not confine a media-import file copy to the document root, nor enforce an effective file-type restriction on it, allowing users with the Author role or higher to plant content that, once an administrator runs the import, copies an arbitrary server-readable file into a publicly served directory, exposing it to unauthenticated retrieval.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/b549d615-f06e-494f-9a71-da3152aacec9/" ], "timeline": [ { "at": "2026-10-10T06:16:41.017", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107321" } ] }, { "id": "CVE-2026-107282", "vendor": "AsyncHttpClient", "product": "async-http-client", "title": "async-http-client vulnerability", "summary": "The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original origin. Connection-pool selection, CONNECT handling, realm selection, and TLS setup can consequently send the original host's path, Host header, Authorization credentials, or plaintext request to the replay destination. Documented ResponseFilter failover and retry paths can trigger the replay. This issue is fixed in versions 3.0.13 and 2.16.1.", "updated_at": "2026-10-10T03:17:06.900", "published_at": "2026-10-07T22:17:04.167", "cvss": 9.4, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": ">= 3.0.0, < 3.0.13; >= 2.0.0, < 2.16.1", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-319", "what_happened": "The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original origin. Connection-pool selection, CONNECT handling, realm selection, and TLS setup can consequently send the original host's path, Host header, Authorization credentials, or plaintext request to the replay destination. Documented ResponseFilter failover and retry paths can trigger the replay. This issue is fixed in versions 3.0.13 and 2.16.1.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/AsyncHttpClient/async-http-client/commit/15b254514a411623e5f1d8c99ea79c0f82f8a466", "https://github.com/AsyncHttpClient/async-http-client/commit/bbc31aed3b044f9f7a126cf689a8c8d7ad2ae1cb", "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.1", "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.13", "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-jmqq-x5g9-9p2w" ], "timeline": [ { "at": "2026-10-07T22:17:04.167", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107282" } ] }, { "id": "CVE-2026-107269", "vendor": "gophish", "product": "gophish", "title": "gophish vulnerability", "summary": "Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring login response times. Attackers can submit candidate usernames to POST /login and detect bcrypt comparison delays for existing accounts, narrowing targets for password guessing or credential stuffing.", "updated_at": "2026-10-10T03:17:06.763", "published_at": "2026-10-07T16:17:46.287", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 0.12.1 (semver)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-208", "what_happened": "Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring login response times. Attackers can submit candidate usernames to POST /login and detect bcrypt comparison delays for existing accounts, narrowing targets for password guessing or credential stuffing.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://blog.ostorlab.co/gophish-0121-manual-review-agentic-deep-scan.html", "https://github.com/gophish/gophish", "https://github.com/gophish/gophish/blob/b1648f0759c6d57ac989157c55d8b47c40254fe6/controllers/route.go#L375-L390", "https://www.vulncheck.com/advisories/gophish-through-0.12.1-username-enumeration-via-post-login-timing-discrepancy" ], "timeline": [ { "at": "2026-10-07T16:17:46.287", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107269" } ] }, { "id": "CVE-2026-107231", "vendor": "AsyncHttpClient", "product": "async-http-client", "title": "async-http-client vulnerability", "summary": "The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challenge Digest while omitting or emptying the nonce, causing the client to resend the username and password using reversible Basic authentication. Both origin and proxy challenge parsers are affected. This issue is fixed in versions 3.0.13 and 2.16.1.", "updated_at": "2026-10-10T03:17:06.630", "published_at": "2026-10-07T22:17:03.320", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": ">= 3.0.0.Beta1, < 3.0.13; >= 2.0.0, < 2.16.1", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-319", "what_happened": "The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challenge Digest while omitting or emptying the nonce, causing the client to resend the username and password using reversible Basic authentication. Both origin and proxy challenge parsers are affected. This issue is fixed in versions 3.0.13 and 2.16.1.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/AsyncHttpClient/async-http-client/commit/8376866aa9b5a7653ad19db9d472692f875caa83", "https://github.com/AsyncHttpClient/async-http-client/commit/c8d639bf6ac341d377d610a93570bcd15565f1a6", "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.1", "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.13", "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-rqf5-2wxv-rjf4" ], "timeline": [ { "at": "2026-10-07T22:17:03.320", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107231" } ] }, { "id": "CVE-2026-107225", "vendor": "qax-os", "product": "excelize", "title": "excelize vulnerability", "summary": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.0 to 2.11.0, GetStyle's fill, border, and font extraction predicates check only upper bounds for attacker-controlled style-table indices. File.GetStyle relies on extractStyleCondFuncs predicates that allow negative FillID, BorderID, and FontID values to reach slice indexing. When a crafted styles.xml supplies a negative fillId, borderId, or fontId and the application reads the style, a negative identifier passes the upper-bound-only predicate and becomes a negative slice index, allowing an attacker to panic while reading cell styling. No fixed version is available as of this review.", "updated_at": "2026-10-10T03:17:06.460", "published_at": "2026-10-07T19:17:35.333", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "confidence": 35, "confidence_label": "observed", "affected": ">= 2.8.0, <= 2.11.0", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-20", "what_happened": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.0 to 2.11.0, GetStyle's fill, border, and font extraction predicates check only upper bounds for attacker-controlled style-table indices. File.GetStyle relies on extractStyleCondFuncs predicates that allow negative FillID, BorderID, and FontID values to reach slice indexing. When a crafted styles.xml supplies a negative fillId, borderId, or fontId and the application reads the style, a negative identifier passes the upper-bound-only predicate and becomes a negative slice index, allowing an attacker to panic while reading cell styling. No fixed version is available as of this review.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/qax-os/excelize/commit/ae2113b410e51f6a141c396a59eda8c42b91bc22", "https://github.com/qax-os/excelize/pull/2367", "https://github.com/qax-os/excelize/security/advisories/GHSA-5h23-36rv-pm65" ], "timeline": [ { "at": "2026-10-07T19:17:35.333", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107225" } ] }, { "id": "CVE-2026-107220", "vendor": "qax-os", "product": "excelize", "title": "excelize vulnerability", "summary": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the cached rectangle empty for an empty mergeCell ref and then passes that empty slice to cellInRange without a length check. GetCellValue reaches mergeCellsParser, which passes an empty rectangle derived from the mergeCell ref attribute into cellInRange. When a crafted worksheet contains an empty mergeCell ref and a non-streaming cell API reads the worksheet, cellInRange indexes four positions in an empty slice, allowing an attacker to panic on the first affected cell operation. No fixed version is available as of this review.", "updated_at": "2026-10-10T03:17:06.287", "published_at": "2026-10-07T19:17:34.447", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "confidence": 35, "confidence_label": "observed", "affected": ">= 2.7.1, <= 2.11.0", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-125", "what_happened": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the cached rectangle empty for an empty mergeCell ref and then passes that empty slice to cellInRange without a length check. GetCellValue reaches mergeCellsParser, which passes an empty rectangle derived from the mergeCell ref attribute into cellInRange. When a crafted worksheet contains an empty mergeCell ref and a non-streaming cell API reads the worksheet, cellInRange indexes four positions in an empty slice, allowing an attacker to panic on the first affected cell operation. No fixed version is available as of this review.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/qax-os/excelize/commit/99903a3240e58a47ff28fb8e05a03bd9d496ec24", "https://github.com/qax-os/excelize/pull/2379", "https://github.com/qax-os/excelize/security/advisories/GHSA-g27h-8qhm-6pff" ], "timeline": [ { "at": "2026-10-07T19:17:34.447", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107220" } ] }, { "id": "CVE-2026-107215", "vendor": "qax-os", "product": "excelize", "title": "excelize vulnerability", "summary": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, extractPart allocates a byte slice directly from an attacker-controlled CFB directory-entry size before validating the sector chain or size domain. extractPart trusts the CFB directory entry streamSize for EncryptionInfo and EncryptedPackage allocations before validating the stream. When a crafted OLE compound file declares a negative or extremely large EncryptionInfo or EncryptedPackage stream size, the declared size reaches make with a negative length or forces a multi-gigabyte allocation, allowing an attacker to panic or exhaust process memory. No fixed version is available as of this review.", "updated_at": "2026-10-10T03:17:06.113", "published_at": "2026-10-07T18:17:19.213", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "confidence": 35, "confidence_label": "observed", "affected": ">= 2.3.1, <= 2.11.0", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-789", "what_happened": "Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, extractPart allocates a byte slice directly from an attacker-controlled CFB directory-entry size before validating the sector chain or size domain. extractPart trusts the CFB directory entry streamSize for EncryptionInfo and EncryptedPackage allocations before validating the stream. When a crafted OLE compound file declares a negative or extremely large EncryptionInfo or EncryptedPackage stream size, the declared size reaches make with a negative length or forces a multi-gigabyte allocation, allowing an attacker to panic or exhaust process memory. No fixed version is available as of this review.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/qax-os/excelize/commit/5f636f9dcde55911f14290060b017f0cc88cd694", "https://github.com/qax-os/excelize/pull/2396", "https://github.com/qax-os/excelize/security/advisories/GHSA-x2q3-8cjh-766f" ], "timeline": [ { "at": "2026-10-07T18:17:19.213", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107215" } ] }, { "id": "CVE-2026-107210", "vendor": "ImageMagick", "product": "ImageMagick", "title": "ImageMagick vulnerability", "summary": "ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy limit, bypassing resource restrictions and consuming excessive disk space. This issue is fixed in versions 7.1.2-30 and 6.9.13-55.", "updated_at": "2026-10-10T03:17:05.957", "published_at": "2026-10-07T16:17:46.120", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "confidence": 35, "confidence_label": "observed", "affected": "< 6.9.13-55; >= 7.0.0, < 7.1.2-30", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-409", "what_happened": "ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy limit, bypassing resource restrictions and consuming excessive disk space. This issue is fixed in versions 7.1.2-30 and 6.9.13-55.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/ImageMagick/ImageMagick/commit/ae2ed8c81d8fad1f186e7f2bc0837b46a1c7be61", "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-30", "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3j4w-pvxj-fpjc", "https://github.com/ImageMagick/ImageMagick6/commit/7d8e0eb11804a5ce5322ea317dfd3557cded4e7b", "https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-55" ], "timeline": [ { "at": "2026-10-07T16:17:46.120", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107210" } ] }, { "id": "CVE-2026-107203", "vendor": "Red Hat", "product": "Red Hat Satellite 6", "title": "Red Hat Satellite 6 vulnerability", "summary": "An **incorrect authorization** flaw has been found in **network interface handling** in the **Foreman** package. The domain and subnet interface API checks only that the caller holds a host permission. It does not apply the search limit on that permission, so the request is answered from every interface on the domain or subnet. A low-privileged network attacker or user must already be allowed to view some hosts and to view a domain or subnet shared with other hosts. They can request that domain or subnet's interfaces. The response includes interface records of hosts they are not allowed to view. If the attacker or user is also allowed to edit some hosts, they can submit a change to one of those interfaces. The interface is then saved with that change.", "updated_at": "2026-10-12T06:16:58.667", "published_at": "2026-10-12T06:16:58.667", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-863", "what_happened": "An **incorrect authorization** flaw has been found in **network interface handling** in the **Foreman** package. The domain and subnet interface API checks only that the caller holds a host permission. It does not apply the search limit on that permission, so the request is answered from every interface on the domain or subnet. A low-privileged network attacker or user must already be allowed to view some hosts and to view a domain or subnet shared with other hosts. They can request that domain or subnet's interfaces. The response includes interface records of hosts they are not allowed to view. If the attacker or user is also allowed to edit some hosts, they can submit a change to one of those interfaces. The interface is then saved with that change.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://access.redhat.com/security/cve/CVE-2026-107203", "https://bugzilla.redhat.com/show_bug.cgi?id=2547470" ], "timeline": [ { "at": "2026-10-12T06:16:58.667", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107203" } ] }, { "id": "CVE-2026-107194", "vendor": "Sungrow", "product": "iSolarCloud", "title": "iSolarCloud vulnerability", "summary": "Sungrow iSolarCloud before 2026 allows authentication bypass and account takeover via \"login_type\":\"5\" in a login request, potentially leading to \"local blackouts on the whole continent\" in Europe. An email address for the user_account property is required; however, a user can view the email address associated with their parent organization.", "updated_at": "2026-10-10T03:17:05.783", "published_at": "2026-10-07T14:17:09.203", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 2026 (custom)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-288", "what_happened": "Sungrow iSolarCloud before 2026 allows authentication bypass and account takeover via \"login_type\":\"5\" in a login request, potentially leading to \"local blackouts on the whole continent\" in Europe. An email address for the user_account property is required; however, a user can view the email address associated with their parent organization.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://jakkaru.de/articles/sungrow-vulnerability-exposes-gigawatts-worldwide", "https://www.sungrowpower.com/en/products/cloud-software/isolarcloud" ], "timeline": [ { "at": "2026-10-07T14:17:09.203", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107194" } ] }, { "id": "CVE-2026-107193", "vendor": "Red Hat", "product": "Red Hat Satellite 6", "title": "Red Hat Satellite 6 vulnerability", "summary": "A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete filters for one role only. They can delete filters that belong to other unlocked roles. Those other roles then lose the access the deleted filters had granted.", "updated_at": "2026-10-12T06:16:58.463", "published_at": "2026-10-12T06:16:58.463", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-639", "what_happened": "A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete filters for one role only. They can delete filters that belong to other unlocked roles. Those other roles then lose the access the deleted filters had granted.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://access.redhat.com/security/cve/CVE-2026-107193", "https://bugzilla.redhat.com/show_bug.cgi?id=2547437" ], "timeline": [ { "at": "2026-10-12T06:16:58.463", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107193" } ] }, { "id": "CVE-2026-107181", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Telegram CVE-2026-107181", "summary": "Telegram CVE-2026-107181", "updated_at": "2026-10-13T22:00:00Z", "published_at": "2026-10-13T22:00:00Z", "cvss": 0, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 25, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "PoC-in-GitHub · SeanDishman/telegram-cve-2026-107181", "author": "SeanDishman", "first_seen": "2026-10-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 19, "title": "Telegram CVE-2026-107181", "summary": "Telegram CVE-2026-107181", "url": "https://github.com/SeanDishman/telegram-cve-2026-107181" }, { "repository": "PoC-in-GitHub · 00nx/telegram-account-takeover-poc", "author": "00nx", "first_seen": "2026-10-13", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "CVE-2026-107181 Proof Of Concept for telegram Desktop account take over in windows", "summary": "CVE-2026-107181 Proof Of Concept for telegram Desktop account take over in windows", "url": "https://github.com/00nx/telegram-account-takeover-poc" }, { "repository": "PoC-in-GitHub · abdugafforov-bobur/cve-2026-107181-poc", "author": "abdugafforov-bobur", "first_seen": "2026-10-14", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 7, "title": "CVE-2026-107181 repository", "summary": "", "url": "https://github.com/abdugafforov-bobur/cve-2026-107181-poc" } ], "references": [ "https://github.com/SeanDishman/telegram-cve-2026-107181", "https://github.com/00nx/telegram-account-takeover-poc", "https://github.com/abdugafforov-bobur/cve-2026-107181-poc" ], "timeline": [ { "at": "2026-10-13T22:00:00Z", "label": "Discovered through PoC-in-GitHub", "url": "https://github.com/SeanDishman/telegram-cve-2026-107181" } ] }, { "id": "CVE-2026-107169", "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "title": "Red Hat Enterprise Linux 10 vulnerability", "summary": "A flaw was found in m17n-lib. An attacker could provide specially crafted or truncated UTF-8 input to trigger an unhandled null pointer dereference during text processing. This issue causes the application to crash unexpectedly, resulting in a Denial of Service (DoS).", "updated_at": "2026-10-10T03:17:05.650", "published_at": "2026-10-07T15:17:19.023", "cvss": 6.2, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-476", "what_happened": "A flaw was found in m17n-lib. An attacker could provide specially crafted or truncated UTF-8 input to trigger an unhandled null pointer dereference during text processing. This issue causes the application to crash unexpectedly, resulting in a Denial of Service (DoS).", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://access.redhat.com/security/cve/CVE-2026-107169", "https://bugzilla.redhat.com/show_bug.cgi?id=2547410" ], "timeline": [ { "at": "2026-10-07T15:17:19.023", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107169" } ] }, { "id": "CVE-2026-107162", "vendor": "ExpressGateway", "product": "express-gateway", "title": "express-gateway vulnerability", "summary": "Express Gateway through 1.16.11 contains an authentication bypass vulnerability in the OAuth 2.0 refresh_token grant that fails to validate the token secret or issuing client. Attackers with any valid client credentials and the identifier portion of another user's refresh token can obtain that user's access token and impersonate them against oauth2-protected APIs.", "updated_at": "2026-10-10T03:17:05.480", "published_at": "2026-10-07T13:17:19.963", "cvss": 7.6, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.16.11 (semver)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "High", "cwe": "CWE-287", "what_happened": "Express Gateway through 1.16.11 contains an authentication bypass vulnerability in the OAuth 2.0 refresh_token grant that fails to validate the token secret or issuing client. Attackers with any valid client credentials and the identifier portion of another user's refresh token can obtain that user's access token and impersonate them against oauth2-protected APIs.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/ExpressGateway/express-gateway", "https://github.com/ExpressGateway/express-gateway/blob/45612814d12f65889ef3bdf80b2ed7ab9b557736/lib/policies/oauth2/oauth2-server.js#L221-L247", "https://github.com/ExpressGateway/express-gateway/blob/45612814d12f65889ef3bdf80b2ed7ab9b557736/lib/services/tokens/token.service.js#L100-L136", "https://github.com/ExpressGateway/express-gateway/issues/1076", "https://www.vulncheck.com/advisories/express-gateway-through-1.16.11-oauth-2.0-refresh-token-validation-bypass" ], "timeline": [ { "at": "2026-10-07T13:17:19.963", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107162" } ] }, { "id": "CVE-2026-107161", "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "title": "Red Hat Enterprise Linux 10 vulnerability", "summary": "A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application.", "updated_at": "2026-10-10T03:17:05.307", "published_at": "2026-10-07T20:17:10.977", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-122", "what_happened": "A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://access.redhat.com/security/cve/CVE-2026-107161", "https://bugzilla.redhat.com/show_bug.cgi?id=2460420", "http://www.openwall.com/lists/oss-security/2026/10/09/20" ], "timeline": [ { "at": "2026-10-07T20:17:10.977", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107161" } ] }, { "id": "CVE-2026-107151", "vendor": "Red Hat", "product": "Red Hat Satellite 6", "title": "Red Hat Satellite 6 vulnerability", "summary": "Missing authentication has been found in remote-execution task updates in the smart_proxy_dynflow package. The progress and completion callbacks accept a report when the one-time token is missing. A network attacker or user must already know the identifier of a running job. This applies when remote execution is set to pull or pull-mqtt mode. They can send their own job output and mark the job as a success or a failure. The job is then recorded with that result.", "updated_at": "2026-10-10T03:17:05.187", "published_at": "2026-10-07T13:17:19.783", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-306", "what_happened": "Missing authentication has been found in remote-execution task updates in the smart_proxy_dynflow package. The progress and completion callbacks accept a report when the one-time token is missing. A network attacker or user must already know the identifier of a running job. This applies when remote execution is set to pull or pull-mqtt mode. They can send their own job output and mark the job as a success or a failure. The job is then recorded with that result.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://access.redhat.com/security/cve/CVE-2026-107151", "https://bugzilla.redhat.com/show_bug.cgi?id=2547357" ], "timeline": [ { "at": "2026-10-07T13:17:19.783", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107151" } ] }, { "id": "CVE-2026-107120", "vendor": "Unknown", "product": "Contest Gallery", "title": "Contest Gallery vulnerability", "summary": "The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to an email address they do not own, gaining an authenticated session.", "updated_at": "2026-10-10T12:16:46.377", "published_at": "2026-10-10T06:16:40.903", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "before 33.0.1 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-287", "what_happened": "The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to an email address they do not own, gaining an authenticated session.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/13853303-741e-4f87-8543-d5d825d20e8e/" ], "timeline": [ { "at": "2026-10-10T06:16:40.903", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107120" } ] }, { "id": "CVE-2026-107083", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Exploit for CVE-2026-107083", "summary": "Authenticated staff can perform SQL Injection in SLiMS admin modules.", "updated_at": "2026-10-16T23:52:37Z", "published_at": "2026-10-16T23:52:37Z", "cvss": 6.2, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 31, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "CWE-89", "what_happened": "Authenticated staff can perform SQL Injection in SLiMS admin modules.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for CVE-2026-107083", "summary": "Authenticated staff can perform SQL Injection in SLiMS admin modules.", "what_happened": "Authenticated staff can perform SQL Injection in SLiMS admin modules.", "cvss": 6.2, "cvss_vector": "NONE", "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "CWE-89", "references": [ "https://sploitus.com/exploit?id=0F20447F-6BB2-51DB-97FC-B2A60C895392", "https://github.com/Primandito/CVE-2026-107083" ], "repository": "Sploitus", "author": "Primandito", "first_seen": "2026-10-17T01:52:37", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=0F20447F-6BB2-51DB-97FC-B2A60C895392" }, { "title": "Exploit for CVE-2026-107083", "summary": "Authenticated staff can perform SQL Injection in SLiMS admin modules.", "what_happened": "Authenticated staff can perform SQL Injection in SLiMS admin modules.", "cvss": 6.2, "cvss_vector": "NONE", "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "CWE-89", "references": [ "https://sploitus.com/exploit?id=0F20447F-6BB2-51DB-97FC-B2A60C895392", "https://github.com/Primandito/CVE-2026-107083" ], "repository": "Primandito/CVE-2026-107083", "author": "Primandito", "first_seen": "2026-10-17T01:52:37", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://github.com/Primandito/CVE-2026-107083" } ], "references": [ "https://sploitus.com/exploit?id=0F20447F-6BB2-51DB-97FC-B2A60C895392", "https://github.com/Primandito/CVE-2026-107083" ], "timeline": [ { "at": "2026-10-16T23:52:37Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=0F20447F-6BB2-51DB-97FC-B2A60C895392" } ], "cvss_vector": "NONE" }, { "id": "CVE-2026-107082", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Exploit for CVE-2026-107082", "summary": "Authenticated staff can perform SQL Injection in SLiMS Admin Bibliography Module.", "updated_at": "2026-10-16T23:52:37Z", "published_at": "2026-10-16T23:52:37Z", "cvss": 6.2, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 61, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "CWE-89", "what_happened": "Authenticated staff can perform SQL Injection in SLiMS Admin Bibliography Module.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for CVE-2026-107082", "summary": "Authenticated staff can perform SQL Injection in SLiMS Admin Bibliography Module.", "what_happened": "Authenticated staff can perform SQL Injection in SLiMS Admin Bibliography Module.", "cvss": 6.2, "cvss_vector": "NONE", "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "CWE-89", "references": [ "https://sploitus.com/exploit?id=F78DE10F-26DB-520D-98DF-09187D1BCE88", "https://github.com/Primandito/CVE-2026-107082" ], "repository": "Sploitus", "author": "Primandito", "first_seen": "2026-10-17T01:43:16", "confidence": "High", "verification": "verified", "verified": true, "verification_detail": "Sploitus reports working code with at least 90% confidence.", "url": "https://sploitus.com/exploit?id=F78DE10F-26DB-520D-98DF-09187D1BCE88" }, { "title": "Exploit for CVE-2026-107083", "summary": "Authenticated staff can perform SQL Injection in SLiMS admin modules.", "what_happened": "Authenticated staff can perform SQL Injection in SLiMS admin modules.", "cvss": 6.2, "cvss_vector": "NONE", "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "CWE-89", "references": [ "https://sploitus.com/exploit?id=0F20447F-6BB2-51DB-97FC-B2A60C895392", "https://github.com/Primandito/CVE-2026-107083" ], "repository": "Sploitus", "author": "Primandito", "first_seen": "2026-10-17T01:52:37", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=0F20447F-6BB2-51DB-97FC-B2A60C895392" }, { "title": "Exploit for CVE-2026-107083", "summary": "Authenticated staff can perform SQL Injection in SLiMS admin modules.", "what_happened": "Authenticated staff can perform SQL Injection in SLiMS admin modules.", "cvss": 6.2, "cvss_vector": "NONE", "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "CWE-89", "references": [ "https://sploitus.com/exploit?id=0F20447F-6BB2-51DB-97FC-B2A60C895392", "https://github.com/Primandito/CVE-2026-107083" ], "repository": "Primandito/CVE-2026-107083", "author": "Primandito", "first_seen": "2026-10-17T01:52:37", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://github.com/Primandito/CVE-2026-107083" }, { "title": "Exploit for CVE-2026-107082", "summary": "Authenticated staff can perform SQL Injection in SLiMS Admin Bibliography Module.", "what_happened": "Authenticated staff can perform SQL Injection in SLiMS Admin Bibliography Module.", "cvss": 6.2, "cvss_vector": "NONE", "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "CWE-89", "references": [ "https://sploitus.com/exploit?id=F78DE10F-26DB-520D-98DF-09187D1BCE88", "https://github.com/Primandito/CVE-2026-107082" ], "repository": "Primandito/CVE-2026-107082", "author": "Primandito", "first_seen": "2026-10-17T01:43:16", "confidence": "High", "verification": "verified", "verified": true, "verification_detail": "Linked by a Sploitus working-code assessment.", "url": "https://github.com/Primandito/CVE-2026-107082" } ], "references": [ "https://sploitus.com/exploit?id=F78DE10F-26DB-520D-98DF-09187D1BCE88", "https://sploitus.com/exploit?id=0F20447F-6BB2-51DB-97FC-B2A60C895392", "https://github.com/Primandito/CVE-2026-107083", "https://github.com/Primandito/CVE-2026-107082" ], "timeline": [ { "at": "2026-10-16T23:52:37Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=F78DE10F-26DB-520D-98DF-09187D1BCE88" } ], "cvss_vector": "NONE" }, { "id": "CVE-2026-107081", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Exploit for CVE-2026-107083", "summary": "Authenticated staff can perform SQL Injection in SLiMS admin modules.", "updated_at": "2026-10-16T23:52:37Z", "published_at": "2026-10-16T23:52:37Z", "cvss": 6.2, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 61, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "CWE-89", "what_happened": "Authenticated staff can perform SQL Injection in SLiMS admin modules.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for CVE-2026-107083", "summary": "Authenticated staff can perform SQL Injection in SLiMS admin modules.", "what_happened": "Authenticated staff can perform SQL Injection in SLiMS admin modules.", "cvss": 6.2, "cvss_vector": "NONE", "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "CWE-89", "references": [ "https://sploitus.com/exploit?id=0F20447F-6BB2-51DB-97FC-B2A60C895392", "https://github.com/Primandito/CVE-2026-107083" ], "repository": "Sploitus", "author": "Primandito", "first_seen": "2026-10-17T01:52:37", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=0F20447F-6BB2-51DB-97FC-B2A60C895392" }, { "title": "Exploit for CVE-2026-107083", "summary": "Authenticated staff can perform SQL Injection in SLiMS admin modules.", "what_happened": "Authenticated staff can perform SQL Injection in SLiMS admin modules.", "cvss": 6.2, "cvss_vector": "NONE", "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "CWE-89", "references": [ "https://sploitus.com/exploit?id=0F20447F-6BB2-51DB-97FC-B2A60C895392", "https://github.com/Primandito/CVE-2026-107083" ], "repository": "Primandito/CVE-2026-107083", "author": "Primandito", "first_seen": "2026-10-17T01:52:37", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://github.com/Primandito/CVE-2026-107083" }, { "title": "Exploit for CVE-2026-107082", "summary": "Authenticated staff can perform SQL Injection in SLiMS Admin Bibliography Module.", "what_happened": "Authenticated staff can perform SQL Injection in SLiMS Admin Bibliography Module.", "cvss": 6.2, "cvss_vector": "NONE", "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "CWE-89", "references": [ "https://sploitus.com/exploit?id=F78DE10F-26DB-520D-98DF-09187D1BCE88", "https://github.com/Primandito/CVE-2026-107082" ], "repository": "Sploitus", "author": "Primandito", "first_seen": "2026-10-17T01:43:16", "confidence": "High", "verification": "verified", "verified": true, "verification_detail": "Sploitus reports working code with at least 90% confidence.", "url": "https://sploitus.com/exploit?id=F78DE10F-26DB-520D-98DF-09187D1BCE88" }, { "title": "Exploit for CVE-2026-107082", "summary": "Authenticated staff can perform SQL Injection in SLiMS Admin Bibliography Module.", "what_happened": "Authenticated staff can perform SQL Injection in SLiMS Admin Bibliography Module.", "cvss": 6.2, "cvss_vector": "NONE", "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "CWE-89", "references": [ "https://sploitus.com/exploit?id=F78DE10F-26DB-520D-98DF-09187D1BCE88", "https://github.com/Primandito/CVE-2026-107082" ], "repository": "Primandito/CVE-2026-107082", "author": "Primandito", "first_seen": "2026-10-17T01:43:16", "confidence": "High", "verification": "verified", "verified": true, "verification_detail": "Linked by a Sploitus working-code assessment.", "url": "https://github.com/Primandito/CVE-2026-107082" } ], "references": [ "https://sploitus.com/exploit?id=0F20447F-6BB2-51DB-97FC-B2A60C895392", "https://github.com/Primandito/CVE-2026-107083", "https://sploitus.com/exploit?id=F78DE10F-26DB-520D-98DF-09187D1BCE88", "https://github.com/Primandito/CVE-2026-107082" ], "timeline": [ { "at": "2026-10-16T23:52:37Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=0F20447F-6BB2-51DB-97FC-B2A60C895392" } ], "cvss_vector": "NONE" }, { "id": "CVE-2026-106931", "vendor": "EG Secure Solutions", "product": "SiteGuard Server Edition", "title": "EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability", "summary": "EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.", "updated_at": "2026-10-19T22:00:00Z", "published_at": "2026-10-19T22:00:00Z", "cvss": 0, "confidence": 65, "confidence_label": "observed", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": true, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [], "references": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" ], "timeline": [ { "at": "2026-10-19T22:00:00Z", "label": "Discovered through CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-10-20", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2026-106634", "vendor": "Adobe", "product": "Adobe Experience Manager 6.5 LTS", "title": "Adobe Experience Manager 6.5 LTS vulnerability", "summary": "Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system write. A low-privileged attacker could leverage this vulnerability to write files to unauthorized locations on the file system. Exploitation of this issue does not require user interaction. Scope is changed.", "updated_at": "2026-10-17T02:17:13.320", "published_at": "2026-10-13T20:17:17.103", "cvss": 7.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 6.5 LTS SP3 (custom); 0 through 6.5.25 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-22", "what_happened": "Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system write. A low-privileged attacker could leverage this vulnerability to write files to unauthorized locations on the file system. Exploitation of this issue does not require user interaction. Scope is changed.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://helpx.adobe.com/security/products/experience-manager/apsb26-152.html" ], "timeline": [ { "at": "2026-10-13T20:17:17.103", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106634" } ] }, { "id": "CVE-2026-106629", "vendor": "Adobe", "product": "Adobe Experience Manager 6.5 LTS", "title": "Adobe Experience Manager 6.5 LTS vulnerability", "summary": "Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.", "updated_at": "2026-10-17T02:17:13.180", "published_at": "2026-10-13T20:17:16.507", "cvss": 9.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 6.5 LTS SP3 (custom); 0 through 6.5.25 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://helpx.adobe.com/security/products/experience-manager/apsb26-152.html" ], "timeline": [ { "at": "2026-10-13T20:17:16.507", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106629" } ] }, { "id": "CVE-2026-106623", "vendor": "Adobe", "product": "ColdFusion 2025", "title": "ColdFusion 2025 vulnerability", "summary": "ColdFusion is affected by an Incorrect Authorization vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction.", "updated_at": "2026-10-17T02:17:13.063", "published_at": "2026-10-13T21:17:31.597", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2025.0.13 (custom); 0 through 2023.0.25 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-863", "what_happened": "ColdFusion is affected by an Incorrect Authorization vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html" ], "timeline": [ { "at": "2026-10-13T21:17:31.597", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106623" } ] }, { "id": "CVE-2026-106610", "vendor": "miniOrange", "product": "miniorange otp verification", "title": "miniorange otp verification vulnerability", "summary": "Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7.", "updated_at": "2026-10-10T19:16:57.187", "published_at": "2026-10-10T19:16:57.187", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "0 through 5.5.7 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-266", "what_happened": "Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/miniorange-otp-verification/vulnerability/wordpress-miniorange-otp-verification-plugin-5-5-7-privilege-escalation-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-10-10T19:16:57.187", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106610" } ] }, { "id": "CVE-2026-106609", "vendor": "Web Impian", "product": "Bayarcash WooCommerce", "title": "Bayarcash WooCommerce vulnerability", "summary": "Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through 4.4.2.", "updated_at": "2026-10-10T17:17:00.310", "published_at": "2026-10-10T17:17:00.310", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 4.4.2 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through 4.4.2.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/bayarcash-wc/vulnerability/wordpress-bayarcash-woocommerce-plugin-4-4-2-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-10-10T17:17:00.310", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106609" } ] }, { "id": "CVE-2026-106608", "vendor": "Automattic", "product": "WooCommerce", "title": "WooCommerce vulnerability", "summary": "Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from 9.8.0 through 11.1.2.", "updated_at": "2026-10-10T17:17:00.190", "published_at": "2026-10-10T17:17:00.190", "cvss": 7.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "9.8.0 through 11.1.2 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-266", "what_happened": "Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from 9.8.0 through 11.1.2.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/woocommerce/vulnerability/wordpress-woocommerce-plugin-9-8-0-11-1-2-privilege-escalation-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-10-10T17:17:00.190", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106608" } ] }, { "id": "CVE-2026-106606", "vendor": "YITH", "product": "YITH WooCommerce Affiliates", "title": "YITH WooCommerce Affiliates vulnerability", "summary": "Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affiliates yith-woocommerce-affiliates allows Object Injection.This issue affects YITH WooCommerce Affiliates: from n/a through 3.31.0.", "updated_at": "2026-10-10T08:17:04.353", "published_at": "2026-10-10T08:17:04.353", "cvss": 7.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "0 through 3.31.0 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-502", "what_happened": "Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affiliates yith-woocommerce-affiliates allows Object Injection.This issue affects YITH WooCommerce Affiliates: from n/a through 3.31.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/yith-woocommerce-affiliates/vulnerability/wordpress-yith-woocommerce-affiliates-plugin-3-31-0-php-object-injection-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-10-10T08:17:04.353", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106606" } ] }, { "id": "CVE-2026-106602", "vendor": "Automattic", "product": "Jetpack", "title": "Jetpack vulnerability", "summary": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2.", "updated_at": "2026-10-11T13:17:12.013", "published_at": "2026-10-09T13:17:09.930", "cvss": 4.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 16.2 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-288", "what_happened": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/jetpack/vulnerability/wordpress-jetpack-plugin-16-2-broken-authentication-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-10-09T13:17:09.930", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106602" } ] }, { "id": "CVE-2026-106578", "vendor": "ImageMagick", "product": "ImageMagick", "title": "ImageMagick vulnerability", "summary": "ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.", "updated_at": "2026-10-10T03:17:05.040", "published_at": "2026-10-07T16:17:44.217", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "confidence": 35, "confidence_label": "observed", "affected": "< 6.9.13-56; >= 7.0.0, < 7.1.2-31", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-590", "what_happened": "ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/ImageMagick/ImageMagick/commit/5d29c094020612dc8fb471b10fc1d1cc6e9e4378", "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31", "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6xf5-c3jx-rp39", "https://github.com/ImageMagick/ImageMagick6/commit/bfe0117fd9742b3970383e000978d64e5e04372d", "https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56" ], "timeline": [ { "at": "2026-10-07T16:17:44.217", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106578" } ] }, { "id": "CVE-2026-106573", "vendor": "ImageMagick", "product": "ImageMagick", "title": "ImageMagick vulnerability", "summary": "ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.", "updated_at": "2026-10-10T03:17:04.897", "published_at": "2026-10-07T16:17:43.263", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "confidence": 35, "confidence_label": "observed", "affected": "< 6.9.13-56; >= 7.0.0, < 7.1.2-31", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-400", "what_happened": "ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and 6.9.13-56.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/ImageMagick/ImageMagick/commit/c311471c4e4978494834c707b417bc033d95cc48", "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-31", "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qr53-hc3p-fc62", "https://github.com/ImageMagick/ImageMagick6/commit/49560a1641f72a127e413b9861eca0997fde2b96", "https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-56" ], "timeline": [ { "at": "2026-10-07T16:17:43.263", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106573" } ] }, { "id": "CVE-2026-106568", "vendor": "ImageMagick", "product": "ImageMagick", "title": "ImageMagick vulnerability", "summary": "ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32 and 6.9.13-57.", "updated_at": "2026-10-10T03:17:04.750", "published_at": "2026-10-07T16:17:41.143", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "confidence": 35, "confidence_label": "observed", "affected": "< 6.9.13-57; >= 7.0.0, < 7.1.2-32", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-835", "what_happened": "ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32 and 6.9.13-57.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/ImageMagick/ImageMagick/commit/e4f7ad983df6c831832eba3689f96b75f8b67051", "https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32", "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9p7q-63hw-mcr4", "https://github.com/ImageMagick/ImageMagick6/commit/27e36ca5cb446664bfc284d28d91fced8887b025", "https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57" ], "timeline": [ { "at": "2026-10-07T16:17:41.143", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106568" } ] }, { "id": "CVE-2026-106563", "vendor": "backstage", "product": "backstage", "title": "backstage vulnerability", "summary": "Backstage is an open framework for building developer portals. Prior to 0.21.8, the @backstage/plugin-kubernetes-backend package is affected by improper entity validation in deprecated kubernetes services endpoint. An authenticated user with Kubernetes read permissions could access Kubernetes workload data beyond their intended scope by supplying crafted entity data to the deprecated services endpoint. The exposure is limited to read-only access to Kubernetes object metadata across configured clusters. This issue is fixed in version 0.21.8.", "updated_at": "2026-10-10T03:17:04.603", "published_at": "2026-10-07T15:17:17.860", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "< 1.54.1; < 0.21.8", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "High", "cwe": "CWE-20", "what_happened": "Backstage is an open framework for building developer portals. Prior to 0.21.8, the @backstage/plugin-kubernetes-backend package is affected by improper entity validation in deprecated kubernetes services endpoint. An authenticated user with Kubernetes read permissions could access Kubernetes workload data beyond their intended scope by supplying crafted entity data to the deprecated services endpoint. The exposure is limited to read-only access to Kubernetes object metadata across configured clusters. This issue is fixed in version 0.21.8.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/backstage/backstage/commit/2d5d3e77d630455d6d48cfa8f31fd3c126fd6f29", "https://github.com/backstage/backstage/releases/tag/v1.54.1", "https://github.com/backstage/backstage/security/advisories/GHSA-r9ph-3637-55px" ], "timeline": [ { "at": "2026-10-07T15:17:17.860", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106563" } ] }, { "id": "CVE-2026-106558", "vendor": "backstage", "product": "backstage", "title": "backstage vulnerability", "summary": "Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdown_extensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation source may bypass TechDocs sanitization and cause Python objects to be imported and instantiated in the generator runtime, leading to arbitrary code execution. Earlier fixes in versions 1.14.6 and 1.15.4 did not fully address the supported mapping representation of markdown_extensions. Impact is greatest when documentation generation runs with backend credentials, filesystem access, or internal network access. This issue is fixed in versions 1.14.8, 1.15.6, and 2.0.1.", "updated_at": "2026-10-10T03:17:04.400", "published_at": "2026-10-07T15:17:15.713", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "< 1.50.7; >= 1.51.0-next.0, < 1.54.9; >= 1.55.0-next.0, < 1.55.2; < 1.14.8; >= 1.15.0, < 1.15.6; >= 2.0.0, < 2.0.1", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-502", "what_happened": "Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdown_extensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation source may bypass TechDocs sanitization and cause Python objects to be imported and instantiated in the generator runtime, leading to arbitrary code execution. Earlier fixes in versions 1.14.6 and 1.15.4 did not fully address the supported mapping representation of markdown_extensions. Impact is greatest when documentation generation runs with backend credentials, filesystem access, or internal network access. This issue is fixed in versions 1.14.8, 1.15.6, and 2.0.1.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/backstage/backstage/commit/32723a0fe4e12ed80535fc65d5331765c55aa91b", "https://github.com/backstage/backstage/commit/944edb51c8524d3664b18f2d57ba101b1c93b709", "https://github.com/backstage/backstage/commit/f18e9abcc6051491862b15e4fc60e69f8d52310c", "https://github.com/backstage/backstage/releases/tag/v1.50.7", "https://github.com/backstage/backstage/releases/tag/v1.54.9", "https://github.com/backstage/backstage/releases/tag/v1.55.2", "https://github.com/backstage/backstage/security/advisories/GHSA-qmw3-745m-w99g" ], "timeline": [ { "at": "2026-10-07T15:17:15.713", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106558" } ] }, { "id": "CVE-2026-106445", "vendor": "handlebars-lang", "product": "handlebars.js", "title": "Exploit for CVE-2026-106445", "summary": "Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker can render a controlled template with allowProtoMethodsByDefault enabled and an accessible function in the template context, the template can traverse from that function through its prototype to Function.prototype and then obtain the Function constructor through the own-property bypass. This permits attacker-controlled JavaScript to execute with the server application's privileges. This issue is fixed in version 4.7.10.", "updated_at": "2026-10-09T02:16:59.703", "published_at": "2026-10-06T20:17:26.293", "cvss": 9.2, "confidence": 100, "confidence_label": "verified", "affected": ">= 4.0.0, < 4.7.10", "fixed": "See vendor advisory", "source_count": 79, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-184", "what_happened": "Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker can render a controlled template with allowProtoMethodsByDefault enabled and an accessible function in the template context, the template can traverse from that function through its prototype to Function.prototype and then obtain the Function constructor through the own-property bypass. This permits attacker-controlled JavaScript to execute with the server application's privileges. This issue is fixed in version 4.7.10.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for CVE-2026-106445", "summary": "Sandbox escape in Handlebars.js allows RCE when allowProtoMethodsByDefault is true.", "what_happened": "Sandbox escape in Handlebars.js allows RCE when allowProtoMethodsByDefault is true.", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-184", "references": [ "https://sploitus.com/exploit?id=30A77426-D6AC-5C2B-932F-9AE28F883FD3", "https://github.com/murrez/CVE-2026-106445" ], "repository": "Sploitus", "author": "murrez", "first_seen": "2026-10-10T08:25:40", "confidence": "High", "verification": "verified", "verified": true, "verification_detail": "Sploitus reports working code with at least 90% confidence.", "url": "https://sploitus.com/exploit?id=30A77426-D6AC-5C2B-932F-9AE28F883FD3" }, { "repository": "murrez/CVE-2026-106445", "author": "murrez", "first_seen": "2026-10-10", "confidence": "High", "verification": "verified", "verified": true, "stars": 3, "title": "CVE-2026-106445 — Handlebars 4.0.0–4.7.9 RCE via Function.prototype.constructor bypass (GHSA-p8wg-vrv2-v86f). PoCbit PoC + Docker lab (4.7.9), check/exploit HTTP client, GHSA template chain. Fixed 4.7.10. https://pocbit.org/pocs/cve-2026-106445", "summary": "CVE-2026-106445 — Handlebars 4.0.0–4.7.9 RCE via Function.prototype.constructor bypass (GHSA-p8wg-vrv2-v86f). PoCbit PoC + Docker lab (4.7.9), check/exploit HTTP client, GHSA template chain. Fixed 4.7.10. https://pocbit.org/pocs/cve-2026-106445", "url": "https://github.com/murrez/CVE-2026-106445" } ], "references": [ "https://sploitus.com/exploit?id=30A77426-D6AC-5C2B-932F-9AE28F883FD3", "https://github.com/murrez/CVE-2026-106445", "https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa", "https://github.com/handlebars-lang/handlebars.js/pull/2185", "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10", "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f" ], "timeline": [ { "at": "2026-10-10T06:25:40Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=30A77426-D6AC-5C2B-932F-9AE28F883FD3" }, { "at": "2026-10-06T20:17:26.293", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106445" } ], "enrichment_checked_at": "2026-10-10T10:05:24Z", "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "id": "CVE-2026-106418", "vendor": "Google", "product": "Chrome", "title": "Chrome vulnerability", "summary": "Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)", "updated_at": "2026-10-09T22:16:59.290", "published_at": "2026-10-06T19:18:11.557", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "155.0.8059.39 through before 155.0.8059.39 (custom)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html", "https://issues.chromium.org/issues/553283471" ], "timeline": [ { "at": "2026-10-06T19:18:11.557", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106418" } ] }, { "id": "CVE-2026-106385", "vendor": "Google", "product": "Chrome", "title": "Chrome vulnerability", "summary": "Race condition in Chromoting in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)", "updated_at": "2026-10-09T22:16:59.100", "published_at": "2026-10-06T19:18:07.740", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "155.0.8059.39 through before 155.0.8059.39 (custom)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-362", "what_happened": "Race condition in Chromoting in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html", "https://issues.chromium.org/issues/554874487" ], "timeline": [ { "at": "2026-10-06T19:18:07.740", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106385" } ] }, { "id": "CVE-2026-106381", "vendor": "Google", "product": "Chrome", "title": "Chrome vulnerability", "summary": "Incorrect authorization in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)", "updated_at": "2026-10-09T22:16:58.790", "published_at": "2026-10-06T19:18:07.297", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "155.0.8059.39 through before 155.0.8059.39 (custom)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-863", "what_happened": "Incorrect authorization in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html", "https://issues.chromium.org/issues/501763586" ], "timeline": [ { "at": "2026-10-06T19:18:07.297", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106381" } ] }, { "id": "CVE-2026-106365", "vendor": "Google", "product": "Chrome", "title": "Chrome vulnerability", "summary": "Missing authorization in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)", "updated_at": "2026-10-09T22:16:58.560", "published_at": "2026-10-06T19:18:05.507", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "155.0.8059.39 through before 155.0.8059.39 (custom)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing authorization in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html", "https://issues.chromium.org/issues/498075038" ], "timeline": [ { "at": "2026-10-06T19:18:05.507", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106365" } ] }, { "id": "CVE-2026-106362", "vendor": "Google", "product": "Chrome", "title": "Chrome vulnerability", "summary": "Missing authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)", "updated_at": "2026-10-09T22:16:58.373", "published_at": "2026-10-06T19:18:05.183", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "155.0.8059.39 through before 155.0.8059.39 (custom)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html", "https://issues.chromium.org/issues/514456975" ], "timeline": [ { "at": "2026-10-06T19:18:05.183", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106362" } ] }, { "id": "CVE-2026-106331", "vendor": "Google", "product": "Chrome", "title": "Chrome vulnerability", "summary": "Improper input validation in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted Chrome extension. (Chromium security severity: Low)", "updated_at": "2026-10-09T22:16:58.137", "published_at": "2026-10-06T19:18:01.470", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "155.0.8059.39 through before 155.0.8059.39 (custom)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-20", "what_happened": "Improper input validation in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted Chrome extension. (Chromium security severity: Low)", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html", "https://issues.chromium.org/issues/553256068" ], "timeline": [ { "at": "2026-10-06T19:18:01.470", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106331" } ] }, { "id": "CVE-2026-106297", "vendor": "Google", "product": "Chrome", "title": "Chrome vulnerability", "summary": "Incorrect authorization in Scheduling in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)", "updated_at": "2026-10-09T22:16:57.913", "published_at": "2026-10-06T19:17:57.690", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "155.0.8059.39 through before 155.0.8059.39 (custom)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-863", "what_happened": "Incorrect authorization in Scheduling in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html", "https://issues.chromium.org/issues/513735469" ], "timeline": [ { "at": "2026-10-06T19:17:57.690", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106297" } ] }, { "id": "CVE-2026-106294", "vendor": "Google", "product": "Chrome", "title": "Chrome vulnerability", "summary": "Incomplete cleanup in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)", "updated_at": "2026-10-09T22:16:57.713", "published_at": "2026-10-06T19:17:57.347", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "confidence": 35, "confidence_label": "observed", "affected": "155.0.8059.39 through before 155.0.8059.39 (custom)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-459", "what_happened": "Incomplete cleanup in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html", "https://issues.chromium.org/issues/556215048" ], "timeline": [ { "at": "2026-10-06T19:17:57.347", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106294" } ] }, { "id": "CVE-2026-106287", "vendor": "Google", "product": "Chrome", "title": "Chrome vulnerability", "summary": "Information loss in CORS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)", "updated_at": "2026-10-09T22:16:57.520", "published_at": "2026-10-06T19:17:56.497", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "155.0.8059.39 through before 155.0.8059.39 (custom)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-221", "what_happened": "Information loss in CORS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html", "https://issues.chromium.org/issues/513518289" ], "timeline": [ { "at": "2026-10-06T19:17:56.497", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106287" } ] }, { "id": "CVE-2026-106286", "vendor": "Google", "product": "Chrome", "title": "Chrome vulnerability", "summary": "Confused deputy in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium)", "updated_at": "2026-10-09T22:16:57.313", "published_at": "2026-10-06T19:17:56.387", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "155.0.8059.39 through before 155.0.8059.39 (custom)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-441", "what_happened": "Confused deputy in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium)", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html", "https://issues.chromium.org/issues/497148613" ], "timeline": [ { "at": "2026-10-06T19:17:56.387", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106286" } ] }, { "id": "CVE-2026-106267", "vendor": "Google", "product": "Chrome", "title": "Chrome vulnerability", "summary": "Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)", "updated_at": "2026-10-09T22:16:57.127", "published_at": "2026-10-06T19:17:54.223", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "155.0.8059.39 through before 155.0.8059.39 (custom)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html", "https://issues.chromium.org/issues/498737756" ], "timeline": [ { "at": "2026-10-06T19:17:54.223", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106267" } ] }, { "id": "CVE-2026-106266", "vendor": "Google", "product": "Chrome", "title": "Chrome vulnerability", "summary": "Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)", "updated_at": "2026-10-09T22:16:56.927", "published_at": "2026-10-06T19:17:54.110", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "155.0.8059.39 through before 155.0.8059.39 (custom)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-441", "what_happened": "Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html", "https://issues.chromium.org/issues/501914204" ], "timeline": [ { "at": "2026-10-06T19:17:54.110", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106266" } ] }, { "id": "CVE-2026-106237", "vendor": "Google", "product": "Chrome", "title": "Chrome vulnerability", "summary": "Information leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)", "updated_at": "2026-10-09T22:16:56.753", "published_at": "2026-10-06T19:17:50.577", "cvss": 9.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L", "confidence": 35, "confidence_label": "observed", "affected": "155.0.8059.39 through before 155.0.8059.39 (custom)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-200", "what_happened": "Information leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html", "https://issues.chromium.org/issues/553255283" ], "timeline": [ { "at": "2026-10-06T19:17:50.577", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106237" } ] }, { "id": "CVE-2026-106195", "vendor": "Google", "product": "Chrome", "title": "Chrome vulnerability", "summary": "Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)", "updated_at": "2026-10-09T22:16:56.557", "published_at": "2026-10-06T19:17:45.673", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "155.0.8059.39 through before 155.0.8059.39 (custom)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-863", "what_happened": "Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html", "https://issues.chromium.org/issues/553930843" ], "timeline": [ { "at": "2026-10-06T19:17:45.673", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106195" } ] }, { "id": "CVE-2026-106173", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Exploit for CVE-2026-106173", "summary": "Proof-of-concept exploit for CVE-2026-106173. CVSS 9.8.", "updated_at": "2026-10-20T12:29:09Z", "published_at": "2026-10-20T12:29:09Z", "cvss": 9.8, "confidence": 80, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Unauthenticated remote code execution in Fortinet FortiSIEM via gRPC path traversal.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for CVE-2026-106173", "summary": "Unauthenticated remote code execution in Fortinet FortiSIEM via gRPC path traversal.", "what_happened": "Unauthenticated remote code execution in Fortinet FortiSIEM via gRPC path traversal.", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=1326F40E-3854-5189-8341-0063F7F5B205", "https://github.com/horizon3ai/CVE-2026-106173" ], "repository": "Sploitus", "author": "horizon3ai", "first_seen": "2026-10-20T12:45:02", "confidence": "High", "verification": "verified", "verified": true, "verification_detail": "Sploitus reports working code with at least 90% confidence.", "url": "https://sploitus.com/exploit?id=1326F40E-3854-5189-8341-0063F7F5B205" }, { "title": "Exploit for CVE-2026-106173", "summary": "Unauthenticated remote code execution in Fortinet FortiSIEM via gRPC path traversal.", "what_happened": "Unauthenticated remote code execution in Fortinet FortiSIEM via gRPC path traversal.", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=1326F40E-3854-5189-8341-0063F7F5B205", "https://github.com/horizon3ai/CVE-2026-106173" ], "repository": "horizon3ai/CVE-2026-106173", "author": "horizon3ai", "first_seen": "2026-10-20T12:45:02", "confidence": "High", "verification": "verified", "verified": true, "verification_detail": "Linked by a Sploitus working-code assessment.", "url": "https://github.com/horizon3ai/CVE-2026-106173" } ], "references": [ "https://sploitus.com/exploit?id=1326F40E-3854-5189-8341-0063F7F5B205", "https://github.com/horizon3ai/CVE-2026-106173" ], "timeline": [ { "at": "2026-10-20T12:29:09Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=1326F40E-3854-5189-8341-0063F7F5B205" } ] }, { "id": "CVE-2026-106139", "vendor": "Progress Software", "product": "Kendo UI for Vue", "title": "Kendo UI for Vue vulnerability", "summary": "In Progress® Kendo UI for Vue (@progress/kendo-vue-charts) starting with version 2.5.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when the user hovers over the affected data point. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application.", "updated_at": "2026-10-10T10:16:43.933", "published_at": "2026-10-10T10:16:43.933", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "2.5.0 through before 10.1.0 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-80", "what_happened": "In Progress® Kendo UI for Vue (@progress/kendo-vue-charts) starting with version 2.5.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when the user hovers over the affected data point. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.telerik.com/kendo-vue-ui/components/knowledge-base/kb-security-chart-tooltip-xss-cve-2026-1061389" ], "timeline": [ { "at": "2026-10-10T10:16:43.933", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106139" } ] }, { "id": "CVE-2026-106138", "vendor": "Progress Software", "product": "KendoReact", "title": "KendoReact vulnerability", "summary": "In Progress® KendoReact (@progress/kendo-react-charts) starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when the user hovers over the affected data point. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application.", "updated_at": "2026-10-10T10:16:42.570", "published_at": "2026-10-10T10:16:42.570", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "1.1.0 through before 16.2.0 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-80", "what_happened": "In Progress® KendoReact (@progress/kendo-react-charts) starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when the user hovers over the affected data point. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.telerik.com/kendo-react-ui/components/knowledge-base/kb-security-chart-tooltip-xss-cve-2026-106138" ], "timeline": [ { "at": "2026-10-10T10:16:42.570", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106138" } ] }, { "id": "CVE-2026-106063", "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "title": "Red Hat Enterprise Linux 10 vulnerability", "summary": "A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. When exporting an image with extremely large width and height, the export path allocates a buffer using a 32-bit width * height (and bytes-per-pixel) product that can overflow. GEGL then writes the full uncompressed extent into the undersized buffer, after integer overflow in the allocation size", "updated_at": "2026-10-08T08:16:34.063", "published_at": "2026-10-06T20:17:17.090", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "High", "cwe": "CWE-119", "what_happened": "A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. When exporting an image with extremely large width and height, the export path allocates a buffer using a 32-bit width * height (and bytes-per-pixel) product that can overflow. GEGL then writes the full uncompressed extent into the undersized buffer, after integer overflow in the allocation size", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://access.redhat.com/security/cve/CVE-2026-106063", "https://bugzilla.redhat.com/show_bug.cgi?id=2546668" ], "timeline": [ { "at": "2026-10-06T20:17:17.090", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106063" } ] }, { "id": "CVE-2026-106062", "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "title": "Red Hat Enterprise Linux 10 vulnerability", "summary": "A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.", "updated_at": "2026-10-08T08:16:33.920", "published_at": "2026-10-06T21:17:04.903", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-119", "what_happened": "A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://access.redhat.com/security/cve/CVE-2026-106062", "https://bugzilla.redhat.com/show_bug.cgi?id=2546654" ], "timeline": [ { "at": "2026-10-06T21:17:04.903", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106062" } ] }, { "id": "CVE-2026-106061", "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "title": "Red Hat Enterprise Linux 10 vulnerability", "summary": "A flaw was found in GIMP’s X cursor (XMC) thumbnail loader. When GIMP generates a thumbnail for a crafted XMC file, it allocates a pixel buffer using a width * height size computed in 32-bit signed arithmetic. If that product overflows, the allocation is smaller than the true image extent. A subsequent GEGL buffer read uses the unwrapped dimensions and performs an out-of-bounds read on the heap, after integer overflow in the size calculation. This can crash GIMP or corrupt process memory.", "updated_at": "2026-10-08T08:16:33.557", "published_at": "2026-10-07T03:16:57.473", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-125", "what_happened": "A flaw was found in GIMP’s X cursor (XMC) thumbnail loader. When GIMP generates a thumbnail for a crafted XMC file, it allocates a pixel buffer using a width * height size computed in 32-bit signed arithmetic. If that product overflows, the allocation is smaller than the true image extent. A subsequent GEGL buffer read uses the unwrapped dimensions and performs an out-of-bounds read on the heap, after integer overflow in the size calculation. This can crash GIMP or corrupt process memory.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://access.redhat.com/security/cve/CVE-2026-106061", "https://bugzilla.redhat.com/show_bug.cgi?id=2546640" ], "timeline": [ { "at": "2026-10-07T03:16:57.473", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106061" } ] }, { "id": "CVE-2026-106059", "vendor": "gitahead", "product": "gitahead", "title": "gitahead vulnerability", "summary": "GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated unescaped into the Show in Finder AppleScript. Attackers can commit a file whose path contains a double quote followed by a do shell script payload, which runs as the victim user when Show in Finder is chosen.", "updated_at": "2026-10-10T03:17:04.260", "published_at": "2026-10-07T12:17:09.100", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.7.1 (semver)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-78", "what_happened": "GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated unescaped into the Show in Finder AppleScript. Attackers can commit a file whose path contains a double quote followed by a do shell script payload, which runs as the victim user when Show in Finder is chosen.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/gitahead/gitahead", "https://github.com/gitahead/gitahead/blob/v2.7.1/src/tools/ShowTool.cpp#L40-L48", "https://github.com/gitahead/gitahead/issues/663", "https://www.vulncheck.com/advisories/gitahead-through-2.7.1-on-macos-command-injection-via-show-in-finder-applescript" ], "timeline": [ { "at": "2026-10-07T12:17:09.100", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106059" } ] }, { "id": "CVE-2026-106029", "vendor": "Unknown", "product": "WeddingCity Lite", "title": "WeddingCity Lite vulnerability", "summary": "The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide.", "updated_at": "2026-10-11T07:17:22.963", "published_at": "2026-10-11T07:17:22.963", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.0.4 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/7a08e8fd-9795-4aac-b023-5e75b741400b/" ], "timeline": [ { "at": "2026-10-11T07:17:22.963", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106029" } ] }, { "id": "CVE-2026-105995", "vendor": "Unknown", "product": "Booking Package", "title": "Booking Package vulnerability", "summary": "The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens.", "updated_at": "2026-10-10T12:16:46.120", "published_at": "2026-10-10T06:16:40.793", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "before 1.7.30 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-200", "what_happened": "The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/a778a758-4c44-45d6-bd34-9668bba2a95c/" ], "timeline": [ { "at": "2026-10-10T06:16:40.793", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105995" } ] }, { "id": "CVE-2026-105990", "vendor": "Unknown", "product": "Accept PayPal Payments using Contact Form 7", "title": "Accept PayPal Payments using Contact Form 7 vulnerability", "summary": "The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data (name, email, telephone, postal address, message) and payment metadata of everyone who submitted a payment form.", "updated_at": "2026-10-10T12:16:45.870", "published_at": "2026-10-10T06:16:40.677", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "before 4.0.7 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-200", "what_happened": "The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data (name, email, telephone, postal address, message) and payment metadata of everyone who submitted a payment form.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/211d7613-a7e0-45f9-b262-66651aa4f535/" ], "timeline": [ { "at": "2026-10-10T06:16:40.677", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105990" } ] }, { "id": "CVE-2026-105989", "vendor": "Unknown", "product": "Accept PayPal Payments using Contact Form 7", "title": "Accept PayPal Payments using Contact Form 7 vulnerability", "summary": "The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7's status metadata onto arbitrary posts.", "updated_at": "2026-10-10T12:16:45.703", "published_at": "2026-10-10T06:16:40.547", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "before 4.0.7 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-862", "what_happened": "The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7's status metadata onto arbitrary posts.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/df2b15dd-1748-4dcf-8b4f-8c053dc0dd73/" ], "timeline": [ { "at": "2026-10-10T06:16:40.547", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105989" } ] }, { "id": "CVE-2026-105977", "vendor": "Unknown", "product": "Portfolio Filter Gallery", "title": "Portfolio Filter Gallery vulnerability", "summary": "The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor role and above to permanently delete certain media attachments belonging to other users, including administrators.", "updated_at": "2026-10-10T12:16:45.553", "published_at": "2026-10-10T06:16:40.427", "cvss": 2.2, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "2.0.2 through before 2.2.1 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "High", "cwe": "CWE-639", "what_happened": "The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor role and above to permanently delete certain media attachments belonging to other users, including administrators.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/6ad219b8-3633-4c54-a6cf-71cc0acf035e/" ], "timeline": [ { "at": "2026-10-10T06:16:40.427", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105977" } ] }, { "id": "CVE-2026-105976", "vendor": "Unknown", "product": "Portfolio Filter Gallery", "title": "Portfolio Filter Gallery vulnerability", "summary": "The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing users with at least the Contributor role to read, modify and delete other users' galleries as well as site-wide gallery filters.", "updated_at": "2026-10-10T12:16:45.400", "published_at": "2026-10-10T06:16:40.313", "cvss": 4.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "before 2.2.1 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-863", "what_happened": "The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing users with at least the Contributor role to read, modify and delete other users' galleries as well as site-wide gallery filters.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://wpscan.com/vulnerability/1ad36801-d53b-4253-ab7a-bd91c0f144f3/" ], "timeline": [ { "at": "2026-10-10T06:16:40.313", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105976" } ] }, { "id": "CVE-2026-105949", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2026-105949 exploit", "summary": "Exploit for CVE-2026-105949. CVSS 8.8.", "updated_at": "2026-10-20T11:30:29Z", "published_at": "2026-10-20T11:30:29Z", "cvss": 8.8, "confidence": 80, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "A public source linked this CVE to an advisory or demonstration repository. Review the original reference before use.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-10-20T11:30:29+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "CVE-2026-105949 exploit", "summary": "Exploit for CVE-2026-105949. CVSS 8.8.", "cvss": 8.8, "url": "https://sploitus.com/exploit?id=CVE-2026-105949" } ], "references": [ "https://sploitus.com/exploit?id=CVE-2026-105949" ], "timeline": [ { "at": "2026-10-20T11:30:29Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=CVE-2026-105949" } ] }, { "id": "CVE-2026-105892", "vendor": "rtCamp Inc.", "product": "rtMedia for WordPress, BuddyPress and bbPress", "title": "rtMedia for WordPress, BuddyPress and bbPress vulnerability", "summary": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Path Traversal.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.13.", "updated_at": "2026-10-10T19:16:56.990", "published_at": "2026-10-10T19:16:56.990", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "0 through 4.7.13 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-22", "what_happened": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Path Traversal.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.13.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/buddypress-media/vulnerability/wordpress-rtmedia-for-wordpress-buddypress-and-bbpress-plugin-4-7-13-arbitrary-file-deletion-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-10-10T19:16:56.990", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105892" } ] }, { "id": "CVE-2026-105891", "vendor": "Liquid Web / StellarWP", "product": "Event Tickets", "title": "Event Tickets vulnerability", "summary": "Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1.", "updated_at": "2026-10-10T04:18:09.363", "published_at": "2026-10-08T13:17:14.070", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 5.30.0.1 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/event-tickets/vulnerability/wordpress-event-tickets-plugin-5-30-0-1-broken-access-control-vulnerability-2?_s_id=cve" ], "timeline": [ { "at": "2026-10-08T13:17:14.070", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105891" } ] }, { "id": "CVE-2026-105889", "vendor": "Tickera", "product": "Tickera", "title": "Tickera vulnerability", "summary": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6.", "updated_at": "2026-10-10T17:17:00.063", "published_at": "2026-10-10T17:17:00.063", "cvss": 9.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 3.6.0.6 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-89", "what_happened": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/tickera-event-ticketing-system/vulnerability/wordpress-tickera-plugin-3-6-0-6-sql-injection-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-10-10T17:17:00.063", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105889" } ] }, { "id": "CVE-2026-105885", "vendor": "10Web", "product": "Slider by 10Web", "title": "Slider by 10Web vulnerability", "summary": "Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62.", "updated_at": "2026-10-10T14:16:37.087", "published_at": "2026-10-10T14:16:37.087", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.2.62 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-502", "what_happened": "Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/slider-wd/vulnerability/wordpress-slider-by-10web-plugin-1-2-62-php-object-injection-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-10-10T14:16:37.087", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105885" } ] }, { "id": "CVE-2026-105872", "vendor": "mklacroix", "product": "Product Configurator for WooCommerce", "title": "Product Configurator for WooCommerce vulnerability", "summary": "Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5.", "updated_at": "2026-10-11T13:17:11.693", "published_at": "2026-10-09T13:17:08.957", "cvss": 7.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.7.5 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-502", "what_happened": "Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/product-configurator-for-woocommerce/vulnerability/wordpress-product-configurator-for-woocommerce-plugin-1-7-5-php-object-injection-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-10-09T13:17:08.957", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105872" } ] }, { "id": "CVE-2026-105870", "vendor": "Delight Star Inc.", "product": "WP Associate Post R2", "title": "WP Associate Post R2 vulnerability", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Delight Star Inc. WP Associate Post R2 wp-associate-post-r2 allows Reflected XSS.This issue affects WP Associate Post R2: from n/a through 5.0.1.", "updated_at": "2026-10-11T12:16:52.110", "published_at": "2026-10-09T13:17:08.710", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 5.0.1 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Delight Star Inc. WP Associate Post R2 wp-associate-post-r2 allows Reflected XSS.This issue affects WP Associate Post R2: from n/a through 5.0.1.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/wp-associate-post-r2/vulnerability/wordpress-wp-associate-post-r2-plugin-5-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-10-09T13:17:08.710", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105870" } ] }, { "id": "CVE-2026-105844", "vendor": "payloadcms", "product": "payload", "title": "Exploit for CVE-2026-105844", "summary": "Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended application behavior that can lead to remote code execution. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.", "updated_at": "2026-10-06T20:03:40.690", "published_at": "2026-10-06T16:17:06.400", "cvss": 9.3, "confidence": 100, "confidence_label": "verified", "affected": ">= 3.0.0, < 3.88.0; >= 4.0.0-canary.0, < 4.0.0-canary.27", "fixed": "See vendor advisory", "source_count": 89, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-1321", "what_happened": "Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended application behavior that can lead to remote code execution. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for CVE-2026-105844", "summary": "Prototype pollution in Payload CMS @payloadcms/plugin-import-export allows access-control bypass.", "what_happened": "Prototype pollution in Payload CMS @payloadcms/plugin-import-export allows access-control bypass.", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-1321", "references": [ "https://sploitus.com/exploit?id=73BE1B4F-C08C-5F0A-9943-93A0A290FB8E", "https://github.com/murrez/CVE-2026-105844" ], "repository": "Sploitus", "author": "murrez", "first_seen": "2026-10-07T19:56:16", "confidence": "High", "verification": "verified", "verified": true, "verification_detail": "Sploitus reports working code with at least 90% confidence.", "url": "https://sploitus.com/exploit?id=73BE1B4F-C08C-5F0A-9943-93A0A290FB8E" }, { "title": "Exploit for CVE-2026-105844", "summary": "Prototype pollution in Payload CMS @payloadcms/plugin-import-export allows access-control bypass.", "what_happened": "Prototype pollution in Payload CMS @payloadcms/plugin-import-export allows access-control bypass.", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-1321", "references": [ "https://sploitus.com/exploit?id=73BE1B4F-C08C-5F0A-9943-93A0A290FB8E", "https://github.com/murrez/CVE-2026-105844" ], "repository": "murrez/CVE-2026-105844", "author": "murrez", "first_seen": "2026-10-07T19:56:16", "confidence": "High", "verification": "verified", "verified": true, "verification_detail": "Linked by a Sploitus working-code assessment.", "url": "https://github.com/murrez/CVE-2026-105844" } ], "references": [ "https://sploitus.com/exploit?id=73BE1B4F-C08C-5F0A-9943-93A0A290FB8E", "https://github.com/murrez/CVE-2026-105844", "https://github.com/payloadcms/payload/commit/a742140ab4fca3160f7f83e9e7d996552ffc3b5a", "https://github.com/payloadcms/payload/releases/tag/v3.88.0", "https://github.com/payloadcms/payload/security/advisories/GHSA-qf28-8hc6-vwrp" ], "timeline": [ { "at": "2026-10-07T17:56:16Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=73BE1B4F-C08C-5F0A-9943-93A0A290FB8E" }, { "at": "2026-10-06T16:17:06.400", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105844" } ], "enrichment_checked_at": "2026-10-07T22:05:31Z", "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "id": "CVE-2026-105829", "vendor": "thephpleague", "product": "commonmark", "title": "commonmark vulnerability", "summary": "League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. Attackers can place a lone ; when a victim navigates to it the injected script executes in the victim browser in the origin of the Netdata instance (reflected cross-site scripting). These endpoints are registered with HTTP_ACL_NOCHECK and anonymous access and, because bearer-token protection is disabled by default, are reachable without authentication on a default Netdata agent. The issue was resolved by removing the ilove endpoint.", "updated_at": "2026-09-30T15:10:00.560", "published_at": "2026-07-02T20:17:00.420", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 2.3.1 (semver)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Netdata before 2.3.1 reflects the user-supplied love query parameter of the api/v2/ilove.svg and api/v3/ilove.svg endpoints verbatim into the generated SVG document (into a text element) without HTML or XML escaping, and serves the response with Content-Type image/svg+xml. An attacker can craft a URL such as /api/v2/ilove.svg?love=; when a victim navigates to it the injected script executes in the victim browser in the origin of the Netdata instance (reflected cross-site scripting). These endpoints are registered with HTTP_ACL_NOCHECK and anonymous access and, because bearer-token protection is disabled by default, are reachable without authentication on a default Netdata agent. The issue was resolved by removing the ilove endpoint.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/netdata/netdata/commit/f82554fe9b21b5ae51a8663a3f4ddce84cac16af", "https://github.com/netdata/netdata/pull/19919", "https://github.com/netdata/netdata/releases/tag/v2.3.1", "https://www.vulncheck.com/advisories/netdata-reflected-cross-site-scripting-via-love-parameter-in-ilove-svg-endpoint" ], "timeline": [ { "at": "2026-07-02T20:17:00.420", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71385" } ] }, { "id": "CVE-2025-71383", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request (from the local Wi-Fi network) that lacks a /api/login username or password field. This occurs because of an error in a JSON parser.", "updated_at": "2026-10-08T03:16:32.637", "published_at": "2026-10-06T17:17:10.953", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-20", "what_happened": "Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request (from the local Wi-Fi network) that lacks a /api/login username or password field. This occurs because of an error in a JSON parser.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.klogixsecurity.com/scorpion-labs-blog/anatomy-of-an-iot-exploit-from-hands-on-to-rce-folie-a-deux" ], "timeline": [ { "at": "2026-10-06T17:17:10.953", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71383" } ] }, { "id": "CVE-2025-71380", "vendor": "n8n", "product": "n8n", "title": "n8n vulnerability", "summary": "The Execute Command node in n8n allows authenticated users to execute arbitrary commands on the host system where n8n runs. Attackers with user access or compromised credentials can exploit this node to run malicious commands, potentially leading to data exfiltration, service disruption, or complete system compromise.", "updated_at": "2026-09-30T15:10:00.560", "published_at": "2026-07-04T02:16:23.477", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.114.4 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-284", "what_happened": "The Execute Command node in n8n allows authenticated users to execute arbitrary commands on the host system where n8n runs. Attackers with user access or compromised credentials can exploit this node to run malicious commands, potentially leading to data exfiltration, service disruption, or complete system compromise.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/n8n-io/n8n/security/advisories/GHSA-365g-vjw2-grx8", "https://www.vulncheck.com/advisories/n8n-arbitrary-command-execution-via-execute-command-node" ], "timeline": [ { "at": "2026-07-04T02:16:23.477", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71380" } ] }, { "id": "CVE-2025-71379", "vendor": "vllm", "product": "vllm", "title": "vllm vulnerability", "summary": "vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities. Several regex patterns — in vllm/lora/utils.py, the phi4mini tool parser, and the OpenAI-compatible serving chat endpoint — are susceptible to catastrophic backtracking. An attacker submitting crafted input with nested or repeated structures can trigger severe CPU consumption and performance degradation, resulting in denial of service.", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-06-20T19:16:23.410", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "0.6.3 through before 0.9.0 (semver)", "fixed": "See vendor advisory", "source_count": 25, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-1333", "what_happened": "vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities. Several regex patterns — in vllm/lora/utils.py, the phi4mini tool parser, and the OpenAI-compatible serving chat endpoint — are susceptible to catastrophic backtracking. An attacker submitting crafted input with nested or repeated structures can trigger severe CPU consumption and performance degradation, resulting in denial of service.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2026-06-20", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-j828-28rj-hfhp" } ], "references": [ "https://github.com/vllm-project/vllm/security/advisories/GHSA-j828-28rj-hfhp", "https://www.vulncheck.com/advisories/vllm-regular-expression-denial-of-service-in-multiple-components" ], "timeline": [ { "at": "2026-06-20T19:16:23.410", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71379" } ] }, { "id": "CVE-2025-71378", "vendor": "picklescan", "product": "picklescan", "title": "picklescan vulnerability", "summary": "picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious pickle files bypass picklescan detection and execute remote code when loaded via pickle.load().", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-06-21T14:16:23.140", "cvss": 7.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "before 0.0.30 (semver)", "fixed": "See vendor advisory", "source_count": 26, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-502", "what_happened": "picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious pickle files bypass picklescan detection and execute remote code when loaded via pickle.load().", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2026-06-21", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9w88-8rmg-7g2p" } ], "references": [ "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9w88-8rmg-7g2p", "https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-undetected-cprofile-runctx-in-pickle-files" ], "timeline": [ { "at": "2026-06-21T14:16:23.140", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71378" } ] }, { "id": "CVE-2025-71377", "vendor": "stoatchat", "product": "stoatchat", "title": "stoatchat vulnerability", "summary": "stoatchat (delta) versions before 20250210-1 (0.8.2) contain a logic error in the query messages route. When fetching messages 'nearby' another message, the database query can be given a message limit of zero, which the database interprets as 'no limit'. A remote unauthenticated attacker can craft nearby message fetch requests to download an entire channel's message history in a single expensive request, and can send many such requests in parallel, resulting in denial of service through resource exhaustion.", "updated_at": "2026-09-29T15:10:00.193", "published_at": "2026-07-16T13:16:24.057", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 0.8.2 (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-1025", "what_happened": "stoatchat (delta) versions before 20250210-1 (0.8.2) contain a logic error in the query messages route. When fetching messages 'nearby' another message, the database query can be given a message limit of zero, which the database interprets as 'no limit'. A remote unauthenticated attacker can craft nearby message fetch requests to download an entire channel's message history in a single expensive request, and can send many such requests in parallel, resulting in denial of service through resource exhaustion.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/stoatchat/stoatchat/commit/5f84daa9dba34c103cd83a2ee1f5e5ba900bfe94", "https://github.com/stoatchat/stoatchat/security/advisories/GHSA-h7h6-7pxm-mc66", "https://www.vulncheck.com/advisories/stoatchat-before-20250210-1-unrestricted-message-history-fetch" ], "timeline": [ { "at": "2026-07-16T13:16:24.057", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71377" } ] }, { "id": "CVE-2025-71376", "vendor": "picklescan", "product": "picklescan", "title": "picklescan vulnerability", "summary": "picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.autocomplete.AutoComplete.fetch_completions in reduce methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when loaded by victims.", "updated_at": "2026-10-12T21:10:00.227", "published_at": "2026-06-23T13:16:38.870", "cvss": 7.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 0.0.29 (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-502", "what_happened": "picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.autocomplete.AutoComplete.fetch_completions in reduce methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when loaded by victims.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-7cq8-mj8x-j263", "https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-undetected-idlelib-autocomplete-autocomplete-fetch-completions" ], "timeline": [ { "at": "2026-06-23T13:16:38.870", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71376" } ] }, { "id": "CVE-2025-71370", "vendor": "picklescan", "product": "picklescan", "title": "picklescan vulnerability", "summary": "picklescan before 0.0.28 fails to detect malicious torch.jit.unsupported_tensor_ops.execWrapper function calls embedded in pickle files. Attackers can craft malicious pickle files that bypass picklescan detection and execute arbitrary code when loaded via pickle.load().", "updated_at": "2026-10-12T21:10:00.227", "published_at": "2026-06-23T13:16:38.743", "cvss": 7.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 0.0.28 (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-502", "what_happened": "picklescan before 0.0.28 fails to detect malicious torch.jit.unsupported_tensor_ops.execWrapper function calls embedded in pickle files. Attackers can craft malicious pickle files that bypass picklescan detection and execute arbitrary code when loaded via pickle.load().", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-vr7h-p6mm-wpmh", "https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-torch-jit-unsupported-tensor-ops-execwrapper" ], "timeline": [ { "at": "2026-06-23T13:16:38.743", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71370" } ] }, { "id": "CVE-2025-71365", "vendor": "picklescan", "product": "picklescan", "title": "picklescan vulnerability", "summary": "picklescan before 0.0.33 fails to detect malicious pickle files that invoke numpy.f2py.crackfortran.myeval function through the reduce method. Attackers can craft malicious pickle files embedding arbitrary code that evades picklescan detection and executes remote code when loaded.", "updated_at": "2026-10-12T21:10:00.227", "published_at": "2026-06-23T13:16:38.617", "cvss": 7.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 0.0.33 (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-502", "what_happened": "picklescan before 0.0.33 fails to detect malicious pickle files that invoke numpy.f2py.crackfortran.myeval function through the reduce method. Attackers can craft malicious pickle files embedding arbitrary code that evades picklescan detection and executes remote code when loaded.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-3329-ghmp-jmv5", "https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-numpy-f2py-crackfortran-myeval-detection-bypass" ], "timeline": [ { "at": "2026-06-23T13:16:38.617", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71365" } ] }, { "id": "CVE-2025-71358", "vendor": "picklescan", "product": "picklescan", "title": "picklescan vulnerability", "summary": "picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.autocomplete.AutoComplete.get_entity function in reduce methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when loaded by victims using pickle.load().", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-06-22T22:16:45.360", "cvss": 7.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 0.0.29 (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-502", "what_happened": "picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.autocomplete.AutoComplete.get_entity function in reduce methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when loaded by victims using pickle.load().", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-6w4w-5w54-rjvr", "https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-idlelib-autocomplete-autocomplete-get-entity" ], "timeline": [ { "at": "2026-06-22T22:16:45.360", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71358" } ] }, { "id": "CVE-2025-71357", "vendor": "picklescan", "product": "picklescan", "title": "picklescan vulnerability", "summary": "picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-06-21T14:16:23.017", "cvss": 7.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "before 0.0.30 (semver)", "fixed": "See vendor advisory", "source_count": 26, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-502", "what_happened": "picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2026-06-21", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-j343-8v2j-ff7w" } ], "references": [ "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-j343-8v2j-ff7w", "https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-undetected-idlelib-pyshell-modifiedinterpreter-runcommand" ], "timeline": [ { "at": "2026-06-21T14:16:23.017", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71357" } ] }, { "id": "CVE-2025-71351", "vendor": "picklescan", "product": "picklescan", "title": "picklescan vulnerability", "summary": "picklescan before 0.0.25 fails to detect malicious pickle files that use timeit.timeit() in the __reduce__ method, allowing remote code execution. Attackers can craft pickle files that import dangerous libraries like os and execute arbitrary system commands, which evade picklescan detection and execute when pickle.load() is called.", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-06-21T14:16:22.897", "cvss": 7.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 0.0.25 (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-184", "what_happened": "picklescan before 0.0.25 fails to detect malicious pickle files that use timeit.timeit() in the __reduce__ method, allowing remote code execution. Attackers can craft pickle files that import dangerous libraries like os and execute arbitrary system commands, which evade picklescan detection and execute when pickle.load() is called.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-v7x6-rv5q-mhwc", "https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-timeit-timeit-detection-bypass" ], "timeline": [ { "at": "2026-06-21T14:16:22.897", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71351" } ] }, { "id": "CVE-2025-71348", "vendor": "picklescan", "product": "picklescan", "title": "picklescan vulnerability", "summary": "picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods. Attackers can craft pickle files embedding arbitrary code that evades detection but executes during pickle.load, enabling remote code execution in supply chain attacks.", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-06-21T14:16:22.750", "cvss": 7.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "before 0.0.28 (semver)", "fixed": "See vendor advisory", "source_count": 26, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-502", "what_happened": "picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods. Attackers can craft pickle files embedding arbitrary code that evades detection but executes during pickle.load, enabling remote code execution in supply chain attacks.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2026-06-21", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-vv6j-3g6g-2pvj" } ], "references": [ "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-vv6j-3g6g-2pvj", "https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-torch-utils-config-module-load-config-bypass" ], "timeline": [ { "at": "2026-06-21T14:16:22.750", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71348" } ] }, { "id": "CVE-2025-71344", "vendor": "picklescan", "product": "picklescan", "title": "picklescan vulnerability", "summary": "picklescan before 0.0.30 (affected versions 0.0.26 and earlier) fails to detect the ensurepip._run_pip built-in function when scanning pickle files, allowing attackers to execute arbitrary code. Malicious pickle files embedding ensurepip._run_pip calls in __reduce__ methods bypass picklescan detection and achieve remote code execution upon pickle.load() invocation.", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-06-22T22:16:45.220", "cvss": 7.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 0.0.30 (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-502", "what_happened": "picklescan before 0.0.30 (affected versions 0.0.26 and earlier) fails to detect the ensurepip._run_pip built-in function when scanning pickle files, allowing attackers to execute arbitrary code. Malicious pickle files embedding ensurepip._run_pip calls in __reduce__ methods bypass picklescan detection and achieve remote code execution upon pickle.load() invocation.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-xp4f-hrf8-rxw7", "https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-undetected-ensurepip-run-pip-function" ], "timeline": [ { "at": "2026-06-22T22:16:45.220", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71344" } ] }, { "id": "CVE-2025-71341", "vendor": "picklescan", "product": "picklescan", "title": "picklescan vulnerability", "summary": "picklescan before 0.0.29 fails to detect the profile.Profile.runctx function when analyzing pickle files, allowing attackers to embed undetected malicious code. Remote attackers can craft malicious pickle files using profile.Profile.runctx in the reduce method to achieve remote code execution when the pickle file is loaded.", "updated_at": "2026-10-12T21:10:00.227", "published_at": "2026-06-23T13:16:38.370", "cvss": 7.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 0.0.29 (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-502", "what_happened": "picklescan before 0.0.29 fails to detect the profile.Profile.runctx function when analyzing pickle files, allowing attackers to embed undetected malicious code. Remote attackers can craft malicious pickle files using profile.Profile.runctx in the reduce method to achieve remote code execution when the pickle file is loaded.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-6vqj-c2q5-j97w", "https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-undetected-profile-profile-runctx" ], "timeline": [ { "at": "2026-06-23T13:16:38.370", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71341" } ] }, { "id": "CVE-2025-71339", "vendor": "Picklescan", "product": "Picklescan", "title": "Picklescan vulnerability", "summary": "Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran._eval_length gadget in pickle __reduce__ methods, allowing arbitrary code execution. Attackers can craft malicious pickle files that execute arbitrary Python code when loaded by victims who trust Picklescan's safety validation.", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-06-22T22:16:45.053", "cvss": 7.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 0.0.33 (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-502", "what_happened": "Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran._eval_length gadget in pickle __reduce__ methods, allowing arbitrary code execution. Attackers can craft malicious pickle files that execute arbitrary Python code when loaded by victims who trust Picklescan's safety validation.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-6556-fwc2-fg2p", "https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-numpy-f2py-crackfortran-eval-length-gadget" ], "timeline": [ { "at": "2026-06-22T22:16:45.053", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71339" } ] }, { "id": "CVE-2025-71337", "vendor": "Flowise", "product": "Flowise", "title": "Flowise vulnerability", "summary": "Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability. An authenticated user can change the account email address, used as a login identifier and password-recovery channel, via the account profile endpoint without confirming the change to the original email address or re-entering the current password. By changing the recovery email, an attacker can take over the account and abuse password reset mechanisms.", "updated_at": "2026-10-12T21:10:00.227", "published_at": "2026-06-23T13:16:38.233", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "before 3.0.10 (semver)", "fixed": "See vendor advisory", "source_count": 26, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-620", "what_happened": "Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability. An authenticated user can change the account email address, used as a login identifier and password-recovery channel, via the account profile endpoint without confirming the change to the original email address or re-entering the current password. By changing the recovery email, an attacker can take over the account and abuse password reset mechanisms.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2026-06-23", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x39m-3393-3qp4" } ], "references": [ "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x39m-3393-3qp4", "https://www.vulncheck.com/advisories/flowise-unverified-email-change-via-account-profile-endpoint" ], "timeline": [ { "at": "2026-06-23T13:16:38.233", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71337" } ] }, { "id": "CVE-2025-71330", "vendor": "image-size", "product": "image-size", "title": "image-size vulnerability", "summary": "image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length field is 0, causing the while loop condition to remain true indefinitely.", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-06-10T14:16:30.387", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "1.1.0 through 1.2.1 (semver); 2.0.0 through 2.0.2 (semver)", "fixed": "See vendor advisory", "source_count": 26, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-835", "what_happened": "image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length field is 0, causing the while loop condition to remain true indefinitely.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "joshua.hu", "author": "NVD reference", "first_seen": "2026-06-10", "confidence": "High", "verification": "verified", "verified": true, "url": "https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities" } ], "references": [ "https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities", "https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439", "https://www.vulncheck.com/advisories/image-size-denial-of-service-via-malformed-icns-image-parsing" ], "timeline": [ { "at": "2026-06-10T14:16:30.387", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71330" } ] }, { "id": "CVE-2025-71329", "vendor": "image-size", "product": "image-size", "title": "image-size vulnerability", "summary": "image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-06-10T14:16:30.160", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "1.1.0 through 1.2.1 (semver); 2.0.0 through 2.0.2 (semver)", "fixed": "See vendor advisory", "source_count": 26, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-835", "what_happened": "image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "joshua.hu", "author": "NVD reference", "first_seen": "2026-06-10", "confidence": "High", "verification": "verified", "verified": true, "url": "https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities" } ], "references": [ "https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities", "https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439", "https://www.vulncheck.com/advisories/image-size-denial-of-service-via-infinite-loop-in-jxl-heif-parser" ], "timeline": [ { "at": "2026-06-10T14:16:30.160", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71329" } ] }, { "id": "CVE-2025-71325", "vendor": "picklescan", "product": "picklescan", "title": "picklescan vulnerability", "summary": "picklescan before 0.0.27 contains a parsing logic error in the _list_globals function when handling STACK_GLOBAL opcodes, failing to track arguments in the correct range and allowing malicious pickle files to bypass detection. Attackers can craft pickle files with arguments at position zero to trigger unexpected exceptions and evade security scanning.", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-06-17T17:16:41.247", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 0.0.27 (semver)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-391", "what_happened": "picklescan before 0.0.27 contains a parsing logic error in the _list_globals function when handling STACK_GLOBAL opcodes, failing to track arguments in the correct range and allowing malicious pickle files to bypass detection. Attackers can craft pickle files with arguments at position zero to trigger unexpected exceptions and evade security scanning.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/mmaitre314/picklescan/commit/2a8383cfeb4158567f9770d86597300c9e508d0f", "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9gvj-pp9x-gcfr", "https://www.vulncheck.com/advisories/picklescan-detection-bypass-via-stack-global-opcode-parsing-logic-flaw" ], "timeline": [ { "at": "2026-06-17T17:16:41.247", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71325" } ] }, { "id": "CVE-2025-71323", "vendor": "picklescan", "product": "picklescan", "title": "picklescan vulnerability", "summary": "picklescan before 0.0.33 fails to block the ctypes module, allowing attackers to achieve remote code execution by invoking direct syscalls and accessing raw memory. Attackers can craft malicious pickle files using ctypes.WinDLL to load kernel32.dll and execute arbitrary commands, bypassing sandbox protections and gadget chain detection.", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-06-17T17:16:41.110", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 0.0.33 (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-184", "what_happened": "picklescan before 0.0.33 fails to block the ctypes module, allowing attackers to achieve remote code execution by invoking direct syscalls and accessing raw memory. Attackers can craft malicious pickle files using ctypes.WinDLL to load kernel32.dll and execute arbitrary commands, bypassing sandbox protections and gadget chain detection.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-4675-36f9-wf6r", "https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-unblocked-ctypes-module" ], "timeline": [ { "at": "2026-06-17T17:16:41.110", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71323" } ] }, { "id": "CVE-2025-71322", "vendor": "PickleScan", "product": "PickleScan", "title": "PickleScan vulnerability", "summary": "PickleScan before 0.0.33 fails to include the pty.spawn function in its unsafe globals list, allowing attackers to bypass security checks. Malicious actors can craft pickle payloads using pty.spawn to achieve arbitrary code execution when files are processed by PickleScan.", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-06-17T17:16:40.980", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 0.0.33 (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-693", "what_happened": "PickleScan before 0.0.33 fails to include the pty.spawn function in its unsafe globals list, allowing attackers to bypass security checks. Malicious actors can craft pickle payloads using pty.spawn to achieve arbitrary code execution when files are processed by PickleScan.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-hgrh-qx5j-jfwx", "https://www.vulncheck.com/advisories/picklescan-unsafe-globals-check-bypass-via-pty-spawn-function" ], "timeline": [ { "at": "2026-06-17T17:16:40.980", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71322" } ] }, { "id": "CVE-2025-71321", "vendor": "picklescan", "product": "picklescan", "title": "picklescan vulnerability", "summary": "picklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows attackers to bypass the dangerous blocklist by using distutils.file_util.write_file. Attackers can construct malicious pickle objects to overwrite critical system files and achieve denial of service or remote code execution.", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-06-17T17:16:40.847", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 0.0.33 (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-502", "what_happened": "picklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows attackers to bypass the dangerous blocklist by using distutils.file_util.write_file. Attackers can construct malicious pickle objects to overwrite critical system files and achieve denial of service or remote code execution.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-m273-6v24-x4m4", "https://www.vulncheck.com/advisories/picklescan-arbitrary-file-writing-via-distutils-module-bypass" ], "timeline": [ { "at": "2026-06-17T17:16:40.847", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71321" } ] }, { "id": "CVE-2025-71320", "vendor": "picklescan", "product": "picklescan", "title": "picklescan vulnerability", "summary": "picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and operator.methodcaller functions, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle files using these unblocked functions to achieve arbitrary code execution when the pickle is deserialized.", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-06-17T17:16:40.697", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 0.0.33 (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-184", "what_happened": "picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and operator.methodcaller functions, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle files using these unblocked functions to achieve arbitrary code execution when the pickle is deserialized.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-84r2-jw7c-4r5q", "https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-incomplete-disallowed-inputs" ], "timeline": [ { "at": "2026-06-17T17:16:40.697", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71320" } ] }, { "id": "CVE-2025-70962", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The application contains hardcoded credentials in the RTSP authentication mechanism. An attacker with network access can use the unchangeable default credentials to access the RTSP video stream, resulting in unauthorized viewing of camera footage.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2026-08-05T14:16:58.390", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-284", "what_happened": "Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The application contains hardcoded credentials in the RTSP authentication mechanism. An attacker with network access can use the unchangeable default credentials to access the RTSP video stream, resulting in unauthorized viewing of camera footage.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/namaek2/CVE-2025-70962", "https://www.zositech.com/" ], "timeline": [ { "at": "2026-08-05T14:16:58.390", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-70962" } ] }, { "id": "CVE-2025-70336", "vendor": "Unknown vendor", "product": "Unknown product", "title": "PodcastGenerator 3.2.9 - Stored XSS", "summary": "PodcastGenerator 3.2.9 - Stored XSS", "updated_at": "2026-10-19T22:00:00Z", "published_at": "2026-10-19T22:00:00Z", "cvss": 0, "confidence": 80, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "PodcastGenerator 3.2.9 Stored XSS", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52677", "author": "Sahil Arya", "first_seen": "2026-09-02", "confidence": "High", "title": "PodcastGenerator 3.2.9 - Stored XSS", "summary": "PodcastGenerator 3.2.9 - Stored XSS", "url": "https://www.exploit-db.com/exploits/52677", "verification": "verified", "verified": true }, { "repository": "CXSecurity WLB-2026100002", "author": "Sahil Arya", "first_seen": "2026-10-20", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "PodcastGenerator 3.2.9 Stored XSS", "summary": "PodcastGenerator 3.2.9 Stored XSS", "what_happened": "PodcastGenerator 3.2.9 Stored XSS", "cvss": 0, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "url": "https://cxsecurity.com/issue/WLB-2026100002", "cwe": "Unknown" } ], "references": [ "https://www.exploit-db.com/exploits/52677", "https://cxsecurity.com/issue/WLB-2026100002" ], "timeline": [ { "at": "2026-10-19T22:00:00Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52677" } ] }, { "id": "CVE-2025-70116", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "A NULL pointer dereference in GPAC MP4Box: when parsing certain truncated MP4 files, an unknown/invalid stsd entry can result in missing descriptor fields (e.g., codec/mime/profile strings). gf_media_map_esd then calls strlen() on a NULL pointer, triggering a crash (ASan SEGV).", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-05-27T17:16:29.187", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "confidence": 35, "confidence_label": "observed", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-476", "what_happened": "A NULL pointer dereference in GPAC MP4Box: when parsing certain truncated MP4 files, an unknown/invalid stsd entry can result in missing descriptor fields (e.g., codec/mime/profile strings). gf_media_map_esd then calls strlen() on a NULL pointer, triggering a crash (ASan SEGV).", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/gpac/gpac/issues/3345", "https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/68/68_gf_media_map_esd_media_tools_isom_tools_c_1364", "https://infosec.exchange/@sigdevel/116624563750949972", "http://www.openwall.com/lists/oss-security/2026/05/30/2" ], "timeline": [ { "at": "2026-05-27T17:16:29.187", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-70116" } ] }, { "id": "CVE-2025-70103", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras::DecodeImagePNM function in file lib/extras/dec/pnm.cc.", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-05-27T15:16:24.783", "cvss": 7.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-122", "what_happened": "Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras::DecodeImagePNM function in file lib/extras/dec/pnm.cc.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/libjxl/libjxl/issues/4337", "https://github.com/libjxl/libjxl/pull/4338", "https://github.com/sigdevel/pocs/blob/main/res/libjxl/2025/2", "https://infosec.exchange/@sigdevel/116642233929409910", "http://www.openwall.com/lists/oss-security/2026/05/30/7" ], "timeline": [ { "at": "2026-05-27T15:16:24.783", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-70103" } ] }, { "id": "CVE-2025-69949", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in check_availability.php via the parameters emailid and email.", "updated_at": "2026-10-13T09:10:00.323", "published_at": "2026-07-29T22:16:52.213", "cvss": 7.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-89", "what_happened": "kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in check_availability.php via the parameters emailid and email.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-check_availability.php-email-sqli/20250811-hospital-management-system-check_availability.php-email-sqli.md", "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-check_availability.php-emailid-sqli/20250811-hospital-management-system-check_availability.php-emailid-sqli.md" ], "timeline": [ { "at": "2026-07-29T22:16:52.213", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69949" } ] }, { "id": "CVE-2025-69946", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php via the parameters district_id , division_id, region_id, and ward_id.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2026-07-31T21:17:29.390", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-89", "what_happened": "SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php via the parameters district_id , division_id, region_id, and ward_id.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/um-dsp/TaintRadar", "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/loansystem/20250811-modern-loan-management-system-ajaxdata.php-district_id-sqli/20250811-modern-loan-management-system-ajaxdata.php-district_id-sqli.md", "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/loansystem/20250811-modern-loan-management-system-ajaxdata.php-division_id-sqli/20250811-modern-loan-management-system-ajaxdata.php-division_id-sqli.md", "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/loansystem/20250811-modern-loan-management-system-ajaxdata.php-region_id-sqli/20250811-modern-loan-management-system-ajaxdata.php-region_id-sqli.md", "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/loansystem/20250811-modern-loan-management-system-ajaxdata.php-ward_id-sqli/20250811-modern-loan-management-system-ajaxdata.php-ward_id-sqli.md", "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/loansystem/20250811-modern-loan-management-system-delete_group.php-id-sqli/20250811-modern-loan-management-system-delete_group.php-id-sqli.md" ], "timeline": [ { "at": "2026-07-31T21:17:29.390", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69946" } ] }, { "id": "CVE-2025-69944", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in the view-medhistory.php endpoint via the viewid parameter.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2026-07-29T22:16:51.987", "cvss": 7.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-89", "what_happened": "kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in the view-medhistory.php endpoint via the viewid parameter.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-view-medhistory.php-viewid-sqli/20250811-hospital-management-system-view-medhistory.php-viewid-sqli.md" ], "timeline": [ { "at": "2026-07-29T22:16:51.987", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69944" } ] }, { "id": "CVE-2025-69943", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "kishan0725 Hospital Management System 4.0 is vulnerale to SQL Injection in get_doctor.php via the parameters doctor and specilizationid.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2026-07-29T22:16:51.870", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-89", "what_happened": "kishan0725 Hospital Management System 4.0 is vulnerale to SQL Injection in get_doctor.php via the parameters doctor and specilizationid.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-get_doctor.php-doctor-sqli/20250811-hospital-management-system-get_doctor.php-doctor-sqli.md", "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-get_doctor.php-specilizationid-sqli/20250811-hospital-management-system-get_doctor.php-specilizationid-sqli.md" ], "timeline": [ { "at": "2026-07-29T22:16:51.870", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69943" } ] }, { "id": "CVE-2025-69938", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2026-07-30T21:16:52.670", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-89", "what_happened": "CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/codeastro/20250811-membership-management-system-renew.php-membershiptype-sqli/20250811-membership-management-system-renew.php-membershiptype-sqli.md" ], "timeline": [ { "at": "2026-07-30T21:16:52.670", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69938" } ] }, { "id": "CVE-2025-69937", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2026-07-30T21:16:52.563", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-89", "what_happened": "CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/codeastro/20250811-membership-management-system-edit_type.php-id-sqli/20250811-membership-management-system-edit_type.php-id-sqli.md" ], "timeline": [ { "at": "2026-07-30T21:16:52.563", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69937" } ] }, { "id": "CVE-2025-69935", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue_report.php via the fromDate parameter.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2026-07-30T21:16:52.333", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-89", "what_happened": "CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue_report.php via the fromDate parameter.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/codeastro/20250811-membership-management-system-revenue_report.php-fromdate-sqli/20250811-membership-management-system-revenue_report.php-fromdate-sqli.md" ], "timeline": [ { "at": "2026-07-30T21:16:52.333", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69935" } ] }, { "id": "CVE-2025-69364", "vendor": "Cloudways", "product": "Breeze", "title": "Breeze vulnerability", "summary": "Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <= 2.2.21.", "updated_at": "2026-10-07T09:10:00.160", "published_at": "2026-01-06T17:15:49.023", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.2.21 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <= 2.2.21.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/breeze/vulnerability/wordpress-breeze-plugin-2-2-21-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-01-06T17:15:49.023", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69364" } ] }, { "id": "CVE-2025-69363", "vendor": "CyberChimps", "product": "Responsive Addons for Elementor", "title": "Responsive Addons for Elementor vulnerability", "summary": "Missing Authorization vulnerability in CyberChimps Responsive Addons for Elementor responsive-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Addons for Elementor: from n/a through <= 2.0.8.", "updated_at": "2026-10-07T09:10:00.160", "published_at": "2026-01-06T17:15:48.903", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.0.8 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in CyberChimps Responsive Addons for Elementor responsive-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Addons for Elementor: from n/a through <= 2.0.8.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/responsive-addons-for-elementor/vulnerability/wordpress-responsive-addons-for-elementor-plugin-2-0-8-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-01-06T17:15:48.903", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69363" } ] }, { "id": "CVE-2025-69362", "vendor": "POSIMYTH", "product": "UiChemy", "title": "UiChemy vulnerability", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH UiChemy uichemy allows Stored XSS.This issue affects UiChemy: from n/a through <= 4.4.2.", "updated_at": "2026-10-07T09:10:00.160", "published_at": "2026-01-06T17:15:48.790", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 4.4.2 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH UiChemy uichemy allows Stored XSS.This issue affects UiChemy: from n/a through <= 4.4.2.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/uichemy/vulnerability/wordpress-uichemy-plugin-4-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-01-06T17:15:48.790", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69362" } ] }, { "id": "CVE-2025-69361", "vendor": "PublishPress", "product": "Post Expirator", "title": "Post Expirator vulnerability", "summary": "Missing Authorization vulnerability in PublishPress Post Expirator post-expirator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Expirator: from n/a through <= 4.9.3.", "updated_at": "2026-10-07T09:10:00.160", "published_at": "2026-01-06T17:15:48.673", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 4.9.3 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in PublishPress Post Expirator post-expirator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Expirator: from n/a through <= 4.9.3.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/post-expirator/vulnerability/wordpress-post-expirator-plugin-4-9-3-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-01-06T17:15:48.673", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69361" } ] }, { "id": "CVE-2025-69360", "vendor": "CodexThemes", "product": "TheGem Theme Elements (for WPBakery)", "title": "TheGem Theme Elements (for WPBakery) vulnerability", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for WPBakery) thegem-elements allows DOM-Based XSS.This issue affects TheGem Theme Elements (for WPBakery): from n/a through <= 5.11.0.", "updated_at": "2026-10-07T09:10:00.160", "published_at": "2026-01-06T17:15:48.557", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 5.11.0 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for WPBakery) thegem-elements allows DOM-Based XSS.This issue affects TheGem Theme Elements (for WPBakery): from n/a through <= 5.11.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/thegem-elements/vulnerability/wordpress-thegem-theme-elements-for-wpbakery-plugin-5-11-0-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-01-06T17:15:48.557", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69360" } ] }, { "id": "CVE-2025-69359", "vendor": "WPFunnels", "product": "Creator LMS", "title": "Creator LMS vulnerability", "summary": "Missing Authorization vulnerability in WPFunnels Creator LMS creatorlms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Creator LMS: from n/a through <= 1.1.12.", "updated_at": "2026-10-07T09:10:00.160", "published_at": "2026-01-06T17:15:48.440", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.1.12 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in WPFunnels Creator LMS creatorlms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Creator LMS: from n/a through <= 1.1.12.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/creatorlms/vulnerability/wordpress-creator-lms-plugin-1-1-12-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-01-06T17:15:48.440", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69359" } ] }, { "id": "CVE-2025-69357", "vendor": "CodexThemes", "product": "TheGem Theme Elements (for Elementor)", "title": "TheGem Theme Elements (for Elementor) vulnerability", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elements-elementor allows Stored XSS.This issue affects TheGem Theme Elements (for Elementor): from n/a through <= 5.11.0.", "updated_at": "2026-10-07T09:10:00.160", "published_at": "2026-01-06T17:15:48.327", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 5.11.0 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elements-elementor allows Stored XSS.This issue affects TheGem Theme Elements (for Elementor): from n/a through <= 5.11.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/thegem-elements-elementor/vulnerability/wordpress-thegem-theme-elements-for-elementor-plugin-5-11-0-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-01-06T17:15:48.327", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69357" } ] }, { "id": "CVE-2025-69356", "vendor": "CodexThemes", "product": "TheGem Theme Elements (for Elementor)", "title": "TheGem Theme Elements (for Elementor) vulnerability", "summary": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elements-elementor allows PHP Local File Inclusion.This issue affects TheGem Theme Elements (for Elementor): from n/a through <= 5.11.0.", "updated_at": "2026-10-07T09:10:00.160", "published_at": "2026-01-06T17:15:48.207", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "0 through 5.11.0 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "High", "cwe": "CWE-98", "what_happened": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elements-elementor allows PHP Local File Inclusion.This issue affects TheGem Theme Elements (for Elementor): from n/a through <= 5.11.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/thegem-elements-elementor/vulnerability/wordpress-thegem-theme-elements-for-elementor-plugin-5-11-0-local-file-inclusion-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-01-06T17:15:48.207", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69356" } ] }, { "id": "CVE-2025-69354", "vendor": "BBR Plugins", "product": "Better Business Reviews", "title": "Better Business Reviews vulnerability", "summary": "Missing Authorization vulnerability in BBR Plugins Better Business Reviews better-business-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Business Reviews: from n/a through <= 0.1.1.", "updated_at": "2026-10-07T09:10:00.160", "published_at": "2026-01-06T17:15:47.963", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 0.1.1 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in BBR Plugins Better Business Reviews better-business-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Business Reviews: from n/a through <= 0.1.1.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/better-business-reviews/vulnerability/wordpress-better-business-reviews-plugin-0-1-1-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-01-06T17:15:47.963", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69354" } ] }, { "id": "CVE-2025-69352", "vendor": "StellarWP", "product": "The Events Calendar", "title": "The Events Calendar vulnerability", "summary": "Missing Authorization vulnerability in StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through <= 6.15.12.2.", "updated_at": "2026-10-07T09:10:00.160", "published_at": "2026-01-06T17:15:47.723", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 6.15.12.2 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through <= 6.15.12.2.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/the-events-calendar/vulnerability/wordpress-the-events-calendar-plugin-6-15-12-2-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-01-06T17:15:47.723", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69352" } ] }, { "id": "CVE-2025-69345", "vendor": "BoldGrid", "product": "Post and Page Builder by BoldGrid", "title": "Post and Page Builder by BoldGrid vulnerability", "summary": "Missing Authorization vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.9.", "updated_at": "2026-10-13T08:10:00.137", "published_at": "2026-01-06T17:15:46.987", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.27.9 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.9.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/post-and-page-builder/vulnerability/wordpress-post-and-page-builder-by-boldgrid-plugin-1-27-9-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-01-06T17:15:46.987", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69345" } ] }, { "id": "CVE-2025-69344", "vendor": "themehunk", "product": "Oneline Lite", "title": "Oneline Lite vulnerability", "summary": "Missing Authorization vulnerability in themehunk Oneline Lite oneline-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Oneline Lite: from n/a through <= 6.6.", "updated_at": "2026-10-07T09:10:00.160", "published_at": "2026-01-07T12:17:06.557", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 6.6 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in themehunk Oneline Lite oneline-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Oneline Lite: from n/a through <= 6.6.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Theme/oneline-lite/vulnerability/wordpress-oneline-lite-theme-6-6-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-01-07T12:17:06.557", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69344" } ] }, { "id": "CVE-2025-69333", "vendor": "Crocoblock", "product": "JetEngine", "title": "JetEngine vulnerability", "summary": "Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through <= 3.8.1.1.", "updated_at": "2026-10-07T09:10:00.160", "published_at": "2026-01-07T12:17:06.413", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 3.8.1.1 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through <= 3.8.1.1.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-8-1-1-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-01-07T12:17:06.413", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69333" } ] }, { "id": "CVE-2025-69217", "vendor": "coturn", "product": "coturn", "title": "coturn vulnerability", "summary": "coturn is a free open source implementation of TURN and STUN Server. Versions 4.6.2r5 through 4.7.0-r4 have a bad random number generator for nonces and port randomization after refactoring. Additionally, random numbers aren't generated with openssl's RAND_bytes but libc's random() (if it's not running on Windows). When fetching about 50 sequential nonces (i.e., through sending 50 unauthenticated allocations requests) it is possible to completely reconstruct the current state of the random number generator, thereby predicting the next nonce. This allows authentication while spoofing IPs. An attacker can send authenticated messages without ever receiving the responses, including the nonce (requires knowledge of the credentials, which is e.g., often the case in IoT settings). Since the port randomization is deterministic given the pseudorandom seed, an attacker can exactly reconstruct the ports and, hence predict the randomization of the ports. If an attacker allocates a relay port, they know the current port, and they are able to predict the next relay port (at least if it is not used before). Commit 11fc465f4bba70bb0ad8aae17d6c4a63a29917d9 contains a fix.", "updated_at": "2026-10-13T08:10:00.137", "published_at": "2025-12-30T01:15:41.390", "cvss": 7.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "confidence": 35, "confidence_label": "observed", "affected": ">= 4.6.2r5, <= 4.7.0-r4", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-338", "what_happened": "coturn is a free open source implementation of TURN and STUN Server. Versions 4.6.2r5 through 4.7.0-r4 have a bad random number generator for nonces and port randomization after refactoring. Additionally, random numbers aren't generated with openssl's RAND_bytes but libc's random() (if it's not running on Windows). When fetching about 50 sequential nonces (i.e., through sending 50 unauthenticated allocations requests) it is possible to completely reconstruct the current state of the random number generator, thereby predicting the next nonce. This allows authentication while spoofing IPs. An attacker can send authenticated messages without ever receiving the responses, including the nonce (requires knowledge of the credentials, which is e.g., often the case in IoT settings). Since the port randomization is deterministic given the pseudorandom seed, an attacker can exactly reconstruct the ports and, hence predict the randomization of the ports. If an attacker allocates a relay port, they know the current port, and they are able to predict the next relay port (at least if it is not used before). Commit 11fc465f4bba70bb0ad8aae17d6c4a63a29917d9 contains a fix.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/coturn/coturn/commit/11fc465f4bba70bb0ad8aae17d6c4a63a29917d9", "https://github.com/coturn/coturn/commit/88ced471385869d7e7fbbc4766e78ef521b36af6", "https://github.com/coturn/coturn/security/advisories/GHSA-fvj6-9jhg-9j84" ], "timeline": [ { "at": "2025-12-30T01:15:41.390", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69217" } ] }, { "id": "CVE-2025-69203", "vendor": "SignalK", "product": "signalk-server", "title": "signalk-server vulnerability", "summary": "Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the access request system have two related features that when combined by themselves and with an information disclosure vulnerability enable convincing social engineering attacks against administrators. When a device creates an access request, it specifies three fields: `clientId`, `description`, and `permissions`. The SignalK admin UI displays the `description` field prominently to the administrator when showing pending requests, but the actual `permissions` field (which determines the access level granted) is less visible or displayed separately. This allows an attacker to request `admin` permissions while providing a description that suggests readonly access. The access request handler trusts the `X-Forwarded-For` HTTP header without validation to determine the client's IP address. This header is intended to preserve the original client IP when requests pass through reverse proxies, but when trusted unconditionally, it allows attackers to spoof their IP address. The spoofed IP is displayed to administrators in the access request approval interface, potentially making malicious requests appear to originate from trusted internal network addresses. Since device/source names can be enumerated via the information disclosure vulnerability, an attacker can impersonate a legitimate device or source, craft a convincing description, spoof a trusted internal IP address, and request elevated permissions, creating a highly convincing social engineering scenario that increases the likelihood of administrator approval. Users should upgrade to version 2.19.0 to fix this issue.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2026-01-01T19:15:54.067", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "confidence": 100, "confidence_label": "verified", "affected": "< 2.19.0", "fixed": "See vendor advisory", "source_count": 68, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-290", "what_happened": "Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the access request system have two related features that when combined by themselves and with an information disclosure vulnerability enable convincing social engineering attacks against administrators. When a device creates an access request, it specifies three fields: `clientId`, `description`, and `permissions`. The SignalK admin UI displays the `description` field prominently to the administrator when showing pending requests, but the actual `permissions` field (which determines the access level granted) is less visible or displayed separately. This allows an attacker to request `admin` permissions while providing a description that suggests readonly access. The access request handler trusts the `X-Forwarded-For` HTTP header without validation to determine the client's IP address. This header is intended to preserve the original client IP when requests pass through reverse proxies, but when trusted unconditionally, it allows attackers to spoof their IP address. The spoofed IP is displayed to administrators in the access request approval interface, potentially making malicious requests appear to originate from trusted internal network addresses. Since device/source names can be enumerated via the information disclosure vulnerability, an attacker can impersonate a legitimate device or source, craft a convincing description, spoof a trusted internal IP address, and request elevated permissions, creating a highly convincing social engineering scenario that increases the likelihood of administrator approval. Users should upgrade to version 2.19.0 to fix this issue.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2026-01-01", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-vfrf-vcj7-wvr8" } ], "references": [ "https://github.com/SignalK/signalk-server/releases/tag/v2.19.0", "https://github.com/SignalK/signalk-server/security/advisories/GHSA-vfrf-vcj7-wvr8" ], "timeline": [ { "at": "2026-01-01T19:15:54.067", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69203" } ] }, { "id": "CVE-2025-69155", "vendor": "Designthemes", "product": "Fitness Zone WordPress Theme", "title": "Fitness Zone WordPress Theme vulnerability", "summary": "Unauthenticated Cross Site Scripting (XSS) in Fitness Zone WordPress Theme <= 5.7 versions.", "updated_at": "2026-09-30T15:10:00.560", "published_at": "2026-07-02T12:16:53.937", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "n/a through 5.7 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Unauthenticated Cross Site Scripting (XSS) in Fitness Zone WordPress Theme <= 5.7 versions.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/theme/fitnesszone/vulnerability/wordpress-fitness-zone-wordpress-theme-theme-5-7-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-07-02T12:16:53.937", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69155" } ] }, { "id": "CVE-2025-69153", "vendor": "designthemes", "product": "Trendy Travel", "title": "Trendy Travel vulnerability", "summary": "Unauthenticated Cross Site Scripting (XSS) in Trendy Travel <= 6.7 versions.", "updated_at": "2026-09-30T15:10:00.560", "published_at": "2026-07-02T12:16:53.700", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "n/a through 6.7 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Unauthenticated Cross Site Scripting (XSS) in Trendy Travel <= 6.7 versions.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/theme/trendytravel/vulnerability/wordpress-trendy-travel-theme-6-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-07-02T12:16:53.700", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69153" } ] }, { "id": "CVE-2025-69133", "vendor": "GoodLayers", "product": "Tourmaster", "title": "Tourmaster vulnerability", "summary": "Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions.", "updated_at": "2026-10-06T08:10:00.193", "published_at": "2026-07-02T12:16:53.300", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "n/a through 5.4.5 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "High", "cwe": "CWE-98", "what_happened": "Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/tourmaster/vulnerability/wordpress-tourmaster-plugin-5-4-5-local-file-inclusion-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-07-02T12:16:53.300", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69133" } ] }, { "id": "CVE-2025-69093", "vendor": "wpdesk", "product": "ShopMagic", "title": "ShopMagic vulnerability", "summary": "Missing Authorization vulnerability in wpdesk ShopMagic shopmagic-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopMagic: from n/a through <= 4.7.2.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2025-12-30T11:16:02.683", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 4.7.2 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in wpdesk ShopMagic shopmagic-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopMagic: from n/a through <= 4.7.2.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/shopmagic-for-woocommerce/vulnerability/wordpress-shopmagic-plugin-4-7-2-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-30T11:16:02.683", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69093" } ] }, { "id": "CVE-2025-69092", "vendor": "WPDeveloper", "product": "Essential Addons for Elementor", "title": "Essential Addons for Elementor vulnerability", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows DOM-Based XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.5.3.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2025-12-30T11:16:02.567", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 6.5.3 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows DOM-Based XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.5.3.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/essential-addons-for-elementor-lite/vulnerability/wordpress-essential-addons-for-elementor-plugin-6-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-30T11:16:02.567", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69092" } ] }, { "id": "CVE-2025-69091", "vendor": "Kraft Plugins", "product": "Demo Importer Plus", "title": "Demo Importer Plus vulnerability", "summary": "Missing Authorization vulnerability in Kraft Plugins Demo Importer Plus demo-importer-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Demo Importer Plus: from n/a through <= 2.0.8.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2025-12-30T11:16:02.443", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.0.8 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in Kraft Plugins Demo Importer Plus demo-importer-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Demo Importer Plus: from n/a through <= 2.0.8.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/demo-importer-plus/vulnerability/wordpress-demo-importer-plus-plugin-2-0-8-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-30T11:16:02.443", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69091" } ] }, { "id": "CVE-2025-69089", "vendor": "autolistings", "product": "Auto Listings", "title": "Auto Listings vulnerability", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in autolistings Auto Listings auto-listings allows Stored XSS.This issue affects Auto Listings: from n/a through <= 2.7.1.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2025-12-30T11:16:02.317", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.7.1 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in autolistings Auto Listings auto-listings allows Stored XSS.This issue affects Auto Listings: from n/a through <= 2.7.1.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/auto-listings/vulnerability/wordpress-auto-listings-plugin-2-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-30T11:16:02.317", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69089" } ] }, { "id": "CVE-2025-69088", "vendor": "Vidish", "product": "Combo Offers WooCommerce", "title": "Combo Offers WooCommerce vulnerability", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vidish Combo Offers WooCommerce woo-combo-offers allows DOM-Based XSS.This issue affects Combo Offers WooCommerce: from n/a through <= 4.2.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2025-12-30T11:16:02.193", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 4.2 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vidish Combo Offers WooCommerce woo-combo-offers allows DOM-Based XSS.This issue affects Combo Offers WooCommerce: from n/a through <= 4.2.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/woo-combo-offers/vulnerability/wordpress-combo-offers-woocommerce-plugin-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-30T11:16:02.193", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69088" } ] }, { "id": "CVE-2025-69082", "vendor": "Frenify", "product": "Arlo", "title": "Arlo vulnerability", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Frenify Arlo arlo allows Reflected XSS.This issue affects Arlo: from n/a through <= 6.0.3.", "updated_at": "2026-10-07T09:10:00.160", "published_at": "2026-01-07T12:17:06.277", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 6.0.3 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Frenify Arlo arlo allows Reflected XSS.This issue affects Arlo: from n/a through <= 6.0.3.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Theme/arlo/vulnerability/wordpress-arlo-theme-6-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-01-07T12:17:06.277", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69082" } ] }, { "id": "CVE-2025-69081", "vendor": "ThemeREX", "product": "Hope", "title": "Hope vulnerability", "summary": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Hope charity-is-hope allows PHP Local File Inclusion.This issue affects Hope: from n/a through <= 3.0.0.", "updated_at": "2026-10-07T09:10:00.160", "published_at": "2026-01-07T12:17:06.127", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "0 through 3.0.0 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-98", "what_happened": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Hope charity-is-hope allows PHP Local File Inclusion.This issue affects Hope: from n/a through <= 3.0.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Theme/charity-is-hope/vulnerability/wordpress-hope-theme-3-0-0-local-file-inclusion-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-01-07T12:17:06.127", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69081" } ] }, { "id": "CVE-2025-69080", "vendor": "JanStudio", "product": "Gecko", "title": "Gecko vulnerability", "summary": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JanStudio Gecko gecko allows PHP Local File Inclusion.This issue affects Gecko: from n/a through <= 1.9.8.", "updated_at": "2026-10-07T09:10:00.160", "published_at": "2026-01-07T12:17:05.990", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.9.8 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-98", "what_happened": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JanStudio Gecko gecko allows PHP Local File Inclusion.This issue affects Gecko: from n/a through <= 1.9.8.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Theme/gecko/vulnerability/wordpress-gecko-theme-1-9-8-local-file-inclusion-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-01-07T12:17:05.990", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69080" } ] }, { "id": "CVE-2025-69034", "vendor": "Mikado-Themes", "product": "Lekker", "title": "Lekker vulnerability", "summary": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Lekker lekker allows PHP Local File Inclusion.This issue affects Lekker: from n/a through <= 1.8.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2025-12-30T11:16:02.063", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.8 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-98", "what_happened": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Lekker lekker allows PHP Local File Inclusion.This issue affects Lekker: from n/a through <= 1.8.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Theme/lekker/vulnerability/wordpress-lekker-theme-1-8-local-file-inclusion-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-30T11:16:02.063", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69034" } ] }, { "id": "CVE-2025-69033", "vendor": "A WP Life", "product": "Blog Filter", "title": "Blog Filter vulnerability", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A WP Life Blog Filter blog-filter allows DOM-Based XSS.This issue affects Blog Filter: from n/a through <= 1.7.3.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2025-12-30T11:16:01.940", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.7.3 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A WP Life Blog Filter blog-filter allows DOM-Based XSS.This issue affects Blog Filter: from n/a through <= 1.7.3.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/blog-filter/vulnerability/wordpress-blog-filter-plugin-1-7-3-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-30T11:16:01.940", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69033" } ] }, { "id": "CVE-2025-69032", "vendor": "Mikado-Themes", "product": "FiveStar", "title": "FiveStar vulnerability", "summary": "Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes FiveStar fivestar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FiveStar: from n/a through <= 1.7.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2025-12-30T11:16:01.827", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.7 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-639", "what_happened": "Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes FiveStar fivestar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FiveStar: from n/a through <= 1.7.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Theme/fivestar/vulnerability/wordpress-fivestar-theme-1-7-insecure-direct-object-references-idor-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-30T11:16:01.827", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69032" } ] }, { "id": "CVE-2025-69031", "vendor": "Skywarrior", "product": "Arcane", "title": "Arcane vulnerability", "summary": "Missing Authorization vulnerability in Skywarrior Arcane arcane allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arcane: from n/a through <= 3.6.6.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2025-12-30T11:16:01.703", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 3.6.6 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in Skywarrior Arcane arcane allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arcane: from n/a through <= 3.6.6.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Theme/arcane/vulnerability/wordpress-arcane-theme-3-6-6-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-30T11:16:01.703", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69031" } ] }, { "id": "CVE-2025-69029", "vendor": "Select-Themes", "product": "Struktur", "title": "Struktur vulnerability", "summary": "Authorization Bypass Through User-Controlled Key vulnerability in Select-Themes Struktur struktur allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Struktur: from n/a through <= 2.5.1.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2025-12-30T11:16:01.470", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.5.1 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-639", "what_happened": "Authorization Bypass Through User-Controlled Key vulnerability in Select-Themes Struktur struktur allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Struktur: from n/a through <= 2.5.1.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Theme/struktur/vulnerability/wordpress-struktur-theme-2-5-1-insecure-direct-object-references-idor-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-30T11:16:01.470", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69029" } ] }, { "id": "CVE-2025-69028", "vendor": "BoldGrid", "product": "weForms", "title": "weForms vulnerability", "summary": "Missing Authorization vulnerability in BoldGrid weForms weforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weForms: from n/a through <= 1.6.25.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2025-12-30T11:16:01.353", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.6.25 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in BoldGrid weForms weforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weForms: from n/a through <= 1.6.25.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/weforms/vulnerability/wordpress-weforms-plugin-1-6-25-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-30T11:16:01.353", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69028" } ] }, { "id": "CVE-2025-69027", "vendor": "tychesoftwares", "product": "Product Delivery Date for WooCommerce – Lite", "title": "Product Delivery Date for WooCommerce – Lite vulnerability", "summary": "Missing Authorization vulnerability in tychesoftwares Product Delivery Date for WooCommerce – Lite product-delivery-date-for-woocommerce-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Delivery Date for WooCommerce – Lite: from n/a through <= 3.2.0.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2025-12-30T11:16:01.243", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 3.2.0 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in tychesoftwares Product Delivery Date for WooCommerce – Lite product-delivery-date-for-woocommerce-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Delivery Date for WooCommerce – Lite: from n/a through <= 3.2.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/product-delivery-date-for-woocommerce-lite/vulnerability/wordpress-product-delivery-date-for-woocommerce-lite-plugin-3-2-0-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-30T11:16:01.243", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69027" } ] }, { "id": "CVE-2025-69025", "vendor": "Aethonic", "product": "Poptics", "title": "Poptics vulnerability", "summary": "Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Aethonic Poptics poptics allows Retrieve Embedded Sensitive Data.This issue affects Poptics: from n/a through <= 1.0.20.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2025-12-30T11:16:01.007", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.0.20 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-497", "what_happened": "Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Aethonic Poptics poptics allows Retrieve Embedded Sensitive Data.This issue affects Poptics: from n/a through <= 1.0.20.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/poptics/vulnerability/wordpress-poptics-ai-powered-popup-builder-for-lead-generation-conversions-exit-intent-email-opt-ins-woocommerce-sales-plugin-1-0-20-sensitive-data-exposure-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-30T11:16:01.007", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69025" } ] }, { "id": "CVE-2025-69024", "vendor": "bizswoop", "product": "BizPrint", "title": "BizPrint vulnerability", "summary": "Missing Authorization vulnerability in bizswoop BizPrint print-google-cloud-print-gcp-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BizPrint: from n/a through <= 4.6.7.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2025-12-30T11:16:00.880", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 4.6.7 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in bizswoop BizPrint print-google-cloud-print-gcp-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BizPrint: from n/a through <= 4.6.7.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/print-google-cloud-print-gcp-woocommerce/vulnerability/wordpress-bizprint-plugin-4-6-7-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-30T11:16:00.880", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69024" } ] }, { "id": "CVE-2025-69023", "vendor": "Marketing Fire", "product": "Discussion Board", "title": "Discussion Board vulnerability", "summary": "Missing Authorization vulnerability in Marketing Fire Discussion Board wp-discussion-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Discussion Board: from n/a through <= 2.5.7.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2025-12-30T11:16:00.763", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.5.7 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in Marketing Fire Discussion Board wp-discussion-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Discussion Board: from n/a through <= 2.5.7.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/wp-discussion-board/vulnerability/wordpress-discussion-board-plugin-2-5-7-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-30T11:16:00.763", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69023" } ] }, { "id": "CVE-2025-69022", "vendor": "Weblizar - WordPress Themes & Plugin", "product": "HR Management Lite", "title": "HR Management Lite vulnerability", "summary": "Missing Authorization vulnerability in Weblizar - WordPress Themes & Plugin HR Management Lite hr-management-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HR Management Lite: from n/a through <= 3.6.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2025-12-30T11:16:00.643", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 3.6 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in Weblizar - WordPress Themes & Plugin HR Management Lite hr-management-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HR Management Lite: from n/a through <= 3.6.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/hr-management-lite/vulnerability/wordpress-hr-management-lite-plugin-3-5-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-30T11:16:00.643", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69022" } ] }, { "id": "CVE-2025-69021", "vendor": "Ays Pro", "product": "Popup box", "title": "Popup box vulnerability", "summary": "Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box ays-popup-box allows Cross Site Request Forgery.This issue affects Popup box: from n/a through <= 6.0.7.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2025-12-30T11:16:00.517", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 6.0.7 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-352", "what_happened": "Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box ays-popup-box allows Cross Site Request Forgery.This issue affects Popup box: from n/a through <= 6.0.7.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/ays-popup-box/vulnerability/wordpress-popup-box-plugin-6-0-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-30T11:16:00.517", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69021" } ] }, { "id": "CVE-2025-69020", "vendor": "Tribulant Software", "product": "Newsletters", "title": "Newsletters vulnerability", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Stored XSS.This issue affects Newsletters: from n/a through <= 4.12.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2025-12-30T11:16:00.393", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 4.12 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Stored XSS.This issue affects Newsletters: from n/a through <= 4.12.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/newsletters-lite/vulnerability/wordpress-newsletters-plugin-4-12-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-30T11:16:00.393", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69020" } ] }, { "id": "CVE-2025-69019", "vendor": "FlippingBook", "product": "FlippingBook", "title": "FlippingBook vulnerability", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FlippingBook FlippingBook flippingbook allows DOM-Based XSS.This issue affects FlippingBook: from n/a through <= 2.0.1.", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2025-12-30T11:16:00.260", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.0.1 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FlippingBook FlippingBook flippingbook allows DOM-Based XSS.This issue affects FlippingBook: from n/a through <= 2.0.1.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/flippingbook/vulnerability/wordpress-flippingbook-plugin-2-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-30T11:16:00.260", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69019" } ] }, { "id": "CVE-2025-69018", "vendor": "Shamalli", "product": "Web Directory Free", "title": "Web Directory Free vulnerability", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamalli Web Directory Free web-directory-free allows DOM-Based XSS.This issue affects Web Directory Free: from n/a through <= 1.7.12.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2025-12-30T11:16:00.130", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.7.12 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamalli Web Directory Free web-directory-free allows DOM-Based XSS.This issue affects Web Directory Free: from n/a through <= 1.7.12.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/web-directory-free/vulnerability/wordpress-web-directory-free-plugin-1-7-12-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-30T11:16:00.130", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69018" } ] }, { "id": "CVE-2025-69017", "vendor": "Magnigenie", "product": "RestroPress", "title": "RestroPress vulnerability", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magnigenie RestroPress restropress allows Stored XSS.This issue affects RestroPress: from n/a through <= 3.2.8.6.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2025-12-30T11:16:00.017", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 3.2.8.6 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magnigenie RestroPress restropress allows Stored XSS.This issue affects RestroPress: from n/a through <= 3.2.8.6.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/restropress/vulnerability/wordpress-restropress-plugin-3-2-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-30T11:16:00.017", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69017" } ] }, { "id": "CVE-2025-69016", "vendor": "averta", "product": "Shortcodes and extra features for Phlox theme", "title": "Shortcodes and extra features for Phlox theme vulnerability", "summary": "Missing Authorization vulnerability in averta Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcodes and extra features for Phlox theme: from n/a through <= 2.17.15.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2025-12-30T11:15:59.887", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.17.15 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in averta Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcodes and extra features for Phlox theme: from n/a through <= 2.17.15.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/auxin-elements/vulnerability/wordpress-shortcodes-and-extra-features-for-phlox-theme-plugin-2-17-12-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-30T11:15:59.887", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69016" } ] }, { "id": "CVE-2025-69014", "vendor": "Youzify", "product": "Youzify", "title": "Youzify vulnerability", "summary": "Server-Side Request Forgery (SSRF) vulnerability in Youzify Youzify youzify allows Server Side Request Forgery.This issue affects Youzify: from n/a through <= 1.3.7.", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2025-12-30T11:15:59.650", "cvss": 4.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.3.7 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "High", "cwe": "CWE-918", "what_happened": "Server-Side Request Forgery (SSRF) vulnerability in Youzify Youzify youzify allows Server Side Request Forgery.This issue affects Youzify: from n/a through <= 1.3.7.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/youzify/vulnerability/wordpress-youzify-plugin-1-3-5-server-side-request-forgery-ssrf-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-30T11:15:59.650", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69014" } ] }, { "id": "CVE-2025-68973", "vendor": "GnuPG", "product": "GnuPG", "title": "GnuPG vulnerability", "summary": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "updated_at": "2026-10-13T09:10:00.323", "published_at": "2025-12-28T17:16:01.500", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "before 2.2.51 (semver); 2.3.0 through before 2.4.9 (semver)", "fixed": "See vendor advisory", "source_count": 10, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "High", "cwe": "CWE-675", "what_happened": "In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/gpg/gnupg/blob/ff30683418695f5d2cc9e6cf8c9418e09378ebe4/g10/armor.c#L1305-L1306", "https://github.com/gpg/gnupg/commit/115d138ba599328005c5321c0ef9f00355838ca9", "https://github.com/gpg/gnupg/compare/gnupg-2.2.50...gnupg-2.2.51", "https://gpg.fail/memcpy", "https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i", "https://news.ycombinator.com/item?id=46403200", "https://www.openwall.com/lists/oss-security/2025/12/28/5", "http://www.openwall.com/lists/oss-security/2025/12/29/11", "https://lists.debian.org/debian-lts-announce/2026/01/msg00008.html" ], "timeline": [ { "at": "2025-12-28T17:16:01.500", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68973" } ] }, { "id": "CVE-2025-68972", "vendor": "GnuPG", "product": "GnuPG", "title": "GnuPG vulnerability", "summary": "In GnuPG through 2.4.8, if a signed message has \\f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an \"invalid armor\" message is printed during verification). This is related to use of \\f as a marker to denote truncation of a long plaintext line.", "updated_at": "2026-10-13T09:10:00.323", "published_at": "2025-12-27T23:15:40.900", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.4.8 (semver)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "High", "cwe": "CWE-347", "what_happened": "In GnuPG through 2.4.8, if a signed message has \\f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an \"invalid armor\" message is printed during verification). This is related to use of \\f as a marker to denote truncation of a long plaintext line.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://gpg.fail/formfeed", "https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i", "https://news.ycombinator.com/item?id=46404339" ], "timeline": [ { "at": "2025-12-27T23:15:40.900", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68972" } ] }, { "id": "CVE-2025-68952", "vendor": "eigent-ai", "product": "eigent", "title": "eigent vulnerability", "summary": "Eigent is a multi-agent Workforce. In version 0.0.60, a 1-click Remote Code Execution (RCE) vulnerability has been identified in Eigent. This vulnerability allows an attacker to execute arbitrary code on the victim's machine or server through a specific interaction (1-click). This issue has been patched in version 0.0.61.", "updated_at": "2026-10-13T09:10:00.323", "published_at": "2025-12-27T01:15:42.853", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "= 0.0.60", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-94", "what_happened": "Eigent is a multi-agent Workforce. In version 0.0.60, a 1-click Remote Code Execution (RCE) vulnerability has been identified in Eigent. This vulnerability allows an attacker to execute arbitrary code on the victim's machine or server through a specific interaction (1-click). This issue has been patched in version 0.0.61.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/eigent-ai/eigent/security/advisories/GHSA-pwcx-28p4-rmq4" ], "timeline": [ { "at": "2025-12-27T01:15:42.853", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68952" } ] }, { "id": "CVE-2025-68948", "vendor": "siyuan-note", "product": "siyuan", "title": "siyuan vulnerability", "summary": "SiYuan is self-hosted, open source personal knowledge management software. In versions 3.5.1 and prior, the SiYuan Note application utilizes a hardcoded cryptographic secret for its session store. This unsafe practice renders the session encryption ineffective. Since the sensitive AccessAuthCode is stored within the session cookie, an attacker who intercepts or obtains a user's encrypted session cookie (e.g., via session hijacking) can locally decrypt it using the public key. Once decrypted, the attacker can retrieve the AccessAuthCode in plain text and use it to authenticate or take over the session.", "updated_at": "2026-10-13T09:10:00.323", "published_at": "2025-12-27T01:15:42.720", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "<= 3.5.1", "fixed": "See vendor advisory", "source_count": 24, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-321", "what_happened": "SiYuan is self-hosted, open source personal knowledge management software. In versions 3.5.1 and prior, the SiYuan Note application utilizes a hardcoded cryptographic secret for its session store. This unsafe practice renders the session encryption ineffective. Since the sensitive AccessAuthCode is stored within the session cookie, an attacker who intercepts or obtains a user's encrypted session cookie (e.g., via session hijacking) can locally decrypt it using the public key. Once decrypted, the attacker can retrieve the AccessAuthCode in plain text and use it to authenticate or take over the session.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-12-27", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-f7ph-rc3w-qp28" } ], "references": [ "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-f7ph-rc3w-qp28" ], "timeline": [ { "at": "2025-12-27T01:15:42.720", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68948" } ] }, { "id": "CVE-2025-68932", "vendor": "FreshRSS", "product": "FreshRSS", "title": "FreshRSS vulnerability", "summary": "FreshRSS is a free, self-hostable RSS aggregator. Prior to version 1.28.0, FreshRSS uses cryptographically weak random number generators (mt_rand() and uniqid()) to generate remember-me authentication tokens and challenge-response nonces. This allows attackers to predict valid session tokens, leading to account takeover through persistent session hijacking. The remember-me tokens provide permanent authentication and are the sole credential for \"keep me logged in\" functionality. This issue has been patched in version 1.28.0.", "updated_at": "2026-10-13T09:10:00.323", "published_at": "2025-12-27T00:15:42.633", "cvss": 2.9, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "< 1.28.0", "fixed": "See vendor advisory", "source_count": 26, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-338", "what_happened": "FreshRSS is a free, self-hostable RSS aggregator. Prior to version 1.28.0, FreshRSS uses cryptographically weak random number generators (mt_rand() and uniqid()) to generate remember-me authentication tokens and challenge-response nonces. This allows attackers to predict valid session tokens, leading to account takeover through persistent session hijacking. The remember-me tokens provide permanent authentication and are the sole credential for \"keep me logged in\" functionality. This issue has been patched in version 1.28.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-12-27", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-j9wc-gwc6-p786" } ], "references": [ "https://github.com/FreshRSS/FreshRSS/commit/57e1a375cbd2db9741ff19167813344f8eff5772", "https://github.com/FreshRSS/FreshRSS/pull/8061", "https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-j9wc-gwc6-p786" ], "timeline": [ { "at": "2025-12-27T00:15:42.633", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68932" } ] }, { "id": "CVE-2025-68929", "vendor": "frappe", "product": "frappe", "title": "frappe vulnerability", "summary": "Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions could be tricked into accessing a specially crafted link. This could lead to a malicious template being executed on the server, resulting in remote code execution. Versions 14.99.6 and 15.88.1 fix the issue. No known workarounds are available.", "updated_at": "2026-10-13T09:10:00.323", "published_at": "2025-12-29T15:16:02.033", "cvss": 9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "< 14.99.6; >= 15.0.0, < 15.88.1", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-1336", "what_happened": "Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions could be tricked into accessing a specially crafted link. This could lead to a malicious template being executed on the server, resulting in remote code execution. Versions 14.99.6 and 15.88.1 fix the issue. No known workarounds are available.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/frappe/frappe/releases/tag/v14.99.6", "https://github.com/frappe/frappe/releases/tag/v15.88.1", "https://github.com/frappe/frappe/security/advisories/GHSA-qq98-vfv9-xmxh" ], "timeline": [ { "at": "2025-12-29T15:16:02.033", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68929" } ] }, { "id": "CVE-2025-68921", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Local Privilege Escalation Affecting Millions of Gaming Laptops", "summary": "Local Privilege Escalation Affecting Millions of Gaming Laptops", "updated_at": "2026-10-03T08:16:11Z", "published_at": "2026-10-03T08:16:11Z", "cvss": 7.8, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 361, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Security app CVE-2025-68921 for gaming laptops downloads a zip from GitHub for Windows 10+", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "PoC-in-GitHub · ZeroMemoryEx/CVE-2025-68921", "author": "ZeroMemoryEx", "first_seen": "2026-01-12", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 62, "title": "Local Privilege Escalation Affecting Millions of Gaming Laptops", "summary": "Local Privilege Escalation Affecting Millions of Gaming Laptops", "url": "https://github.com/ZeroMemoryEx/CVE-2025-68921" }, { "repository": "PoC-in-GitHub · kikiuuw/CVE-2025-68921", "author": "kikiuuw", "first_seen": "2026-01-24", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "🔍 Identify and understand the local privilege escalation vulnerability (CVE-2025-68921) in Nahimic audio software, impacting many gaming laptops.", "summary": "🔍 Identify and understand the local privilege escalation vulnerability (CVE-2025-68921) in Nahimic audio software, impacting many gaming laptops.", "url": "https://github.com/kikiuuw/CVE-2025-68921" }, { "repository": "PoC-in-GitHub · kikiuuw/kikiuuw.github.io", "author": "kikiuuw", "first_seen": "2026-01-25", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "🔍 Explore the CVE-2025-68921 vulnerability in Nahimic, enabling local privilege escalation to `NT AUTHORITY\\SYSTEM`.", "summary": "🔍 Explore the CVE-2025-68921 vulnerability in Nahimic, enabling local privilege escalation to `NT AUTHORITY\\SYSTEM`.", "url": "https://github.com/kikiuuw/kikiuuw.github.io" }, { "repository": "PoC-in-GitHub · kalibb/CVE-2025-68921", "author": "kalibb", "first_seen": "2026-02-06", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 0, "title": "CVE-2025-68921 repository", "summary": "", "url": "https://github.com/kalibb/CVE-2025-68921" }, { "title": "Exploit for CVE-2025-68921", "summary": "Security app CVE-2025-68921 for gaming laptops downloads a zip from GitHub for Windows 10+", "what_happened": "Security app CVE-2025-68921 for gaming laptops downloads a zip from GitHub for Windows 10+", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-KIKIUUW-CVE-2025-68921", "https://kitploit.com/ru/tools/github/kikiuuw/cve-2025-68921/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-09-22T06:16:33", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-KIKIUUW-CVE-2025-68921" }, { "title": "Exploit for CVE-2025-68921", "summary": "Security app CVE-2025-68921 for gaming laptops downloads a zip from GitHub for Windows 10+", "what_happened": "Security app CVE-2025-68921 for gaming laptops downloads a zip from GitHub for Windows 10+", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-KIKIUUW-CVE-2025-68921", "https://kitploit.com/ru/tools/github/kikiuuw/cve-2025-68921/" ], "repository": "kitploit.com", "author": "ru", "first_seen": "2026-09-22T06:16:33", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/ru/tools/github/kikiuuw/cve-2025-68921/" } ], "references": [ "https://github.com/ZeroMemoryEx/CVE-2025-68921", "https://github.com/kikiuuw/CVE-2025-68921", "https://github.com/kikiuuw/kikiuuw.github.io", "https://github.com/kalibb/CVE-2025-68921", "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-KIKIUUW-CVE-2025-68921", "https://kitploit.com/ru/tools/github/kikiuuw/cve-2025-68921/" ], "timeline": [ { "at": "2026-10-03T08:16:11Z", "label": "Discovered through PoC-in-GitHub", "url": "https://github.com/ZeroMemoryEx/CVE-2025-68921" } ] }, { "id": "CVE-2025-68860", "vendor": "Mobile Builder", "product": "Mobile builder", "title": "Mobile builder vulnerability", "summary": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Mobile Builder Mobile builder mobile-builder allows Authentication Abuse.This issue affects Mobile builder: from n/a through <= 1.4.2.", "updated_at": "2026-10-13T09:10:00.323", "published_at": "2025-12-29T22:15:43.597", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.4.2 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-288", "what_happened": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Mobile Builder Mobile builder mobile-builder allows Authentication Abuse.This issue affects Mobile builder: from n/a through <= 1.4.2.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/mobile-builder/vulnerability/wordpress-mobile-builder-plugin-1-4-2-broken-authentication-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-29T22:15:43.597", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68860" } ] }, { "id": "CVE-2025-68740", "vendor": "Linux", "product": "Linux", "title": "Linux vulnerability", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nima: Handle error code returned by ima_filter_rule_match()\n\nIn ima_match_rules(), if ima_filter_rule_match() returns -ENOENT due to\nthe rule being NULL, the function incorrectly skips the 'if (!rc)' check\nand sets 'result = true'. The LSM rule is considered a match, causing\nextra files to be measured by IMA.\n\nThis issue can be reproduced in the following scenario:\nAfter unloading the SELinux policy module via 'semodule -d', if an IMA\nmeasurement is triggered before ima_lsm_rules is updated,\nin ima_match_rules(), the first call to ima_filter_rule_match() returns\n-ESTALE. This causes the code to enter the 'if (rc == -ESTALE &&\n!rule_reinitialized)' block, perform ima_lsm_copy_rule() and retry. In\nima_lsm_copy_rule(), since the SELinux module has been removed, the rule\nbecomes NULL, and the second call to ima_filter_rule_match() returns\n-ENOENT. This bypasses the 'if (!rc)' check and results in a false match.\n\nCall trace:\n selinux_audit_rule_match+0x310/0x3b8\n security_audit_rule_match+0x60/0xa0\n ima_match_rules+0x2e4/0x4a0\n ima_match_policy+0x9c/0x1e8\n ima_get_action+0x48/0x60\n process_measurement+0xf8/0xa98\n ima_bprm_check+0x98/0xd8\n security_bprm_check+0x5c/0x78\n search_binary_handler+0x6c/0x318\n exec_binprm+0x58/0x1b8\n bprm_execve+0xb8/0x130\n do_execveat_common.isra.0+0x1a8/0x258\n __arm64_sys_execve+0x48/0x68\n invoke_syscall+0x50/0x128\n el0_svc_common.constprop.0+0xc8/0xf0\n do_el0_svc+0x24/0x38\n el0_svc+0x44/0x200\n el0t_64_sync_handler+0x100/0x130\n el0t_64_sync+0x3c8/0x3d0\n\nFix this by changing 'if (!rc)' to 'if (rc <= 0)' to ensure that error\ncodes like -ENOENT do not bypass the check and accidentally result in a\nsuccessful match.", "updated_at": "2026-09-29T19:10:00.160", "published_at": "2025-12-24T13:16:28.943", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "4af4662fa4a9dc62289c580337ae2506339c4729 through before d14e0ec6a6828ee0dffa163fb5d513c9a21f0a51 (git); 4af4662fa4a9dc62289c580337ae2506339c4729 through before f2f4627b74c120fcdd8e1db93bc91f9bbaf46f85 (git); 4af4662fa4a9dc62289c580337ae2506339c4729 through before 88cd5fbf5869731be8fc6f7cecb4e0d6ab3d8749 (git); 4af4662fa4a9dc62289c580337ae2506339c4729 through before cca3e7df3c0f99542033657ba850b9a6d27f8784 (git); 4af4662fa4a9dc62289c580337ae2506339c4729 through before c2238d487a640ae3511e1b6f4640ab27ce10d7f6 (git); 4af4662fa4a9dc62289c580337ae2506339c4729 through before de4431faf308d0c533cb386f5fa9af009bc86158 (git); 4af4662fa4a9dc62289c580337ae2506339c4729 through before 32952c4f4d1b2deb30dce72ba109da808a9018e1 (git); 4af4662fa4a9dc62289c580337ae2506339c4729 through before 738c9738e690f5cea24a3ad6fd2d9a323cf614f6 (git); 2.6.30", "fixed": "See vendor advisory", "source_count": 8, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "In the Linux kernel, the following vulnerability has been resolved:\n\nima: Handle error code returned by ima_filter_rule_match()\n\nIn ima_match_rules(), if ima_filter_rule_match() returns -ENOENT due to\nthe rule being NULL, the function incorrectly skips the 'if (!rc)' check\nand sets 'result = true'. The LSM rule is considered a match, causing\nextra files to be measured by IMA.\n\nThis issue can be reproduced in the following scenario:\nAfter unloading the SELinux policy module via 'semodule -d', if an IMA\nmeasurement is triggered before ima_lsm_rules is updated,\nin ima_match_rules(), the first call to ima_filter_rule_match() returns\n-ESTALE. This causes the code to enter the 'if (rc == -ESTALE &&\n!rule_reinitialized)' block, perform ima_lsm_copy_rule() and retry. In\nima_lsm_copy_rule(), since the SELinux module has been removed, the rule\nbecomes NULL, and the second call to ima_filter_rule_match() returns\n-ENOENT. This bypasses the 'if (!rc)' check and results in a false match.\n\nCall trace:\n selinux_audit_rule_match+0x310/0x3b8\n security_audit_rule_match+0x60/0xa0\n ima_match_rules+0x2e4/0x4a0\n ima_match_policy+0x9c/0x1e8\n ima_get_action+0x48/0x60\n process_measurement+0xf8/0xa98\n ima_bprm_check+0x98/0xd8\n security_bprm_check+0x5c/0x78\n search_binary_handler+0x6c/0x318\n exec_binprm+0x58/0x1b8\n bprm_execve+0xb8/0x130\n do_execveat_common.isra.0+0x1a8/0x258\n __arm64_sys_execve+0x48/0x68\n invoke_syscall+0x50/0x128\n el0_svc_common.constprop.0+0xc8/0xf0\n do_el0_svc+0x24/0x38\n el0_svc+0x44/0x200\n el0t_64_sync_handler+0x100/0x130\n el0t_64_sync+0x3c8/0x3d0\n\nFix this by changing 'if (!rc)' to 'if (rc <= 0)' to ensure that error\ncodes like -ENOENT do not bypass the check and accidentally result in a\nsuccessful match.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://git.kernel.org/stable/c/32952c4f4d1b2deb30dce72ba109da808a9018e1", "https://git.kernel.org/stable/c/738c9738e690f5cea24a3ad6fd2d9a323cf614f6", "https://git.kernel.org/stable/c/88cd5fbf5869731be8fc6f7cecb4e0d6ab3d8749", "https://git.kernel.org/stable/c/c2238d487a640ae3511e1b6f4640ab27ce10d7f6", "https://git.kernel.org/stable/c/cca3e7df3c0f99542033657ba850b9a6d27f8784", "https://git.kernel.org/stable/c/d14e0ec6a6828ee0dffa163fb5d513c9a21f0a51", "https://git.kernel.org/stable/c/de4431faf308d0c533cb386f5fa9af009bc86158", "https://git.kernel.org/stable/c/f2f4627b74c120fcdd8e1db93bc91f9bbaf46f85" ], "timeline": [ { "at": "2025-12-24T13:16:28.943", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68740" } ] }, { "id": "CVE-2025-68736", "vendor": "Linux", "product": "Linux", "title": "Linux vulnerability", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nlandlock: Fix handling of disconnected directories\n\nDisconnected files or directories can appear when they are visible and\nopened from a bind mount, but have been renamed or moved from the source\nof the bind mount in a way that makes them inaccessible from the mount\npoint (i.e. out of scope).\n\nPreviously, access rights tied to files or directories opened through a\ndisconnected directory were collected by walking the related hierarchy\ndown to the root of the filesystem, without taking into account the\nmount point because it couldn't be found. This could lead to\ninconsistent access results, potential access right widening, and\nhard-to-debug renames, especially since such paths cannot be printed.\n\nFor a sandboxed task to create a disconnected directory, it needs to\nhave write access (i.e. FS_MAKE_REG, FS_REMOVE_FILE, and FS_REFER) to\nthe underlying source of the bind mount, and read access to the related\nmount point. Because a sandboxed task cannot acquire more access\nrights than those defined by its Landlock domain, this could lead to\ninconsistent access rights due to missing permissions that should be\ninherited from the mount point hierarchy, while inheriting permissions\nfrom the filesystem hierarchy hidden by this mount point instead.\n\nLandlock now handles files and directories opened from disconnected\ndirectories by taking into account the filesystem hierarchy when the\nmount point is not found in the hierarchy walk, and also always taking\ninto account the mount point from which these disconnected directories\nwere opened. This ensures that a rename is not allowed if it would\nwiden access rights [1].\n\nThe rationale is that, even if disconnected hierarchies might not be\nvisible or accessible to a sandboxed task, relying on the collected\naccess rights from them improves the guarantee that access rights will\nnot be widened during a rename because of the access right comparison\nbetween the source and the destination (see LANDLOCK_ACCESS_FS_REFER).\nIt may look like this would grant more access on disconnected files and\ndirectories, but the security policies are always enforced for all the\nevaluated hierarchies. This new behavior should be less surprising to\nusers and safer from an access control perspective.\n\nRemove a wrong WARN_ON_ONCE() canary in collect_domain_accesses() and\nfix the related comment.\n\nBecause opened files have their access rights stored in the related file\nsecurity properties, there is no impact for disconnected or unlinked\nfiles.", "updated_at": "2026-10-03T11:17:33.290", "published_at": "2025-12-24T13:16:28.550", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "cb2c7d1a1776057c9a1f48ed1250d85e94d4850d through before 4f5cdc82a6c7e22cfd9a92d203cec13a52a3f363 (git); cb2c7d1a1776057c9a1f48ed1250d85e94d4850d through before fbf718d5afe21057694a0c0223a18b0c7a5960b6 (git); cb2c7d1a1776057c9a1f48ed1250d85e94d4850d through before 426d5b681b2f3339ff04da39b81d71176dc8c87c (git); cb2c7d1a1776057c9a1f48ed1250d85e94d4850d through before cadb28f8b3fd6908e3051e86158c65c3a8e1c907 (git); cb2c7d1a1776057c9a1f48ed1250d85e94d4850d through before 49c9e09d961025b22e61ef9ad56aa1c21b6ce2f1 (git); 5.13", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "what_happened": "In the Linux kernel, the following vulnerability has been resolved:\n\nlandlock: Fix handling of disconnected directories\n\nDisconnected files or directories can appear when they are visible and\nopened from a bind mount, but have been renamed or moved from the source\nof the bind mount in a way that makes them inaccessible from the mount\npoint (i.e. out of scope).\n\nPreviously, access rights tied to files or directories opened through a\ndisconnected directory were collected by walking the related hierarchy\ndown to the root of the filesystem, without taking into account the\nmount point because it couldn't be found. This could lead to\ninconsistent access results, potential access right widening, and\nhard-to-debug renames, especially since such paths cannot be printed.\n\nFor a sandboxed task to create a disconnected directory, it needs to\nhave write access (i.e. FS_MAKE_REG, FS_REMOVE_FILE, and FS_REFER) to\nthe underlying source of the bind mount, and read access to the related\nmount point. Because a sandboxed task cannot acquire more access\nrights than those defined by its Landlock domain, this could lead to\ninconsistent access rights due to missing permissions that should be\ninherited from the mount point hierarchy, while inheriting permissions\nfrom the filesystem hierarchy hidden by this mount point instead.\n\nLandlock now handles files and directories opened from disconnected\ndirectories by taking into account the filesystem hierarchy when the\nmount point is not found in the hierarchy walk, and also always taking\ninto account the mount point from which these disconnected directories\nwere opened. This ensures that a rename is not allowed if it would\nwiden access rights [1].\n\nThe rationale is that, even if disconnected hierarchies might not be\nvisible or accessible to a sandboxed task, relying on the collected\naccess rights from them improves the guarantee that access rights will\nnot be widened during a rename because of the access right comparison\nbetween the source and the destination (see LANDLOCK_ACCESS_FS_REFER).\nIt may look like this would grant more access on disconnected files and\ndirectories, but the security policies are always enforced for all the\nevaluated hierarchies. This new behavior should be less surprising to\nusers and safer from an access control perspective.\n\nRemove a wrong WARN_ON_ONCE() canary in collect_domain_accesses() and\nfix the related comment.\n\nBecause opened files have their access rights stored in the related file\nsecurity properties, there is no impact for disconnected or unlinked\nfiles.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://git.kernel.org/stable/c/426d5b681b2f3339ff04da39b81d71176dc8c87c", "https://git.kernel.org/stable/c/49c9e09d961025b22e61ef9ad56aa1c21b6ce2f1", "https://git.kernel.org/stable/c/4f5cdc82a6c7e22cfd9a92d203cec13a52a3f363", "https://git.kernel.org/stable/c/cadb28f8b3fd6908e3051e86158c65c3a8e1c907", "https://git.kernel.org/stable/c/fbf718d5afe21057694a0c0223a18b0c7a5960b6" ], "timeline": [ { "at": "2025-12-24T13:16:28.550", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68736" } ] }, { "id": "CVE-2025-68713", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "An issue was discovered in Rakuten Send Anywhere (File Transfer) for Android (com.estmob.android.sendanywhere) 23.2.9. The vulnerability allows untrusted applications (with no permissions) to force arbitrary file downloads into the app's scoped storage. The resulting files appear in the application's trusted Received interface. These conditions establish a vector for arbitrary code execution if the payload is an APK file, or a denial-of-service condition through resource exhaustion from oversized transfers.", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-06-15T20:16:24.703", "cvss": 8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-926", "what_happened": "An issue was discovered in Rakuten Send Anywhere (File Transfer) for Android (com.estmob.android.sendanywhere) 23.2.9. The vulnerability allows untrusted applications (with no permissions) to force arbitrary file downloads into the app's scoped storage. The resulting files appear in the application's trusted Received interface. These conditions establish a vector for arbitrary code execution if the payload is an APK file, or a denial-of-service condition through resource exhaustion from oversized transfers.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/actuator/com.estmob.android.sendanywhere/blob/main/CVE-2025-68713" ], "timeline": [ { "at": "2026-06-15T20:16:24.703", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68713" } ] }, { "id": "CVE-2025-68712", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "SpSoft AppLock (com.sp.protector.free) 7.9.40 for Android allows a local attacker with physical access to bypass fingerprint or PIN authentication. Although the app integrates Android's biometric mechanisms, the lock is implemented with a custom overlay that fails to consistently enforce authentication. By navigating cascading interface flows - insecure navigation through exposed routes facilitates app control evasion {I.N.T.E.R.F.A.C.E] via advertisement or browser intents - an attacker can exit the lock interface without re-authentication and access protected apps (e.g., Chrome). This results in information disclosure and privilege escalation.", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-05-27T17:16:29.063", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-285", "what_happened": "SpSoft AppLock (com.sp.protector.free) 7.9.40 for Android allows a local attacker with physical access to bypass fingerprint or PIN authentication. Although the app integrates Android's biometric mechanisms, the lock is implemented with a custom overlay that fails to consistently enforce authentication. By navigating cascading interface flows - insecure navigation through exposed routes facilitates app control evasion {I.N.T.E.R.F.A.C.E] via advertisement or browser intents - an attacker can exit the lock interface without re-authentication and access protected apps (e.g., Chrome). This results in information disclosure and privilege escalation.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/actuator/com.sp.protector.free", "https://github.com/actuator/com.sp.protector.free/blob/main/CVE-2025-68712", "https://play.google.com/store/apps/details?id=com.sp.protector.free" ], "timeline": [ { "at": "2026-05-27T17:16:29.063", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68712" } ] }, { "id": "CVE-2025-68697", "vendor": "n8n-io", "product": "n8n", "title": "n8n vulnerability", "summary": "n8n is an open source workflow automation platform. Prior to version 2.0.0, in self-hosted n8n instances where the Code node runs in legacy (non-task-runner) JavaScript execution mode, authenticated users with workflow editing access can invoke internal helper functions from within the Code node. This allows a workflow editor to perform actions on the n8n host with the same privileges as the n8n process, including: reading files from the host filesystem (subject to any file-access restrictions configured on the instance and OS/container permissions), and writing files to the host filesystem (subject to the same restrictions). This issue has been patched in version 2.0.0. Workarounds for this issue involve limiting file operations by setting N8N_RESTRICT_FILE_ACCESS_TO to a dedicated directory (e.g., ~/.n8n-files) and ensure it contains no sensitive data, keeping N8N_BLOCK_FILE_ACCESS_TO_N8N_FILES=true (default) to block access to .n8n and user-defined config files, and disabling high-risk nodes (including the Code node) using NODES_EXCLUDE if workflow editors are not fully trusted.", "updated_at": "2026-10-13T09:10:00.323", "published_at": "2025-12-26T22:15:52.777", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "< 2.0.0", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-269", "what_happened": "n8n is an open source workflow automation platform. Prior to version 2.0.0, in self-hosted n8n instances where the Code node runs in legacy (non-task-runner) JavaScript execution mode, authenticated users with workflow editing access can invoke internal helper functions from within the Code node. This allows a workflow editor to perform actions on the n8n host with the same privileges as the n8n process, including: reading files from the host filesystem (subject to any file-access restrictions configured on the instance and OS/container permissions), and writing files to the host filesystem (subject to the same restrictions). This issue has been patched in version 2.0.0. Workarounds for this issue involve limiting file operations by setting N8N_RESTRICT_FILE_ACCESS_TO to a dedicated directory (e.g., ~/.n8n-files) and ensure it contains no sensitive data, keeping N8N_BLOCK_FILE_ACCESS_TO_N8N_FILES=true (default) to block access to .n8n and user-defined config files, and disabling high-risk nodes (including the Code node) using NODES_EXCLUDE if workflow editors are not fully trusted.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/n8n-io/n8n/security/advisories/GHSA-j4p8-h8mh-rh8q" ], "timeline": [ { "at": "2025-12-26T22:15:52.777", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68697" } ] }, { "id": "CVE-2025-68637", "vendor": "Apache Software Foundation", "product": "Apache Uniffle", "title": "Apache Uniffle vulnerability", "summary": "The Uniffle HTTP client is configured to trust all SSL certificates and\n\ndisables hostname verification by default. This insecure configuration\nexposes all REST API communication between the Uniffle CLI/client and the\nUniffle Coordinator service to potential Man-in-the-Middle (MITM) attacks.\n\n\nThis issue affects all versions from before 0.10.0.\n\nUsers are recommended to upgrade to version 0.10.0, which fixes the issue.", "updated_at": "2026-10-07T09:10:00.160", "published_at": "2026-01-07T12:17:05.860", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "before 0.10.0 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-297", "what_happened": "The Uniffle HTTP client is configured to trust all SSL certificates and\n\ndisables hostname verification by default. This insecure configuration\nexposes all REST API communication between the Uniffle CLI/client and the\nUniffle Coordinator service to potential Man-in-the-Middle (MITM) attacks.\n\n\nThis issue affects all versions from before 0.10.0.\n\nUsers are recommended to upgrade to version 0.10.0, which fixes the issue.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://lists.apache.org/thread/trvdd11hmpbjno3t8rc9okr4t036ox2v", "http://www.openwall.com/lists/oss-security/2025/12/27/2" ], "timeline": [ { "at": "2026-01-07T12:17:05.860", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68637" } ] }, { "id": "CVE-2025-68620", "vendor": "SignalK", "product": "signalk-server", "title": "signalk-server vulnerability", "summary": "Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 expose two features that can be chained together to steal JWT authentication tokens without any prior authentication. The attack combines WebSocket-based request enumeration with unauthenticated polling of access request status. The first is Unauthenticated WebSocket Request Enumeration: When a WebSocket client connects to the SignalK stream endpoint with the `serverevents=all` query parameter, the server sends all cached server events including `ACCESS_REQUEST` events that contain details about pending access requests. The `startServerEvents` function iterates over `app.lastServerEvents` and writes each cached event to any connected client without verifying authorization level. Since WebSocket connections are allowed for readonly users (which includes unauthenticated users when `allow_readonly` is true), attackers receive these events containing request IDs, client identifiers, descriptions, requested permissions, and IP addresses. The second is Unauthenticated Token Polling: The access request status endpoint at `/signalk/v1/access/requests/:id` returns the full state of an access request without requiring authentication. When an administrator approves a request, the response includes the issued JWT token in plaintext. The `queryRequest` function returns the complete request object including the token field, and the REST endpoint uses readonly authentication, allowing unauthenticated access. An attacker has two paths to exploit these vulnerabilities. Either the attacker creates their own access request (using the IP spoofing vulnerability to craft a convincing spoofed request), then polls their own request ID until an administrator approves it, receiving the JWT token; or the attacker passively monitors the WebSocket stream to discover request IDs from legitimate devices, then polls those IDs and steals the JWT tokens when administrators approve them, hijacking legitimate device credentials. Both paths require zero authentication and enable complete authentication bypass. Version 2.19.0 fixes the underlying issues.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2026-01-01T19:15:53.910", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "confidence": 100, "confidence_label": "verified", "affected": "< 2.19.0", "fixed": "See vendor advisory", "source_count": 68, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-288", "what_happened": "Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 expose two features that can be chained together to steal JWT authentication tokens without any prior authentication. The attack combines WebSocket-based request enumeration with unauthenticated polling of access request status. The first is Unauthenticated WebSocket Request Enumeration: When a WebSocket client connects to the SignalK stream endpoint with the `serverevents=all` query parameter, the server sends all cached server events including `ACCESS_REQUEST` events that contain details about pending access requests. The `startServerEvents` function iterates over `app.lastServerEvents` and writes each cached event to any connected client without verifying authorization level. Since WebSocket connections are allowed for readonly users (which includes unauthenticated users when `allow_readonly` is true), attackers receive these events containing request IDs, client identifiers, descriptions, requested permissions, and IP addresses. The second is Unauthenticated Token Polling: The access request status endpoint at `/signalk/v1/access/requests/:id` returns the full state of an access request without requiring authentication. When an administrator approves a request, the response includes the issued JWT token in plaintext. The `queryRequest` function returns the complete request object including the token field, and the REST endpoint uses readonly authentication, allowing unauthenticated access. An attacker has two paths to exploit these vulnerabilities. Either the attacker creates their own access request (using the IP spoofing vulnerability to craft a convincing spoofed request), then polls their own request ID until an administrator approves it, receiving the JWT token; or the attacker passively monitors the WebSocket stream to discover request IDs from legitimate devices, then polls those IDs and steals the JWT tokens when administrators approve them, hijacking legitimate device credentials. Both paths require zero authentication and enable complete authentication bypass. Version 2.19.0 fixes the underlying issues.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2026-01-01", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-fq56-hvg6-wvm5" } ], "references": [ "https://github.com/SignalK/signalk-server/releases/tag/v2.19.0", "https://github.com/SignalK/signalk-server/security/advisories/GHSA-fq56-hvg6-wvm5" ], "timeline": [ { "at": "2026-01-01T19:15:53.910", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68620" } ] }, { "id": "CVE-2025-68619", "vendor": "SignalK", "product": "signalk-server", "title": "signalk-server vulnerability", "summary": "Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore interface allow administrators to install npm packages through a REST API endpoint. While the endpoint validates that the package name exists in the npm registry as a known plugin or webapp, the version parameter accepts arbitrary npm version specifiers including URLs. npm supports installing packages from git repositories, GitHub shorthand syntax, and HTTP/HTTPS URLs pointing to tarballs. When npm installs a package, it can automatically execute any `postinstall` script defined in `package.json`, enabling arbitrary code execution. The vulnerability exists because npm's version specifier syntax is extremely flexible, and the SignalK code passes the version parameter directly to npm without sanitization. An attacker with admin access can install a package from an attacker-controlled source containing a malicious `postinstall` script. Version 2.19.0 contains a patch for the issue.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2026-01-01T19:15:53.777", "cvss": 7.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "< 2.19.0", "fixed": "See vendor advisory", "source_count": 68, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-94", "what_happened": "Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore interface allow administrators to install npm packages through a REST API endpoint. While the endpoint validates that the package name exists in the npm registry as a known plugin or webapp, the version parameter accepts arbitrary npm version specifiers including URLs. npm supports installing packages from git repositories, GitHub shorthand syntax, and HTTP/HTTPS URLs pointing to tarballs. When npm installs a package, it can automatically execute any `postinstall` script defined in `package.json`, enabling arbitrary code execution. The vulnerability exists because npm's version specifier syntax is extremely flexible, and the SignalK code passes the version parameter directly to npm without sanitization. An attacker with admin access can install a package from an attacker-controlled source containing a malicious `postinstall` script. Version 2.19.0 contains a patch for the issue.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2026-01-01", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-93jc-vqqc-vvvh" } ], "references": [ "https://github.com/SignalK/signalk-server/releases/tag/v2.19.0", "https://github.com/SignalK/signalk-server/security/advisories/GHSA-93jc-vqqc-vvvh" ], "timeline": [ { "at": "2026-01-01T19:15:53.777", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68619" } ] }, { "id": "CVE-2025-68598", "vendor": "Live Composer Team", "product": "Page Builder: Live Composer", "title": "Page Builder: Live Composer vulnerability", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Live Composer Team Page Builder: Live Composer live-composer-page-builder allows Stored XSS.This issue affects Page Builder: Live Composer: from n/a through 2.1.22.", "updated_at": "2026-09-21T11:17:07.227", "published_at": "2025-12-24T13:16:27.290", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.1.22 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Live Composer Team Page Builder: Live Composer live-composer-page-builder allows Stored XSS.This issue affects Page Builder: Live Composer: from n/a through 2.1.22.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/live-composer-page-builder/vulnerability/wordpress-page-builder-live-composer-plugin-2-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-24T13:16:27.290", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68598" } ] }, { "id": "CVE-2025-68459", "vendor": "Ruijie Networks Co., Ltd.", "product": "AP180-PE V3.xx", "title": "AP180-PE V3.xx vulnerability", "summary": "RG - AP180, Indoor Wall Plate Wireless AP AP180 series provided by Ruijie Networks Co., Ltd. contain an OS command injection vulnerability. An arbitrary OS command may be executed on the product by an attacker who logs in to the CLI service.", "updated_at": "2026-10-07T11:10:00.153", "published_at": "2025-12-18T06:15:49.717", "cvss": 8.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "AP_RGOS 11.9(4)B1P8 and earlier", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-78", "what_happened": "RG - AP180, Indoor Wall Plate Wireless AP AP180 series provided by Ruijie Networks Co., Ltd. contain an OS command injection vulnerability. An arbitrary OS command may be executed on the product by an attacker who logs in to the CLI service.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://jvn.jp/en/vu/JVNVU94068946/", "https://www.ruijie.com.cn/gy/xw-aqtg-gw/930282/" ], "timeline": [ { "at": "2025-12-18T06:15:49.717", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68459" } ] }, { "id": "CVE-2025-68303", "vendor": "Linux", "product": "Linux", "title": "Linux vulnerability", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: intel: punit_ipc: fix memory corruption\n\nThis passes the address of the pointer \"&punit_ipcdev\" when the intent\nwas to pass the pointer itself \"punit_ipcdev\" (without the ampersand).\nThis means that the:\n\n\tcomplete(&ipcdev->cmd_complete);\n\nin intel_punit_ioc() will write to a wrong memory address corrupting it.", "updated_at": "2026-10-13T19:10:00.193", "published_at": "2025-12-16T16:16:09.820", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "fdca4f16f57da76a8e68047923588a87d1c01f0a through before 15d560cdf5b36c51fffec07ac2a983ab3bff4cb2 (git); fdca4f16f57da76a8e68047923588a87d1c01f0a through before 46e9d6f54184573dae1dcbcf6685a572ba6f4480 (git); fdca4f16f57da76a8e68047923588a87d1c01f0a through before 3e7442c5802146fd418ba3f68dcb9ca92b5cec83 (git); fdca4f16f57da76a8e68047923588a87d1c01f0a through before a21615a4ac6fecbb586d59fe2206b63501021789 (git); fdca4f16f57da76a8e68047923588a87d1c01f0a through before c2ee6d38996775a19bfdf20cb01a9b8698cb0baa (git); fdca4f16f57da76a8e68047923588a87d1c01f0a through before 9b9c0adbc3f8a524d291baccc9d0c04097fb4869 (git); 4.5", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "what_happened": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: intel: punit_ipc: fix memory corruption\n\nThis passes the address of the pointer \"&punit_ipcdev\" when the intent\nwas to pass the pointer itself \"punit_ipcdev\" (without the ampersand).\nThis means that the:\n\n\tcomplete(&ipcdev->cmd_complete);\n\nin intel_punit_ioc() will write to a wrong memory address corrupting it.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://git.kernel.org/stable/c/15d560cdf5b36c51fffec07ac2a983ab3bff4cb2", "https://git.kernel.org/stable/c/3e7442c5802146fd418ba3f68dcb9ca92b5cec83", "https://git.kernel.org/stable/c/46e9d6f54184573dae1dcbcf6685a572ba6f4480", "https://git.kernel.org/stable/c/9b9c0adbc3f8a524d291baccc9d0c04097fb4869", "https://git.kernel.org/stable/c/a21615a4ac6fecbb586d59fe2206b63501021789", "https://git.kernel.org/stable/c/c2ee6d38996775a19bfdf20cb01a9b8698cb0baa" ], "timeline": [ { "at": "2025-12-16T16:16:09.820", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68303" } ] }, { "id": "CVE-2025-68302", "vendor": "Linux", "product": "Linux", "title": "Linux vulnerability", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sxgbe: fix potential NULL dereference in sxgbe_rx()\n\nCurrently, when skb is null, the driver prints an error and then\ndereferences skb on the next line.\n\nTo fix this, let's add a 'break' after the error message to switch\nto sxgbe_rx_refill(), which is similar to the approach taken by the\nother drivers in this particular case, e.g. calxeda with xgmac_rx().\n\nFound during a code review.", "updated_at": "2026-10-13T19:10:00.193", "published_at": "2025-12-16T16:16:09.727", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "confidence": 35, "confidence_label": "observed", "affected": "1edb9ca69e8a7988900fc0283e10550b5592164d through before ac171c3c755499c9f87fe30b920602255f8b5648 (git); 1edb9ca69e8a7988900fc0283e10550b5592164d through before 18ef3ad1bb57dcf1a9ee61736039aedccf670b21 (git); 1edb9ca69e8a7988900fc0283e10550b5592164d through before 46e5332126596a2ca791140feab18ce1fc1a3c86 (git); 1edb9ca69e8a7988900fc0283e10550b5592164d through before 7fd789d6ea4915034eb6bcb72f6883c8151083e5 (git); 1edb9ca69e8a7988900fc0283e10550b5592164d through before 45b5b4ddb8d6bea5fc1625ff6f163bbb125d49cc (git); 1edb9ca69e8a7988900fc0283e10550b5592164d through before 88f46c0be77bfe45830ac33102c75be7c34ac3f3 (git); 1edb9ca69e8a7988900fc0283e10550b5592164d through before f5bce28f6b9125502abec4a67d68eabcd24b3b17 (git); 3.15", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "what_happened": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sxgbe: fix potential NULL dereference in sxgbe_rx()\n\nCurrently, when skb is null, the driver prints an error and then\ndereferences skb on the next line.\n\nTo fix this, let's add a 'break' after the error message to switch\nto sxgbe_rx_refill(), which is similar to the approach taken by the\nother drivers in this particular case, e.g. calxeda with xgmac_rx().\n\nFound during a code review.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://git.kernel.org/stable/c/18ef3ad1bb57dcf1a9ee61736039aedccf670b21", "https://git.kernel.org/stable/c/45b5b4ddb8d6bea5fc1625ff6f163bbb125d49cc", "https://git.kernel.org/stable/c/46e5332126596a2ca791140feab18ce1fc1a3c86", "https://git.kernel.org/stable/c/7fd789d6ea4915034eb6bcb72f6883c8151083e5", "https://git.kernel.org/stable/c/88f46c0be77bfe45830ac33102c75be7c34ac3f3", "https://git.kernel.org/stable/c/ac171c3c755499c9f87fe30b920602255f8b5648", "https://git.kernel.org/stable/c/f5bce28f6b9125502abec4a67d68eabcd24b3b17" ], "timeline": [ { "at": "2025-12-16T16:16:09.727", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68302" } ] }, { "id": "CVE-2025-68291", "vendor": "Linux", "product": "Linux", "title": "Linux vulnerability", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose().\n\nsyzbot reported divide-by-zero in __tcp_select_window() by\nMPTCP socket. [0]\n\nWe had a similar issue for the bare TCP and fixed in commit\n499350a5a6e7 (\"tcp: initialize rcv_mss to TCP_MIN_MSS instead\nof 0\").\n\nLet's apply the same fix to mptcp_do_fastclose().\n\n[0]:\nOops: divide error: 0000 [#1] SMP KASAN PTI\nCPU: 0 UID: 0 PID: 6068 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025\nRIP: 0010:__tcp_select_window+0x824/0x1320 net/ipv4/tcp_output.c:3336\nCode: ff ff ff 44 89 f1 d3 e0 89 c1 f7 d1 41 01 cc 41 21 c4 e9 a9 00 00 00 e8 ca 49 01 f8 e9 9c 00 00 00 e8 c0 49 01 f8 44 89 e0 99 7c 24 1c 41 29 d4 48 bb 00 00 00 00 00 fc ff df e9 80 00 00 00\nRSP: 0018:ffffc90003017640 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88807b469e40\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: ffffc90003017730 R08: ffff888033268143 R09: 1ffff1100664d028\nR10: dffffc0000000000 R11: ffffed100664d029 R12: 0000000000000000\nR13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\nFS: 000055557faa0500(0000) GS:ffff888126135000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f64a1912ff8 CR3: 0000000072122000 CR4: 00000000003526f0\nCall Trace:\n \n tcp_select_window net/ipv4/tcp_output.c:281 [inline]\n __tcp_transmit_skb+0xbc7/0x3aa0 net/ipv4/tcp_output.c:1568\n tcp_transmit_skb net/ipv4/tcp_output.c:1649 [inline]\n tcp_send_active_reset+0x2d1/0x5b0 net/ipv4/tcp_output.c:3836\n mptcp_do_fastclose+0x27e/0x380 net/mptcp/protocol.c:2793\n mptcp_disconnect+0x238/0x710 net/mptcp/protocol.c:3253\n mptcp_sendmsg_fastopen+0x2f8/0x580 net/mptcp/protocol.c:1776\n mptcp_sendmsg+0x1774/0x1980 net/mptcp/protocol.c:1855\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg+0xe5/0x270 net/socket.c:742\n __sys_sendto+0x3bd/0x520 net/socket.c:2244\n __do_sys_sendto net/socket.c:2251 [inline]\n __se_sys_sendto net/socket.c:2247 [inline]\n __x64_sys_sendto+0xde/0x100 net/socket.c:2247\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f66e998f749\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007ffff9acedb8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c\nRAX: ffffffffffffffda RBX: 00007f66e9be5fa0 RCX: 00007f66e998f749\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003\nRBP: 00007ffff9acee10 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001\nR13: 00007f66e9be5fa0 R14: 00007f66e9be5fa0 R15: 0000000000000006\n ", "updated_at": "2026-10-13T19:10:00.193", "published_at": "2025-12-16T16:16:07.980", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "9ea05fabce31ff93a0adae8221c58bc6d7b832f3 through before 46b8b58f93f1b383c3840fc6e8fab6c3bce9295f (git); 3a13454fd098ed51e733958488f8ec62859a9ed8 through before eee39f83246a81d970a9ecb7392b7ab74e660094 (git); f6fb2cbc91a81178dea23d463503b4525a76825d through before 05f5e26d488cdc7abc2a826cf1071782d5a21203 (git); c4f7b0916b95fd2226e5ab98882482b08f52e1c0 through before 88163f85d59b4164884df900ee171720fd26686b (git); ae155060247be8dcae3802a95bd1bdf93ab3215d through before f07f4ea53e22429c84b20832fa098b5ecc0d4e35 (git); 6.1.159 through before 6.1.160 (semver); 6.6.119 through before 6.6.120 (semver); 6.12.60 through before 6.12.61 (semver); 6.17.10 through before 6.17.11 (semver); V3.1.6 through before * (custom)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose().\n\nsyzbot reported divide-by-zero in __tcp_select_window() by\nMPTCP socket. [0]\n\nWe had a similar issue for the bare TCP and fixed in commit\n499350a5a6e7 (\"tcp: initialize rcv_mss to TCP_MIN_MSS instead\nof 0\").\n\nLet's apply the same fix to mptcp_do_fastclose().\n\n[0]:\nOops: divide error: 0000 [#1] SMP KASAN PTI\nCPU: 0 UID: 0 PID: 6068 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025\nRIP: 0010:__tcp_select_window+0x824/0x1320 net/ipv4/tcp_output.c:3336\nCode: ff ff ff 44 89 f1 d3 e0 89 c1 f7 d1 41 01 cc 41 21 c4 e9 a9 00 00 00 e8 ca 49 01 f8 e9 9c 00 00 00 e8 c0 49 01 f8 44 89 e0 99 7c 24 1c 41 29 d4 48 bb 00 00 00 00 00 fc ff df e9 80 00 00 00\nRSP: 0018:ffffc90003017640 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88807b469e40\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: ffffc90003017730 R08: ffff888033268143 R09: 1ffff1100664d028\nR10: dffffc0000000000 R11: ffffed100664d029 R12: 0000000000000000\nR13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\nFS: 000055557faa0500(0000) GS:ffff888126135000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f64a1912ff8 CR3: 0000000072122000 CR4: 00000000003526f0\nCall Trace:\n \n tcp_select_window net/ipv4/tcp_output.c:281 [inline]\n __tcp_transmit_skb+0xbc7/0x3aa0 net/ipv4/tcp_output.c:1568\n tcp_transmit_skb net/ipv4/tcp_output.c:1649 [inline]\n tcp_send_active_reset+0x2d1/0x5b0 net/ipv4/tcp_output.c:3836\n mptcp_do_fastclose+0x27e/0x380 net/mptcp/protocol.c:2793\n mptcp_disconnect+0x238/0x710 net/mptcp/protocol.c:3253\n mptcp_sendmsg_fastopen+0x2f8/0x580 net/mptcp/protocol.c:1776\n mptcp_sendmsg+0x1774/0x1980 net/mptcp/protocol.c:1855\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg+0xe5/0x270 net/socket.c:742\n __sys_sendto+0x3bd/0x520 net/socket.c:2244\n __do_sys_sendto net/socket.c:2251 [inline]\n __se_sys_sendto net/socket.c:2247 [inline]\n __x64_sys_sendto+0xde/0x100 net/socket.c:2247\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f66e998f749\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007ffff9acedb8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c\nRAX: ffffffffffffffda RBX: 00007f66e9be5fa0 RCX: 00007f66e998f749\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003\nRBP: 00007ffff9acee10 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001\nR13: 00007f66e9be5fa0 R14: 00007f66e9be5fa0 R15: 0000000000000006\n ", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://git.kernel.org/stable/c/05f5e26d488cdc7abc2a826cf1071782d5a21203", "https://git.kernel.org/stable/c/46b8b58f93f1b383c3840fc6e8fab6c3bce9295f", "https://git.kernel.org/stable/c/88163f85d59b4164884df900ee171720fd26686b", "https://git.kernel.org/stable/c/eee39f83246a81d970a9ecb7392b7ab74e660094", "https://git.kernel.org/stable/c/f07f4ea53e22429c84b20832fa098b5ecc0d4e35", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" ], "timeline": [ { "at": "2025-12-16T16:16:07.980", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68291" } ] }, { "id": "CVE-2025-68290", "vendor": "Linux", "product": "Linux", "title": "Linux vulnerability", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nmost: usb: fix double free on late probe failure\n\nThe MOST subsystem has a non-standard registration function which frees\nthe interface on registration failures and on deregistration.\n\nThis unsurprisingly leads to bugs in the MOST drivers, and a couple of\nrecent changes turned a reference underflow and use-after-free in the\nUSB driver into several double free and a use-after-free on late probe\nfailures.", "updated_at": "2026-10-13T19:10:00.193", "published_at": "2025-12-16T16:16:07.860", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "723de0f9171eeb49a3ae98cae82ebbbb992b3a7c through before 90e6ce2b1b19fb8b9d4afee69f40e4c6a4791154 (git); 723de0f9171eeb49a3ae98cae82ebbbb992b3a7c through before a4c4118c2af284835b16431bbfe77e0130c06fef (git); 723de0f9171eeb49a3ae98cae82ebbbb992b3a7c through before 0dece48660be16918ecf2dbdc7193e8be03e1693 (git); 723de0f9171eeb49a3ae98cae82ebbbb992b3a7c through before 993bfdc3842893c394de13c8200c338ebb979589 (git); 723de0f9171eeb49a3ae98cae82ebbbb992b3a7c through before 2274767dc02b756b25e3db1e31c0ed47c2a78442 (git); 723de0f9171eeb49a3ae98cae82ebbbb992b3a7c through before 8d8ffefe3d5d8b7b73efb866db61130107299c5c (git); 723de0f9171eeb49a3ae98cae82ebbbb992b3a7c through before baadf2a5c26e802a46573eaad331b427b49aaa36 (git); 5.6", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "In the Linux kernel, the following vulnerability has been resolved:\n\nmost: usb: fix double free on late probe failure\n\nThe MOST subsystem has a non-standard registration function which frees\nthe interface on registration failures and on deregistration.\n\nThis unsurprisingly leads to bugs in the MOST drivers, and a couple of\nrecent changes turned a reference underflow and use-after-free in the\nUSB driver into several double free and a use-after-free on late probe\nfailures.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://git.kernel.org/stable/c/0dece48660be16918ecf2dbdc7193e8be03e1693", "https://git.kernel.org/stable/c/2274767dc02b756b25e3db1e31c0ed47c2a78442", "https://git.kernel.org/stable/c/8d8ffefe3d5d8b7b73efb866db61130107299c5c", "https://git.kernel.org/stable/c/90e6ce2b1b19fb8b9d4afee69f40e4c6a4791154", "https://git.kernel.org/stable/c/993bfdc3842893c394de13c8200c338ebb979589", "https://git.kernel.org/stable/c/a4c4118c2af284835b16431bbfe77e0130c06fef", "https://git.kernel.org/stable/c/baadf2a5c26e802a46573eaad331b427b49aaa36" ], "timeline": [ { "at": "2025-12-16T16:16:07.860", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68290" } ] }, { "id": "CVE-2025-68289", "vendor": "Linux", "product": "Linux", "title": "Linux vulnerability", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_eem: Fix memory leak in eem_unwrap\n\nThe existing code did not handle the failure case of usb_ep_queue in the\ncommand path, potentially leading to memory leaks.\n\nImprove error handling to free all allocated resources on usb_ep_queue\nfailure. This patch continues to use goto logic for error handling, as the\nexisting error handling is complex and not easily adaptable to auto-cleanup\nhelpers.\n\nkmemleak results:\n unreferenced object 0xffffff895a512300 (size 240):\n backtrace:\n slab_post_alloc_hook+0xbc/0x3a4\n kmem_cache_alloc+0x1b4/0x358\n skb_clone+0x90/0xd8\n eem_unwrap+0x1cc/0x36c\n unreferenced object 0xffffff8a157f4000 (size 256):\n backtrace:\n slab_post_alloc_hook+0xbc/0x3a4\n __kmem_cache_alloc_node+0x1b4/0x2dc\n kmalloc_trace+0x48/0x140\n dwc3_gadget_ep_alloc_request+0x58/0x11c\n usb_ep_alloc_request+0x40/0xe4\n eem_unwrap+0x204/0x36c\n unreferenced object 0xffffff8aadbaac00 (size 128):\n backtrace:\n slab_post_alloc_hook+0xbc/0x3a4\n __kmem_cache_alloc_node+0x1b4/0x2dc\n __kmalloc+0x64/0x1a8\n eem_unwrap+0x218/0x36c\n unreferenced object 0xffffff89ccef3500 (size 64):\n backtrace:\n slab_post_alloc_hook+0xbc/0x3a4\n __kmem_cache_alloc_node+0x1b4/0x2dc\n kmalloc_trace+0x48/0x140\n eem_unwrap+0x238/0x36c", "updated_at": "2026-10-13T19:10:00.193", "published_at": "2025-12-16T16:16:07.747", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "3b545788505b2e2883aff13bdddeacaf88942a4f through before a9985a88b2fc29fbe1657fe8518908e261d6889c (git); 4249d6fbc10fd997abdf8a1ea49c0389a0edf706 through before 5a1628283cd9dccf1e44acfb74e77504f4dc7472 (git); 4249d6fbc10fd997abdf8a1ea49c0389a0edf706 through before 0ac07e476944a5e4c2b8b087dd167dec248c1bdf (git); 4249d6fbc10fd997abdf8a1ea49c0389a0edf706 through before 41434488ca714ab15cb2a4d0378418d1be8052d2 (git); 4249d6fbc10fd997abdf8a1ea49c0389a0edf706 through before e72c963177c708a167a7e17ed6c76320815157cf (git); 4249d6fbc10fd997abdf8a1ea49c0389a0edf706 through before 0dea2e0069a7e9aa034696f8065945b7be6dd6b7 (git); 4249d6fbc10fd997abdf8a1ea49c0389a0edf706 through before e4f5ce990818d37930cd9fb0be29eee0553c59d9 (git); d55a236f1bab102e353ea5abb7b7b6ff7e847294 (git); 8e275d3d5915a8f7db3786e3f84534bb48245f4c (git); 3680a6ff9a9ccd3c664663da04bef2534397d591 (git); d654be97e1b679616e3337b871a9ec8f31a88841 (git); 8bdef7f21cb6e53c0ce3e1cbcb05975aa0dd0fe9 (git); 77d7f071883cf2921a7547f82e41f15f7f860e35 (git); a55093941e38113dd6f5f5d5d2705fec3018f332 (git); 5.10.50 through before 5.10.247 (semver); 4.4.276 through before 4.5 (semver); 4.9.276 through before 4.10 (semver); 4.14.240 through before 4.15 (semver); 4.19.198 through before 4.20 (semver); 5.4.132 through before 5.5 (semver); 5.12.17 through before 5.13 (semver); 5.13.2 through before 5.14 (semver); 5.14", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_eem: Fix memory leak in eem_unwrap\n\nThe existing code did not handle the failure case of usb_ep_queue in the\ncommand path, potentially leading to memory leaks.\n\nImprove error handling to free all allocated resources on usb_ep_queue\nfailure. This patch continues to use goto logic for error handling, as the\nexisting error handling is complex and not easily adaptable to auto-cleanup\nhelpers.\n\nkmemleak results:\n unreferenced object 0xffffff895a512300 (size 240):\n backtrace:\n slab_post_alloc_hook+0xbc/0x3a4\n kmem_cache_alloc+0x1b4/0x358\n skb_clone+0x90/0xd8\n eem_unwrap+0x1cc/0x36c\n unreferenced object 0xffffff8a157f4000 (size 256):\n backtrace:\n slab_post_alloc_hook+0xbc/0x3a4\n __kmem_cache_alloc_node+0x1b4/0x2dc\n kmalloc_trace+0x48/0x140\n dwc3_gadget_ep_alloc_request+0x58/0x11c\n usb_ep_alloc_request+0x40/0xe4\n eem_unwrap+0x204/0x36c\n unreferenced object 0xffffff8aadbaac00 (size 128):\n backtrace:\n slab_post_alloc_hook+0xbc/0x3a4\n __kmem_cache_alloc_node+0x1b4/0x2dc\n __kmalloc+0x64/0x1a8\n eem_unwrap+0x218/0x36c\n unreferenced object 0xffffff89ccef3500 (size 64):\n backtrace:\n slab_post_alloc_hook+0xbc/0x3a4\n __kmem_cache_alloc_node+0x1b4/0x2dc\n kmalloc_trace+0x48/0x140\n eem_unwrap+0x238/0x36c", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://git.kernel.org/stable/c/0ac07e476944a5e4c2b8b087dd167dec248c1bdf", "https://git.kernel.org/stable/c/0dea2e0069a7e9aa034696f8065945b7be6dd6b7", "https://git.kernel.org/stable/c/41434488ca714ab15cb2a4d0378418d1be8052d2", "https://git.kernel.org/stable/c/5a1628283cd9dccf1e44acfb74e77504f4dc7472", "https://git.kernel.org/stable/c/a9985a88b2fc29fbe1657fe8518908e261d6889c", "https://git.kernel.org/stable/c/e4f5ce990818d37930cd9fb0be29eee0553c59d9", "https://git.kernel.org/stable/c/e72c963177c708a167a7e17ed6c76320815157cf" ], "timeline": [ { "at": "2025-12-16T16:16:07.747", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68289" } ] }, { "id": "CVE-2025-68288", "vendor": "Linux", "product": "Linux", "title": "Linux vulnerability", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: storage: Fix memory leak in USB bulk transport\n\nA kernel memory leak was identified by the 'ioctl_sg01' test from Linux\nTest Project (LTP). The following bytes were mainly observed: 0x53425355.\n\nWhen USB storage devices incorrectly skip the data phase with status data,\nthe code extracts/validates the CSW from the sg buffer, but fails to clear\nit afterwards. This leaves status protocol data in srb's transfer buffer,\nsuch as the US_BULK_CS_SIGN 'USBS' signature observed here. Thus, this can\nlead to USB protocols leaks to user space through SCSI generic (/dev/sg*)\ninterfaces, such as the one seen here when the LTP test requested 512 KiB.\n\nFix the leak by zeroing the CSW data in srb's transfer buffer immediately\nafter the validation of devices that skip data phase.\n\nNote: Differently from CVE-2018-1000204, which fixed a big leak by zero-\ning pages at allocation time, this leak occurs after allocation, when USB\nprotocol data is written to already-allocated sg pages.", "updated_at": "2026-10-13T19:10:00.193", "published_at": "2025-12-16T16:16:07.620", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "a45b599ad808c3c982fdcdc12b0b8611c2f92824 through before 83f0241959831586d9b6d47f6bd5d3dec8f43bf0 (git); a45b599ad808c3c982fdcdc12b0b8611c2f92824 through before 4ba515dfff7eeca369ab85cdbb3f3b231c71720c (git); a45b599ad808c3c982fdcdc12b0b8611c2f92824 through before 467fec3cefbeb9e3ea80f457da9a5666a71ca0d0 (git); a45b599ad808c3c982fdcdc12b0b8611c2f92824 through before cb1401b5bcc2feb5b038fc4b512e5968b016e05e (git); a45b599ad808c3c982fdcdc12b0b8611c2f92824 through before 0f18eac44c5668204bf6eebb01ddb369ac56932b (git); a45b599ad808c3c982fdcdc12b0b8611c2f92824 through before 5b815ddb3f5560fac35b16de3a2a22d5f81c5993 (git); a45b599ad808c3c982fdcdc12b0b8611c2f92824 through before 41e99fe2005182139b1058db71f0d241f8f0078c (git); 582802e7c617cfb07cc15f280c128e6decbc57b8 (git); 58b7ce6f9ef2367f86384b20458642945993b816 (git); 93314640426ddb6af618d0802e622f6fa771792c (git); ad2518320bc440ed3db072e2444a1bb226a9cf7a (git); d827bea2d18c07ba514f7d48cde49f90da9a1384 (git); 39169410574503c6e901de1aa6eac5108475e017 (git); 3.16.58 through before 3.17 (semver); 3.18.110 through before 3.19 (semver); 4.4.133 through before 4.5 (semver); 4.9.103 through before 4.10 (semver); 4.14.44 through before 4.15 (semver); 4.16.12 through before 4.17 (semver); 4.17", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: storage: Fix memory leak in USB bulk transport\n\nA kernel memory leak was identified by the 'ioctl_sg01' test from Linux\nTest Project (LTP). The following bytes were mainly observed: 0x53425355.\n\nWhen USB storage devices incorrectly skip the data phase with status data,\nthe code extracts/validates the CSW from the sg buffer, but fails to clear\nit afterwards. This leaves status protocol data in srb's transfer buffer,\nsuch as the US_BULK_CS_SIGN 'USBS' signature observed here. Thus, this can\nlead to USB protocols leaks to user space through SCSI generic (/dev/sg*)\ninterfaces, such as the one seen here when the LTP test requested 512 KiB.\n\nFix the leak by zeroing the CSW data in srb's transfer buffer immediately\nafter the validation of devices that skip data phase.\n\nNote: Differently from CVE-2018-1000204, which fixed a big leak by zero-\ning pages at allocation time, this leak occurs after allocation, when USB\nprotocol data is written to already-allocated sg pages.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://git.kernel.org/stable/c/0f18eac44c5668204bf6eebb01ddb369ac56932b", "https://git.kernel.org/stable/c/41e99fe2005182139b1058db71f0d241f8f0078c", "https://git.kernel.org/stable/c/467fec3cefbeb9e3ea80f457da9a5666a71ca0d0", "https://git.kernel.org/stable/c/4ba515dfff7eeca369ab85cdbb3f3b231c71720c", "https://git.kernel.org/stable/c/5b815ddb3f5560fac35b16de3a2a22d5f81c5993", "https://git.kernel.org/stable/c/83f0241959831586d9b6d47f6bd5d3dec8f43bf0", "https://git.kernel.org/stable/c/cb1401b5bcc2feb5b038fc4b512e5968b016e05e" ], "timeline": [ { "at": "2025-12-16T16:16:07.620", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68288" } ] }, { "id": "CVE-2025-68287", "vendor": "Linux", "product": "Linux", "title": "Linux vulnerability", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths\n\nThis patch addresses a race condition caused by unsynchronized\nexecution of multiple call paths invoking `dwc3_remove_requests()`,\nleading to premature freeing of USB requests and subsequent crashes.\n\nThree distinct execution paths interact with `dwc3_remove_requests()`:\nPath 1:\nTriggered via `dwc3_gadget_reset_interrupt()` during USB reset\nhandling. The call stack includes:\n- `dwc3_ep0_reset_state()`\n- `dwc3_ep0_stall_and_restart()`\n- `dwc3_ep0_out_start()`\n- `dwc3_remove_requests()`\n- `dwc3_gadget_del_and_unmap_request()`\n\nPath 2:\nAlso initiated from `dwc3_gadget_reset_interrupt()`, but through\n`dwc3_stop_active_transfers()`. The call stack includes:\n- `dwc3_stop_active_transfers()`\n- `dwc3_remove_requests()`\n- `dwc3_gadget_del_and_unmap_request()`\n\nPath 3:\nOccurs independently during `adb root` execution, which triggers\nUSB function unbind and bind operations. The sequence includes:\n- `gserial_disconnect()`\n- `usb_ep_disable()`\n- `dwc3_gadget_ep_disable()`\n- `dwc3_remove_requests()` with `-ESHUTDOWN` status\n\nPath 3 operates asynchronously and lacks synchronization with Paths\n1 and 2. When Path 3 completes, it disables endpoints and frees 'out'\nrequests. If Paths 1 or 2 are still processing these requests,\naccessing freed memory leads to a crash due to use-after-free conditions.\n\nTo fix this added check for request completion and skip processing\nif already completed and added the request status for ep0 while queue.", "updated_at": "2026-10-13T19:10:00.193", "published_at": "2025-12-16T16:16:07.510", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "72246da40f3719af3bfd104a2365b32537c27d83 through before 467add9db13219101f14b6cc5477998b4aaa5fe2 (git); 72246da40f3719af3bfd104a2365b32537c27d83 through before 67192e8cb7f941b5bba91e4bb290683576ce1607 (git); 72246da40f3719af3bfd104a2365b32537c27d83 through before 47de14d741cc4057046c9e2f33df1f7828254e6c (git); 72246da40f3719af3bfd104a2365b32537c27d83 through before afc0e34f161ce61ad351303c46eb57bd44b8b090 (git); 72246da40f3719af3bfd104a2365b32537c27d83 through before 7cfb62888eba292fa35cd9ddbd28ce595f60e139 (git); 72246da40f3719af3bfd104a2365b32537c27d83 through before fa5eaf701e576880070b60922200557ae4aa54e1 (git); 72246da40f3719af3bfd104a2365b32537c27d83 through before e4037689a366743c4233966f0e74bc455820d316 (git); 3.2", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths\n\nThis patch addresses a race condition caused by unsynchronized\nexecution of multiple call paths invoking `dwc3_remove_requests()`,\nleading to premature freeing of USB requests and subsequent crashes.\n\nThree distinct execution paths interact with `dwc3_remove_requests()`:\nPath 1:\nTriggered via `dwc3_gadget_reset_interrupt()` during USB reset\nhandling. The call stack includes:\n- `dwc3_ep0_reset_state()`\n- `dwc3_ep0_stall_and_restart()`\n- `dwc3_ep0_out_start()`\n- `dwc3_remove_requests()`\n- `dwc3_gadget_del_and_unmap_request()`\n\nPath 2:\nAlso initiated from `dwc3_gadget_reset_interrupt()`, but through\n`dwc3_stop_active_transfers()`. The call stack includes:\n- `dwc3_stop_active_transfers()`\n- `dwc3_remove_requests()`\n- `dwc3_gadget_del_and_unmap_request()`\n\nPath 3:\nOccurs independently during `adb root` execution, which triggers\nUSB function unbind and bind operations. The sequence includes:\n- `gserial_disconnect()`\n- `usb_ep_disable()`\n- `dwc3_gadget_ep_disable()`\n- `dwc3_remove_requests()` with `-ESHUTDOWN` status\n\nPath 3 operates asynchronously and lacks synchronization with Paths\n1 and 2. When Path 3 completes, it disables endpoints and frees 'out'\nrequests. If Paths 1 or 2 are still processing these requests,\naccessing freed memory leads to a crash due to use-after-free conditions.\n\nTo fix this added check for request completion and skip processing\nif already completed and added the request status for ep0 while queue.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://git.kernel.org/stable/c/467add9db13219101f14b6cc5477998b4aaa5fe2", "https://git.kernel.org/stable/c/47de14d741cc4057046c9e2f33df1f7828254e6c", "https://git.kernel.org/stable/c/67192e8cb7f941b5bba91e4bb290683576ce1607", "https://git.kernel.org/stable/c/7cfb62888eba292fa35cd9ddbd28ce595f60e139", "https://git.kernel.org/stable/c/afc0e34f161ce61ad351303c46eb57bd44b8b090", "https://git.kernel.org/stable/c/e4037689a366743c4233966f0e74bc455820d316", "https://git.kernel.org/stable/c/fa5eaf701e576880070b60922200557ae4aa54e1" ], "timeline": [ { "at": "2025-12-16T16:16:07.510", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68287" } ] }, { "id": "CVE-2025-68284", "vendor": "Linux", "product": "Linux", "title": "Linux vulnerability", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: prevent potential out-of-bounds writes in handle_auth_session_key()\n\nThe len field originates from untrusted network packets. Boundary\nchecks have been added to prevent potential out-of-bounds writes when\ndecrypting the connection secret or processing service tickets.\n\n[ idryomov: changelog ]", "updated_at": "2026-10-13T19:10:00.193", "published_at": "2025-12-16T16:16:07.190", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "285ea34fc876aa0a2c5e65d310c4a41269e2e5f2 through before f22c55a20a2d9ffbbac57408d5d488cef8201e9d (git); 285ea34fc876aa0a2c5e65d310c4a41269e2e5f2 through before 8dfcc56af28cffb8f25fb9be37b3acc61f2a3d09 (git); 285ea34fc876aa0a2c5e65d310c4a41269e2e5f2 through before ccbccfba25e9aa395daaea156b5e7790910054c4 (git); 285ea34fc876aa0a2c5e65d310c4a41269e2e5f2 through before 5ef575834ca99f719d7573cdece9df2fe2b72424 (git); 285ea34fc876aa0a2c5e65d310c4a41269e2e5f2 through before 6920ff09bf911bc919cd7a6b7176fbdd1a6e6850 (git); 285ea34fc876aa0a2c5e65d310c4a41269e2e5f2 through before 7fce830ecd0a0256590ee37eb65a39cbad3d64fc (git); 5.11", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "what_happened": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: prevent potential out-of-bounds writes in handle_auth_session_key()\n\nThe len field originates from untrusted network packets. Boundary\nchecks have been added to prevent potential out-of-bounds writes when\ndecrypting the connection secret or processing service tickets.\n\n[ idryomov: changelog ]", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://git.kernel.org/stable/c/5ef575834ca99f719d7573cdece9df2fe2b72424", "https://git.kernel.org/stable/c/6920ff09bf911bc919cd7a6b7176fbdd1a6e6850", "https://git.kernel.org/stable/c/7fce830ecd0a0256590ee37eb65a39cbad3d64fc", "https://git.kernel.org/stable/c/8dfcc56af28cffb8f25fb9be37b3acc61f2a3d09", "https://git.kernel.org/stable/c/ccbccfba25e9aa395daaea156b5e7790910054c4", "https://git.kernel.org/stable/c/f22c55a20a2d9ffbbac57408d5d488cef8201e9d" ], "timeline": [ { "at": "2025-12-16T16:16:07.190", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68284" } ] }, { "id": "CVE-2025-68283", "vendor": "Linux", "product": "Linux", "title": "Linux vulnerability", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: replace BUG_ON with bounds check for map->max_osd\n\nOSD indexes come from untrusted network packets. Boundary checks are\nadded to validate these against map->max_osd.\n\n[ idryomov: drop BUG_ON in ceph_get_primary_affinity(), minor cosmetic\n edits ]", "updated_at": "2026-10-13T19:10:00.193", "published_at": "2025-12-16T16:16:07.080", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "confidence": 35, "confidence_label": "observed", "affected": "f24e9980eb860d8600cbe5ef3d2fd9295320d229 through before 57f5fbae9f1024aba17ff75e00433324115c548a (git); f24e9980eb860d8600cbe5ef3d2fd9295320d229 through before becc488a4d864db338ebd4e313aa3c77da24b604 (git); f24e9980eb860d8600cbe5ef3d2fd9295320d229 through before e67e3be690f5f7e3b031cf29e8d91e6d02a8e30d (git); f24e9980eb860d8600cbe5ef3d2fd9295320d229 through before b4368b7f97014e1015445d61abd0b27c4c6e8424 (git); f24e9980eb860d8600cbe5ef3d2fd9295320d229 through before ec3797f043756a94ea2d0f106022e14ac4946c02 (git); 2.6.34", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "what_happened": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: replace BUG_ON with bounds check for map->max_osd\n\nOSD indexes come from untrusted network packets. Boundary checks are\nadded to validate these against map->max_osd.\n\n[ idryomov: drop BUG_ON in ceph_get_primary_affinity(), minor cosmetic\n edits ]", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://git.kernel.org/stable/c/57f5fbae9f1024aba17ff75e00433324115c548a", "https://git.kernel.org/stable/c/b4368b7f97014e1015445d61abd0b27c4c6e8424", "https://git.kernel.org/stable/c/becc488a4d864db338ebd4e313aa3c77da24b604", "https://git.kernel.org/stable/c/e67e3be690f5f7e3b031cf29e8d91e6d02a8e30d", "https://git.kernel.org/stable/c/ec3797f043756a94ea2d0f106022e14ac4946c02" ], "timeline": [ { "at": "2025-12-16T16:16:07.080", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68283" } ] }, { "id": "CVE-2025-68282", "vendor": "Linux", "product": "Linux", "title": "Linux vulnerability", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: udc: fix use-after-free in usb_gadget_state_work\n\nA race condition during gadget teardown can lead to a use-after-free\nin usb_gadget_state_work(), as reported by KASAN:\n\n BUG: KASAN: invalid-access in sysfs_notify+0x2c/0xd0\n Workqueue: events usb_gadget_state_work\n\nThe fundamental race occurs because a concurrent event (e.g., an\ninterrupt) can call usb_gadget_set_state() and schedule gadget->work\nat any time during the cleanup process in usb_del_gadget().\n\nCommit 399a45e5237c (\"usb: gadget: core: flush gadget workqueue after\ndevice removal\") attempted to fix this by moving flush_work() to after\ndevice_del(). However, this does not fully solve the race, as a new\nwork item can still be scheduled *after* flush_work() completes but\nbefore the gadget's memory is freed, leading to the same use-after-free.\n\nThis patch fixes the race condition robustly by introducing a 'teardown'\nflag and a 'state_lock' spinlock to the usb_gadget struct. The flag is\nset during cleanup in usb_del_gadget() *before* calling flush_work() to\nprevent any new work from being scheduled once cleanup has commenced.\nThe scheduling site, usb_gadget_set_state(), now checks this flag under\nthe lock before queueing the work, thus safely closing the race window.", "updated_at": "2026-10-13T19:10:00.193", "published_at": "2025-12-16T16:16:06.970", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15 through before dddc944d65169b552e09cb54e3ed4fbb9ea26416 (git); 5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15 through before eee16f3ff08e759ea828bdf7dc1c0ef2f22134f5 (git); 5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15 through before c12a0c3ef815ddd67e47f9c819f9fe822fed5467 (git); 5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15 through before f02a412c0a18f02f0f91b0a3d9788315a721b7fd (git); 5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15 through before 10014310193cf6736c1aeb4105c5f4a0818d0c65 (git); 5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15 through before 3b32caa73d135eea8fb9cabb45e9fc64c5a3ecb9 (git); 5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15 through before baeb66fbd4201d1c4325074e78b1f557dff89b5b (git); 3.12", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: udc: fix use-after-free in usb_gadget_state_work\n\nA race condition during gadget teardown can lead to a use-after-free\nin usb_gadget_state_work(), as reported by KASAN:\n\n BUG: KASAN: invalid-access in sysfs_notify+0x2c/0xd0\n Workqueue: events usb_gadget_state_work\n\nThe fundamental race occurs because a concurrent event (e.g., an\ninterrupt) can call usb_gadget_set_state() and schedule gadget->work\nat any time during the cleanup process in usb_del_gadget().\n\nCommit 399a45e5237c (\"usb: gadget: core: flush gadget workqueue after\ndevice removal\") attempted to fix this by moving flush_work() to after\ndevice_del(). However, this does not fully solve the race, as a new\nwork item can still be scheduled *after* flush_work() completes but\nbefore the gadget's memory is freed, leading to the same use-after-free.\n\nThis patch fixes the race condition robustly by introducing a 'teardown'\nflag and a 'state_lock' spinlock to the usb_gadget struct. The flag is\nset during cleanup in usb_del_gadget() *before* calling flush_work() to\nprevent any new work from being scheduled once cleanup has commenced.\nThe scheduling site, usb_gadget_set_state(), now checks this flag under\nthe lock before queueing the work, thus safely closing the race window.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://git.kernel.org/stable/c/10014310193cf6736c1aeb4105c5f4a0818d0c65", "https://git.kernel.org/stable/c/3b32caa73d135eea8fb9cabb45e9fc64c5a3ecb9", "https://git.kernel.org/stable/c/baeb66fbd4201d1c4325074e78b1f557dff89b5b", "https://git.kernel.org/stable/c/c12a0c3ef815ddd67e47f9c819f9fe822fed5467", "https://git.kernel.org/stable/c/dddc944d65169b552e09cb54e3ed4fbb9ea26416", "https://git.kernel.org/stable/c/eee16f3ff08e759ea828bdf7dc1c0ef2f22134f5", "https://git.kernel.org/stable/c/f02a412c0a18f02f0f91b0a3d9788315a721b7fd" ], "timeline": [ { "at": "2025-12-16T16:16:06.970", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68282" } ] }, { "id": "CVE-2025-68281", "vendor": "Linux", "product": "Linux", "title": "Linux vulnerability", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SDCA: bug fix while parsing mipi-sdca-control-cn-list\n\n\"struct sdca_control\" declares \"values\" field as integer array.\nBut the memory allocated to it is of char array. This causes\ncrash for sdca_parse_function API. This patch addresses the\nissue by allocating correct data size.", "updated_at": "2026-10-13T19:10:00.193", "published_at": "2025-12-16T15:15:56.243", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "50a479527ef01f9b36dde1803a7e81741a222509 through before fcd5786b506c51cbabc2560c68e040d8dba22a0d (git); 50a479527ef01f9b36dde1803a7e81741a222509 through before eb2d6774cc0d9d6ab8f924825695a85c14b2e0c2 (git); 6.17", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SDCA: bug fix while parsing mipi-sdca-control-cn-list\n\n\"struct sdca_control\" declares \"values\" field as integer array.\nBut the memory allocated to it is of char array. This causes\ncrash for sdca_parse_function API. This patch addresses the\nissue by allocating correct data size.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://git.kernel.org/stable/c/eb2d6774cc0d9d6ab8f924825695a85c14b2e0c2", "https://git.kernel.org/stable/c/fcd5786b506c51cbabc2560c68e040d8dba22a0d" ], "timeline": [ { "at": "2025-12-16T15:15:56.243", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68281" } ] }, { "id": "CVE-2025-68273", "vendor": "SignalK", "product": "signalk-server", "title": "signalk-server vulnerability", "summary": "Signal K Server is a server application that runs on a central hub in a boat. An unauthenticated information disclosure vulnerability in versions prior to 2.19.0 allows any user to retrieve sensitive system information, including the full SignalK data schema, connected serial devices, and installed analyzer tools. This exposure facilitates reconnaissance for further attacks. Version 2.19.0 patches the issue.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2026-01-01T19:15:53.630", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "confidence": 100, "confidence_label": "verified", "affected": "< 2.19.0", "fixed": "See vendor advisory", "source_count": 68, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-200", "what_happened": "Signal K Server is a server application that runs on a central hub in a boat. An unauthenticated information disclosure vulnerability in versions prior to 2.19.0 allows any user to retrieve sensitive system information, including the full SignalK data schema, connected serial devices, and installed analyzer tools. This exposure facilitates reconnaissance for further attacks. Version 2.19.0 patches the issue.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2026-01-01", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-fpf5-w967-rr2m" } ], "references": [ "https://github.com/SignalK/signalk-server/releases/tag/v2.19.0", "https://github.com/SignalK/signalk-server/security/advisories/GHSA-fpf5-w967-rr2m" ], "timeline": [ { "at": "2026-01-01T19:15:53.630", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68273" } ] }, { "id": "CVE-2025-68272", "vendor": "SignalK", "product": "signalk-server", "title": "signalk-server vulnerability", "summary": "Signal K Server is a server application that runs on a central hub in a boat. A Denial of Service (DoS) vulnerability in versions prior to 2.19.0 allows an unauthenticated attacker to crash the SignalK Server by flooding the access request endpoint (`/signalk/v1/access/requests`). This causes a \"JavaScript heap out of memory\" error due to unbounded in-memory storage of request objects. Version 2.19.0 fixes the issue.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2026-01-01T18:15:40.700", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "confidence": 100, "confidence_label": "verified", "affected": "< 2.19.0", "fixed": "See vendor advisory", "source_count": 68, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-400", "what_happened": "Signal K Server is a server application that runs on a central hub in a boat. A Denial of Service (DoS) vulnerability in versions prior to 2.19.0 allows an unauthenticated attacker to crash the SignalK Server by flooding the access request endpoint (`/signalk/v1/access/requests`). This causes a \"JavaScript heap out of memory\" error due to unbounded in-memory storage of request objects. Version 2.19.0 fixes the issue.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2026-01-01", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-7rqc-ff8m-7j23" } ], "references": [ "https://github.com/SignalK/signalk-server/releases/tag/v2.19.0", "https://github.com/SignalK/signalk-server/security/advisories/GHSA-7rqc-ff8m-7j23" ], "timeline": [ { "at": "2026-01-01T18:15:40.700", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68272" } ] }, { "id": "CVE-2025-68266", "vendor": "Linux", "product": "Linux", "title": "Linux vulnerability", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nbfs: Reconstruct file type when loading from disk\n\nsyzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when\nthe S_IFMT bits of the 32bits \"mode\" field loaded from disk are corrupted\nor when the 32bits \"attributes\" field loaded from disk are corrupted.\n\nA documentation says that BFS uses only lower 9 bits of the \"mode\" field.\nBut I can't find an explicit explanation that the unused upper 23 bits\n(especially, the S_IFMT bits) are initialized with 0.\n\nTherefore, ignore the S_IFMT bits of the \"mode\" field loaded from disk.\nAlso, verify that the value of the \"attributes\" field loaded from disk is\neither BFS_VREG or BFS_VDIR (because BFS supports only regular files and\nthe root directory).", "updated_at": "2026-10-13T19:10:00.193", "published_at": "2025-12-16T15:15:56.140", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 through before d0c5ec1f57d8fbb953f166a27d9d32473dc8f3e4 (git); 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 through before aeccd6743ee4fdd1ab8cfcbb5b9a20b613418f6d (git); 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 through before 8f73336b75bd3457b6f9410f2a0601a238f32238 (git); 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 through before a9f626396bfe66f49b743601e862767928237cc0 (git); 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 through before 77899444d46162aeb65f229590c26ba266864223 (git); 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 through before a8cb796e7e2cb7971311ba236922f5e7e1be77e6 (git); 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 through before 34ab4c75588c07cca12884f2bf6b0347c7a13872 (git); 2.6.12; V3.1.6 through before * (custom)", "fixed": "See vendor advisory", "source_count": 8, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "In the Linux kernel, the following vulnerability has been resolved:\n\nbfs: Reconstruct file type when loading from disk\n\nsyzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when\nthe S_IFMT bits of the 32bits \"mode\" field loaded from disk are corrupted\nor when the 32bits \"attributes\" field loaded from disk are corrupted.\n\nA documentation says that BFS uses only lower 9 bits of the \"mode\" field.\nBut I can't find an explicit explanation that the unused upper 23 bits\n(especially, the S_IFMT bits) are initialized with 0.\n\nTherefore, ignore the S_IFMT bits of the \"mode\" field loaded from disk.\nAlso, verify that the value of the \"attributes\" field loaded from disk is\neither BFS_VREG or BFS_VDIR (because BFS supports only regular files and\nthe root directory).", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://git.kernel.org/stable/c/34ab4c75588c07cca12884f2bf6b0347c7a13872", "https://git.kernel.org/stable/c/77899444d46162aeb65f229590c26ba266864223", "https://git.kernel.org/stable/c/8f73336b75bd3457b6f9410f2a0601a238f32238", "https://git.kernel.org/stable/c/a8cb796e7e2cb7971311ba236922f5e7e1be77e6", "https://git.kernel.org/stable/c/a9f626396bfe66f49b743601e862767928237cc0", "https://git.kernel.org/stable/c/aeccd6743ee4fdd1ab8cfcbb5b9a20b613418f6d", "https://git.kernel.org/stable/c/d0c5ec1f57d8fbb953f166a27d9d32473dc8f3e4", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" ], "timeline": [ { "at": "2025-12-16T15:15:56.140", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68266" } ] }, { "id": "CVE-2025-68195", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", "summary": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", "updated_at": "2026-09-30T13:17:13.400", "published_at": "2025-12-16T14:15:52.263", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "See vendor advisory", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [], "timeline": [ { "at": "2025-12-16T14:15:52.263", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68195" } ] }, { "id": "CVE-2025-68190", "vendor": "Linux", "product": "Linux", "title": "Linux vulnerability", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked()\n\nkcalloc() may fail. When WS is non-zero and allocation fails, ectx.ws\nremains NULL while ectx.ws_size is set, leading to a potential NULL\npointer dereference in atom_get_src_int() when accessing WS entries.\n\nReturn -ENOMEM on allocation failure to avoid the NULL dereference.", "updated_at": "2026-10-03T11:17:33.157", "published_at": "2025-12-16T14:15:51.677", "cvss": 0, "cvss_vector": "", "confidence": 35, "confidence_label": "observed", "affected": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21 through before 0b52e3192181b4de58844faedd2928e5c6ca0e06 (git); d38ceaf99ed015f2a0b9af3499791bd3a3daae21 through before 47252c7d5559d8776ad336be9c955d8404e7ae69 (git); d38ceaf99ed015f2a0b9af3499791bd3a3daae21 through before 88d198836f628c57536c6c71d13e90c5d15fbf1a (git); d38ceaf99ed015f2a0b9af3499791bd3a3daae21 through before 73853208a497a036596dcf9efbff8ce927651d3a (git); d38ceaf99ed015f2a0b9af3499791bd3a3daae21 through before 35f3fb86bb0158a298d6834e7e110dcaf07f490c (git); d38ceaf99ed015f2a0b9af3499791bd3a3daae21 through before 997e28d3d00a1d30649629515e4402612921205b (git); d38ceaf99ed015f2a0b9af3499791bd3a3daae21 through before cc9a8e238e42c1f43b98c097995137d644b69245 (git); 4.2", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "See CVSS vector", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked()\n\nkcalloc() may fail. When WS is non-zero and allocation fails, ectx.ws\nremains NULL while ectx.ws_size is set, leading to a potential NULL\npointer dereference in atom_get_src_int() when accessing WS entries.\n\nReturn -ENOMEM on allocation failure to avoid the NULL dereference.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://git.kernel.org/stable/c/0b52e3192181b4de58844faedd2928e5c6ca0e06", "https://git.kernel.org/stable/c/35f3fb86bb0158a298d6834e7e110dcaf07f490c", "https://git.kernel.org/stable/c/47252c7d5559d8776ad336be9c955d8404e7ae69", "https://git.kernel.org/stable/c/73853208a497a036596dcf9efbff8ce927651d3a", "https://git.kernel.org/stable/c/88d198836f628c57536c6c71d13e90c5d15fbf1a", "https://git.kernel.org/stable/c/997e28d3d00a1d30649629515e4402612921205b", "https://git.kernel.org/stable/c/cc9a8e238e42c1f43b98c097995137d644b69245" ], "timeline": [ { "at": "2025-12-16T14:15:51.677", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68190" } ] }, { "id": "CVE-2025-68148", "vendor": "FreshRSS", "product": "FreshRSS", "title": "FreshRSS vulnerability", "summary": "FreshRSS is a free, self-hostable RSS aggregator. From version 1.27.0 to before 1.28.0, An attacker could globally deny access to feeds via proxy modifying to 429 Retry-After for a large list of feeds on given instance, making it unusable for majority of users. This issue has been patched in version 1.28.0.", "updated_at": "2026-10-13T09:10:00.323", "published_at": "2025-12-27T00:15:42.167", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "confidence": 100, "confidence_label": "verified", "affected": ">= 1.27.0, < 1.28.0", "fixed": "See vendor advisory", "source_count": 26, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-770", "what_happened": "FreshRSS is a free, self-hostable RSS aggregator. From version 1.27.0 to before 1.28.0, An attacker could globally deny access to feeds via proxy modifying to 429 Retry-After for a large list of feeds on given instance, making it unusable for majority of users. This issue has been patched in version 1.28.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-12-27", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-qw34-frg7-gf78" } ], "references": [ "https://github.com/FreshRSS/FreshRSS/commit/7d4854a0a4f5665db599f18c34035786465639f3", "https://github.com/FreshRSS/FreshRSS/pull/8029", "https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-qw34-frg7-gf78" ], "timeline": [ { "at": "2025-12-27T00:15:42.167", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68148" } ] }, { "id": "CVE-2025-68120", "vendor": "github.com/golang/vscode-go", "product": "github.com/golang/vscode-go", "title": "github.com/golang/vscode-go vulnerability", "summary": "To prevent unexpected untrusted code execution, the Visual Studio Code Go extension is now disabled in Restricted Mode.", "updated_at": "2026-10-13T09:10:00.323", "published_at": "2025-12-30T00:15:52.333", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L", "confidence": 35, "confidence_label": "observed", "affected": "before 0.52.1 (semver)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "Unknown", "what_happened": "To prevent unexpected untrusted code execution, the Visual Studio Code Go extension is now disabled in Restricted Mode.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://groups.google.com/g/golang-dev/c/CHG4qfcicBU/m/4tanFUymDQAJ", "https://nvd.nist.gov/vuln/detail/CVE-2025-68120", "https://pkg.go.dev/vuln/GO-2025-4249" ], "timeline": [ { "at": "2025-12-30T00:15:52.333", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68120" } ] }, { "id": "CVE-2025-68081", "vendor": "Lester Chan", "product": "WP-Polls", "title": "WP-Polls vulnerability", "summary": "Administrator Cross Site Scripting (XSS) in WP-Polls <= 2.77.3 versions.", "updated_at": "2026-09-29T14:10:00.117", "published_at": "2026-07-23T12:17:05.170", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "n/a through 2.77.3 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Administrator Cross Site Scripting (XSS) in WP-Polls <= 2.77.3 versions.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/wp-polls/vulnerability/wordpress-wp-polls-plugin-2-77-3-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-07-23T12:17:05.170", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68081" } ] }, { "id": "CVE-2025-68075", "vendor": "Kerry", "product": "BNE Testimonials", "title": "BNE Testimonials vulnerability", "summary": "Contributor Cross Site Scripting (XSS) in BNE Testimonials <= 2.0.8 versions.", "updated_at": "2026-09-29T19:10:00.160", "published_at": "2026-06-26T15:16:35.860", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "n/a through 2.0.8 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Contributor Cross Site Scripting (XSS) in BNE Testimonials <= 2.0.8 versions.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/bne-testimonials/vulnerability/wordpress-bne-testimonials-plugin-2-0-8-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-06-26T15:16:35.860", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68075" } ] }, { "id": "CVE-2025-68074", "vendor": "GhozyLab", "product": "Image Carousel", "title": "Image Carousel vulnerability", "summary": "Contributor Cross Site Scripting (XSS) in Image Carousel <= 1.0.0.41 versions.", "updated_at": "2026-09-29T19:10:00.160", "published_at": "2026-06-26T15:16:35.733", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "n/a through 1.0.0.41 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Contributor Cross Site Scripting (XSS) in Image Carousel <= 1.0.0.41 versions.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/image-carousel/vulnerability/wordpress-image-carousel-plugin-1-0-0-41-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-06-26T15:16:35.733", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68074" } ] }, { "id": "CVE-2025-68064", "vendor": "Everthemess", "product": "Goya Core", "title": "Goya Core vulnerability", "summary": "Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions.", "updated_at": "2026-09-29T19:10:00.160", "published_at": "2026-06-26T15:16:35.617", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "n/a through before 1.0.9.4 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "High", "cwe": "CWE-98", "what_happened": "Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/goya-core/vulnerability/wordpress-goya-core-plugin-1-0-9-4-local-file-inclusion-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-06-26T15:16:35.617", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68064" } ] }, { "id": "CVE-2025-68063", "vendor": "StylemixThemes", "product": "Splash - Sport Club WordPress Theme for Basketball, Football, Hockey", "title": "Splash - Sport Club WordPress Theme for Basketball, Football, Hockey vulnerability", "summary": "Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions.", "updated_at": "2026-09-29T19:10:00.160", "published_at": "2026-06-26T15:16:35.490", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "n/a through 4.4.3 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "High", "cwe": "CWE-98", "what_happened": "Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/theme/splash/vulnerability/wordpress-splash-sport-club-wordpress-theme-for-basketball-football-hockey-theme-4-4-3-local-file-inclusion-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-06-26T15:16:35.490", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68063" } ] }, { "id": "CVE-2025-68052", "vendor": "Eagle-Themes", "product": "Eagle Booking", "title": "Eagle Booking vulnerability", "summary": "Unauthenticated Cross Site Request Forgery (CSRF) in Eagle Booking <= 1.3.4.3 versions.", "updated_at": "2026-09-29T19:10:00.160", "published_at": "2026-06-26T15:16:35.363", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "n/a through 1.3.4.3 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-352", "what_happened": "Unauthenticated Cross Site Request Forgery (CSRF) in Eagle Booking <= 1.3.4.3 versions.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/eagle-booking/vulnerability/wordpress-eagle-booking-plugin-1-3-4-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-06-26T15:16:35.363", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68052" } ] }, { "id": "CVE-2025-68049", "vendor": "bunny.net", "product": "bunny.net", "title": "bunny.net vulnerability", "summary": "Subscriber Broken Access Control in bunny.net <= 2.3.6 versions.", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-06-15T21:16:38.190", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "n/a through 2.3.6 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Subscriber Broken Access Control in bunny.net <= 2.3.6 versions.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/bunnycdn/vulnerability/wordpress-bunny-net-plugin-2-3-6-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-06-15T21:16:38.190", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68049" } ] }, { "id": "CVE-2025-67933", "vendor": "taskbuilder", "product": "Taskbuilder", "title": "Taskbuilder vulnerability", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in taskbuilder Taskbuilder taskbuilder allows Reflected XSS.This issue affects Taskbuilder: from n/a through <= 4.0.9.", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-01-08T10:15:52.393", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 4.0.9 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in taskbuilder Taskbuilder taskbuilder allows Reflected XSS.This issue affects Taskbuilder: from n/a through <= 4.0.9.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/taskbuilder/vulnerability/wordpress-taskbuilder-plugin-4-0-9-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-01-08T10:15:52.393", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67933" } ] }, { "id": "CVE-2025-67910", "vendor": "contentstudio", "product": "Contentstudio", "title": "Contentstudio vulnerability", "summary": "Unrestricted Upload of File with Dangerous Type vulnerability in contentstudio Contentstudio contentstudio allows Upload a Web Shell to a Web Server.This issue affects Contentstudio: from n/a through <= 1.3.7.", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-01-08T10:15:49.827", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.3.7 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-434", "what_happened": "Unrestricted Upload of File with Dangerous Type vulnerability in contentstudio Contentstudio contentstudio allows Upload a Web Shell to a Web Server.This issue affects Contentstudio: from n/a through <= 1.3.7.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/contentstudio/vulnerability/wordpress-contentstudio-plugin-1-3-7-arbitrary-file-upload-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-01-08T10:15:49.827", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67910" } ] }, { "id": "CVE-2025-67779", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Exploit for CVE-2025-55184", "summary": "Vulnerability in tools component, details unavailable in repository.", "updated_at": "2026-09-21T14:13:34Z", "published_at": "2026-09-21T14:13:34Z", "cvss": 7.5, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 199, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "what_happened": "Vulnerability in tools component, details unavailable in repository.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for CVE-2025-55184", "summary": "Vulnerability in tools component, details unavailable in repository.", "what_happened": "Vulnerability in tools component, details unavailable in repository.", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-EJPIR-CVE-2025-55184", "https://kitploit.com/ko/tools/github/ejpir/cve-2025-55184/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-09-21T16:13:34", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-EJPIR-CVE-2025-55184" }, { "title": "Exploit for CVE-2025-55184", "summary": "Vulnerability in tools component, details unavailable in repository.", "what_happened": "Vulnerability in tools component, details unavailable in repository.", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-EJPIR-CVE-2025-55184", "https://kitploit.com/ko/tools/github/ejpir/cve-2025-55184/" ], "repository": "kitploit.com", "author": "ko", "first_seen": "2026-09-21T16:13:34", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/ko/tools/github/ejpir/cve-2025-55184/" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-EJPIR-CVE-2025-55184", "https://kitploit.com/ko/tools/github/ejpir/cve-2025-55184/" ], "timeline": [ { "at": "2026-09-21T14:13:34Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-EJPIR-CVE-2025-55184" } ], "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "id": "CVE-2025-67707", "vendor": "Esri", "product": "ArcGIS Server", "title": "ArcGIS Server vulnerability", "summary": "ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload arbitrary files to the server’s designated upload directories.\n\nHowever, the server’s architecture enforces controls that restrict uploaded files to non‑executable storage locations and prevent modification or replacement of existing application components or system configurations. Uploaded files cannot be executed, leveraged to escalate privileges, or used to access sensitive data.\n\nBecause the issue does not enable execution, service disruption, unauthorized access, or integrity compromise, its impact on confidentiality, integrity, and availability is low. Note that race conditions, secret values, or man‑in‑the‑middle conditions are required for exploitation.", "updated_at": "2026-10-08T08:10:00.227", "published_at": "2025-12-31T23:15:41.833", "cvss": 5.6, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "10.9.1 through 11.5 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-434", "what_happened": "ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload arbitrary files to the server’s designated upload directories.\n\nHowever, the server’s architecture enforces controls that restrict uploaded files to non‑executable storage locations and prevent modification or replacement of existing application components or system configurations. Uploaded files cannot be executed, leveraged to escalate privileges, or used to access sensitive data.\n\nBecause the issue does not enable execution, service disruption, unauthorized access, or integrity compromise, its impact on confidentiality, integrity, and availability is low. Note that race conditions, secret values, or man‑in‑the‑middle conditions are required for exploitation.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-2-patch" ], "timeline": [ { "at": "2025-12-31T23:15:41.833", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67707" } ] }, { "id": "CVE-2025-67706", "vendor": "Esri", "product": "ArcGIS Server", "title": "ArcGIS Server vulnerability", "summary": "ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload arbitrary files to the server’s designated upload directories.\n\nHowever, the server’s architecture enforces controls that restrict uploaded files to non‑executable storage locations and prevent modification or replacement of existing application components or system configurations. Uploaded files cannot be executed, leveraged to escalate privileges, or used to access sensitive data.\n\nBecause the issue does not enable execution, service disruption, unauthorized access, or integrity compromise, its impact on confidentiality, integrity, and availability is low. Note that race conditions, secret values, or man‑in‑the‑middle conditions are required for exploitation.", "updated_at": "2026-10-08T08:10:00.227", "published_at": "2025-12-31T23:15:41.687", "cvss": 5.6, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "10.9.1 through 11.4 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-434", "what_happened": "ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload arbitrary files to the server’s designated upload directories.\n\nHowever, the server’s architecture enforces controls that restrict uploaded files to non‑executable storage locations and prevent modification or replacement of existing application components or system configurations. Uploaded files cannot be executed, leveraged to escalate privileges, or used to access sensitive data.\n\nBecause the issue does not enable execution, service disruption, unauthorized access, or integrity compromise, its impact on confidentiality, integrity, and availability is low. Note that race conditions, secret values, or man‑in‑the‑middle conditions are required for exploitation.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-2-patch" ], "timeline": [ { "at": "2025-12-31T23:15:41.687", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67706" } ] }, { "id": "CVE-2025-67651", "vendor": "PHP Jabbers", "product": "Appointment Scheduler", "title": "Appointment Scheduler vulnerability", "summary": "A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions, such as creating new admin accounts.\n\n\nThis issue was fixed in the versions specified in the affected products list.", "updated_at": "2026-09-29T14:10:00.117", "published_at": "2026-07-31T12:16:48.520", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 4.1 (custom); before 2.1 (custom); before 5.1 (custom); before 6.1 (custom); before 6.0 (custom); before 3.1 (custom)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-352", "what_happened": "A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions, such as creating new admin accounts.\n\n\nThis issue was fixed in the versions specified in the affected products list.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://cert.pl/en/posts/2026/07/CVE-2025-67649/", "https://www.phpjabbers.com/" ], "timeline": [ { "at": "2026-07-31T12:16:48.520", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67651" } ] }, { "id": "CVE-2025-67650", "vendor": "PHP Jabbers", "product": "Appointment Scheduler", "title": "Appointment Scheduler vulnerability", "summary": "An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks.\nThis issue was fixed in the versions specified in the affected products list.", "updated_at": "2026-09-29T14:10:00.117", "published_at": "2026-07-31T12:16:48.250", "cvss": 8.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 4.1 (custom); before 2.1 (custom); before 5.1 (custom); before 6.1 (custom); before 6.0 (custom); before 3.1 (custom)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-89", "what_happened": "An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks.\nThis issue was fixed in the versions specified in the affected products list.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://cert.pl/en/posts/2026/07/CVE-2025-67649/", "https://www.phpjabbers.com/" ], "timeline": [ { "at": "2026-07-31T12:16:48.250", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67650" } ] }, { "id": "CVE-2025-67649", "vendor": "PHP Jabbers", "product": "Car Rental Script", "title": "Car Rental Script vulnerability", "summary": "A SQL injection vulnerability has been identified in PHP Jabbers - Car Rental Script . Improper neutralization of input provided by user into parameters responsible for sorting functions allows an unauthenticated attacker to perform SQL Injection attacks.\n\nThis issue was fixed in version 4.1.", "updated_at": "2026-09-29T14:10:00.117", "published_at": "2026-07-31T12:16:48.107", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 4.1 (custom)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-89", "what_happened": "A SQL injection vulnerability has been identified in PHP Jabbers - Car Rental Script . Improper neutralization of input provided by user into parameters responsible for sorting functions allows an unauthenticated attacker to perform SQL Injection attacks.\n\nThis issue was fixed in version 4.1.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://cert.pl/en/posts/2026/07/CVE-2025-67649/", "https://www.phpjabbers.com/car-rental-script/" ], "timeline": [ { "at": "2026-07-31T12:16:48.107", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67649" } ] }, { "id": "CVE-2025-67623", "vendor": "6Storage", "product": "6Storage Rentals", "title": "6Storage Rentals vulnerability", "summary": "Server-Side Request Forgery (SSRF) vulnerability in 6Storage 6Storage Rentals 6storage-rentals allows Server Side Request Forgery.This issue affects 6Storage Rentals: from n/a through <= 2.22.0.", "updated_at": "2026-10-07T13:10:00.713", "published_at": "2025-12-24T13:16:18.583", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.22.0 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-918", "what_happened": "Server-Side Request Forgery (SSRF) vulnerability in 6Storage 6Storage Rentals 6storage-rentals allows Server Side Request Forgery.This issue affects 6Storage Rentals: from n/a through <= 2.22.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/6storage-rentals/vulnerability/wordpress-6storage-rentals-plugin-2-19-9-server-side-request-forgery-ssrf-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-24T13:16:18.583", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67623" } ] }, { "id": "CVE-2025-67622", "vendor": "titopandub", "product": "Evergreen Post Tweeter", "title": "Evergreen Post Tweeter vulnerability", "summary": "Cross-Site Request Forgery (CSRF) vulnerability in titopandub Evergreen Post Tweeter evergreen-post-tweeter allows Stored XSS.This issue affects Evergreen Post Tweeter: from n/a through <= 1.8.9.", "updated_at": "2026-10-07T13:10:00.713", "published_at": "2025-12-24T13:16:18.453", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.8.9 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-352", "what_happened": "Cross-Site Request Forgery (CSRF) vulnerability in titopandub Evergreen Post Tweeter evergreen-post-tweeter allows Stored XSS.This issue affects Evergreen Post Tweeter: from n/a through <= 1.8.9.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/evergreen-post-tweeter/vulnerability/wordpress-evergreen-post-tweeter-plugin-1-8-9-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-24T13:16:18.453", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67622" } ] }, { "id": "CVE-2025-67621", "vendor": "10up", "product": "Eight Day Week Print Workflow", "title": "Eight Day Week Print Workflow vulnerability", "summary": "Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in 10up Eight Day Week Print Workflow eight-day-week-print-workflow allows Retrieve Embedded Sensitive Data.This issue affects Eight Day Week Print Workflow: from n/a through <= 1.2.5.", "updated_at": "2026-10-07T13:10:00.713", "published_at": "2025-12-24T13:16:18.317", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.2.5 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-497", "what_happened": "Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in 10up Eight Day Week Print Workflow eight-day-week-print-workflow allows Retrieve Embedded Sensitive Data.This issue affects Eight Day Week Print Workflow: from n/a through <= 1.2.5.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/eight-day-week-print-workflow/vulnerability/wordpress-eight-day-week-print-workflow-plugin-1-2-5-sensitive-data-exposure-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-24T13:16:18.317", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67621" } ] }, { "id": "CVE-2025-67486", "vendor": "Dolibarr", "product": "dolibarr", "title": "dolibarr vulnerability", "summary": "Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Versions 22.0.2 and earlier contains an authenticated remote code execution vulnerability in the user extrafields functionality. User-controlled input from the \"computed value\" field is passed to PHP's `eval()` function without adequate sanitization, allowing authenticated administrators to execute arbitrary PHP code on the server. As of time of publication, no patched versions are available.", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-05-08T15:16:35.043", "cvss": 8.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "<= 22.0.2", "fixed": "See vendor advisory", "source_count": 26, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-74", "what_happened": "Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Versions 22.0.2 and earlier contains an authenticated remote code execution vulnerability in the user extrafields functionality. User-controlled input from the \"computed value\" field is passed to PHP's `eval()` function without adequate sanitization, allowing authenticated administrators to execute arbitrary PHP code on the server. As of time of publication, no patched versions are available.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "medium.com", "author": "NVD reference", "first_seen": "2026-05-08", "confidence": "High", "verification": "verified", "verified": true, "url": "https://medium.com/@abduxalilovjavohir/dolibarr-erp-authenticated-remote-code-execution-via-eval-injection-in-user-extrafields-dfc305d0118e" } ], "references": [ "https://github.com/Dolibarr/dolibarr/blob/22.0.2/htdocs/core/lib/functions.lib.php", "https://medium.com/@abduxalilovjavohir/dolibarr-erp-authenticated-remote-code-execution-via-eval-injection-in-user-extrafields-dfc305d0118e" ], "timeline": [ { "at": "2026-05-08T15:16:35.043", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67486" } ] }, { "id": "CVE-2025-67450", "vendor": "Eaton", "product": "UPS Companion software", "title": "UPS Companion software vulnerability", "summary": "Due to insecure library loading in the Eaton UPS Companion software executable, an attacker with access to the software package\n\n could perform arbitrary code execution . This security issue has been fixed in the latest version of EUC which is available on the Eaton download center.", "updated_at": "2026-10-06T08:10:00.193", "published_at": "2025-12-26T07:15:45.850", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "before 3.0 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "High", "cwe": "CWE-427", "what_happened": "Due to insecure library loading in the Eaton UPS Companion software executable, an attacker with access to the software package\n\n could perform arbitrary code execution . This security issue has been fixed in the latest version of EUC which is available on the Eaton download center.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1027.pdf" ], "timeline": [ { "at": "2025-12-26T07:15:45.850", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67450" } ] }, { "id": "CVE-2025-67408", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in /save_user.php via the parameter status.", "updated_at": "2026-10-13T09:10:00.323", "published_at": "2026-07-29T22:16:51.627", "cvss": 7.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-89", "what_happened": "Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in /save_user.php via the parameter status.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/automated/20250811-casap-automated-enrollment-system-save_user.php-status-sqli/20250811-casap-automated-enrollment-system-save_user.php-status-sqli.md" ], "timeline": [ { "at": "2026-07-29T22:16:51.627", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67408" } ] }, { "id": "CVE-2025-67407", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_student.php via parameters fname and student_class.", "updated_at": "2026-10-13T09:10:00.323", "published_at": "2026-07-29T22:16:51.510", "cvss": 7.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-89", "what_happened": "Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_student.php via parameters fname and student_class.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/automated/20250811-casap-automated-enrollment-system-update_student.php-fname-sqli/20250811-casap-automated-enrollment-system-update_student.php-fname-sqli.md" ], "timeline": [ { "at": "2026-07-29T22:16:51.510", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67407" } ] }, { "id": "CVE-2025-67405", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_password.php via the parameter new_password.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2026-07-29T22:16:51.283", "cvss": 7.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-89", "what_happened": "Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_password.php via the parameter new_password.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/automated/20250811-casap-automated-enrollment-system-update_password.php-new_password-sqli/20250811-casap-automated-enrollment-system-update_password.php-new_password-sqli.md" ], "timeline": [ { "at": "2026-07-29T22:16:51.283", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67405" } ] }, { "id": "CVE-2025-67404", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in save_stud.php via the parameters fname, lname, and student_class.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2026-07-29T22:16:51.163", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-89", "what_happened": "Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in save_stud.php via the parameters fname, lname, and student_class.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/automated/20250811-casap-automated-enrollment-system-save_stud.php-fname-sqli/20250811-casap-automated-enrollment-system-save_stud.php-fname-sqli.md" ], "timeline": [ { "at": "2026-07-29T22:16:51.163", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67404" } ] }, { "id": "CVE-2025-67403", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_class.php via the parameter class_name.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2026-07-29T22:16:51.033", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-89", "what_happened": "Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_class.php via the parameter class_name.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/automated/20250811-casap-automated-enrollment-system-update_class.php-class_name-sqli/20250811-casap-automated-enrollment-system-update_class.php-class_name-sqli.md" ], "timeline": [ { "at": "2026-07-29T22:16:51.033", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67403" } ] }, { "id": "CVE-2025-67255", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "In NagiosXI 2026R1.0.1 build 1762361101, Dashboard parameters lack proper filtering, allowing any authenticated user to exploit a SQL Injection vulnerability.", "updated_at": "2026-10-13T09:10:00.323", "published_at": "2025-12-29T19:15:56.820", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-89", "what_happened": "In NagiosXI 2026R1.0.1 build 1762361101, Dashboard parameters lack proper filtering, allowing any authenticated user to exploit a SQL Injection vulnerability.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/YongYe-Security/NagiosXI/tree/main", "https://www.nagios.org/" ], "timeline": [ { "at": "2025-12-29T19:15:56.820", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67255" } ] }, { "id": "CVE-2025-67015", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "Incorrect access control in Comtech EF Data CDM-625 / CDM-625A Advanced Satellite Modem with firmware v2.5.1 allows attackers to change the Administrator password and escalate privileges via sending a crafted POST request to /Forms/admin_access_1.", "updated_at": "2026-10-13T09:10:00.323", "published_at": "2025-12-26T16:15:44.577", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "confidence": 100, "confidence_label": "verified", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 24, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-284", "what_happened": "Incorrect access control in Comtech EF Data CDM-625 / CDM-625A Advanced Satellite Modem with firmware v2.5.1 allows attackers to change the Administrator password and escalate privileges via sending a crafted POST request to /Forms/admin_access_1.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-12-26", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-67015%20_%20Comtech%20EF%20Data%20CDM-625%20_%20CDM-625A%20Advanced%20_%20Broken%20Access%20Control" } ], "references": [ "https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-67015%20_%20Comtech%20EF%20Data%20CDM-625%20_%20CDM-625A%20Advanced%20_%20Broken%20Access%20Control", "https://www.comtechefdata.com/" ], "timeline": [ { "at": "2025-12-26T16:15:44.577", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67015" } ] }, { "id": "CVE-2025-67014", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "Incorrect access control in DEV Systemtechnik GmbH DEV 7113 RF over Fiber Distribution System 32-0078 H.01 allows unauthenticated attackers to access an administrative endpoint.", "updated_at": "2026-10-13T09:10:00.323", "published_at": "2025-12-26T16:15:44.473", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "confidence": 100, "confidence_label": "verified", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 24, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-284", "what_happened": "Incorrect access control in DEV Systemtechnik GmbH DEV 7113 RF over Fiber Distribution System 32-0078 H.01 allows unauthenticated attackers to access an administrative endpoint.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-12-26", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-67014%20_%20DEV%20Systemtechnik%20GmbH%20DEV%207113%20RF%20over%20_%20Broken%20Access%20Control" } ], "references": [ "https://dev-systemtechnik.com", "https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-67014%20_%20DEV%20Systemtechnik%20GmbH%20DEV%207113%20RF%20over%20_%20Broken%20Access%20Control" ], "timeline": [ { "at": "2025-12-26T16:15:44.473", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67014" } ] }, { "id": "CVE-2025-67013", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "The web management interface in ETL Systems Ltd DEXTRA Series ' Digital L-Band Distribution System v1.8 does not implement Cross-Site Request Forgery (CSRF) protection mechanisms (no tokens, no Origin/Referer validation) on critical configuration endpoints.", "updated_at": "2026-10-13T09:10:00.323", "published_at": "2025-12-26T16:15:44.367", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "confidence": 100, "confidence_label": "verified", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 24, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-352", "what_happened": "The web management interface in ETL Systems Ltd DEXTRA Series ' Digital L-Band Distribution System v1.8 does not implement Cross-Site Request Forgery (CSRF) protection mechanisms (no tokens, no Origin/Referer validation) on critical configuration endpoints.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-12-26", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-67013%20_%20ETL%20Systems%20Ltd%20DEXTRA%20Series%20_%20CSRF" } ], "references": [ "https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-67013%20_%20ETL%20Systems%20Ltd%20DEXTRA%20Series%20_%20CSRF", "https://www.etlsystems.com/" ], "timeline": [ { "at": "2025-12-26T16:15:44.367", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67013" } ] }, { "id": "CVE-2025-66861", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "An issue was discovered in function d_unqualified_name in file cp-demangle.c in BinUtils 2.26 allowing attackers to cause a denial of service via crafted PE file.", "updated_at": "2026-10-13T09:10:00.323", "published_at": "2025-12-29T17:15:45.997", "cvss": 2.5, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L", "confidence": 100, "confidence_label": "verified", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 24, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "High", "cwe": "CWE-400", "what_happened": "An issue was discovered in function d_unqualified_name in file cp-demangle.c in BinUtils 2.26 allowing attackers to cause a denial of service via crafted PE file.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-12-29", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/caozhzh/CRGF-Vul/blob/main/cxxfilt/crash1.md" } ], "references": [ "https://github.com/caozhzh/CRGF-Vul/blob/main/cxxfilt/crash1.md" ], "timeline": [ { "at": "2025-12-29T17:15:45.997", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66861" } ] }, { "id": "CVE-2025-66737", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "Yealink T21P_E2 Phone 52.84.0.15 is vulnerable to Directory Traversal. A remote normal privileged attacker can read arbitrary files via a crafted request result read function of the diagnostic component.", "updated_at": "2026-10-13T09:10:00.323", "published_at": "2025-12-26T17:15:44.090", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "confidence": 100, "confidence_label": "verified", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 23, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-23", "what_happened": "Yealink T21P_E2 Phone 52.84.0.15 is vulnerable to Directory Traversal. A remote normal privileged attacker can read arbitrary files via a crafted request result read function of the diagnostic component.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "drive.google.com", "author": "NVD reference", "first_seen": "2025-12-26", "confidence": "High", "verification": "verified", "verified": true, "url": "https://drive.google.com/file/d/1MpxnCL4koKupqWWDmY3ljlybjIPD8ieD/view?usp=sharing" } ], "references": [ "https://drive.google.com/file/d/1MpxnCL4koKupqWWDmY3ljlybjIPD8ieD/view?usp=sharing" ], "timeline": [ { "at": "2025-12-26T17:15:44.090", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66737" } ] }, { "id": "CVE-2025-66576", "vendor": "Remotecontrolio", "product": "Remote Keyboard Desktop", "title": "Remote Keyboard Desktop vulnerability", "summary": "Remote Keyboard Desktop 1.0.1 enables remote attackers to execute system commands via the rundll32.exe exported function export, allowing unauthenticated code execution.", "updated_at": "2026-10-18T15:10:00.097", "published_at": "2025-12-04T21:16:10.600", "cvss": 8.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "1.0.1", "fixed": "See vendor advisory", "source_count": 12, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-78", "what_happened": "Remote Keyboard Desktop 1.0.1 enables remote attackers to execute system commands via the rundll32.exe exported function export, allowing unauthenticated code execution.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "www.exploit-db.com", "author": "NVD reference", "first_seen": "2025-12-04", "confidence": "High", "verification": "verified", "verified": true, "url": "https://www.exploit-db.com/exploits/52299" } ], "references": [ "https://apps.microsoft.com/detail/9n0jw8v5sc9m?hl=neutral&gl=US&ocid=pdpshare", "https://remotecontrolio.web.app/", "https://www.exploit-db.com/exploits/52299", "https://www.vulncheck.com/advisories/remote-keyboard-desktop-101-remote-code-execution-rce" ], "timeline": [ { "at": "2025-12-04T21:16:10.600", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66576" } ] }, { "id": "CVE-2025-66574", "vendor": "Compass Plustechologies", "product": "TranzAxis", "title": "TranzAxis vulnerability", "summary": "TranzAxis 3.2.41.10.26 allows authenticated users to inject cross-site scripting via the `Open Object in Tree` endpoint, allowing attackers to steal session cookies and potentially escalate privileges.", "updated_at": "2026-10-18T15:10:00.097", "published_at": "2025-12-04T21:16:10.250", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "3.2.41.10.26", "fixed": "See vendor advisory", "source_count": 11, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "TranzAxis 3.2.41.10.26 allows authenticated users to inject cross-site scripting via the `Open Object in Tree` endpoint, allowing attackers to steal session cookies and potentially escalate privileges.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "www.exploit-db.com", "author": "NVD reference", "first_seen": "2025-12-04", "confidence": "High", "verification": "verified", "verified": true, "url": "https://www.exploit-db.com/exploits/52086" } ], "references": [ "https://compassplustechnologies.com/", "https://www.exploit-db.com/exploits/52086", "https://www.vulncheck.com/advisories/tranzaxis-32411026-stored-cross-site-scripting-xss" ], "timeline": [ { "at": "2025-12-04T21:16:10.250", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66574" } ] }, { "id": "CVE-2025-66573", "vendor": "mersive", "product": "Solstice Pod API", "title": "Solstice Pod API vulnerability", "summary": "Solstice Pod API (version 5.5, 6.2) contains an unauthenticated API endpoint (`/api/config`) that exposes sensitive information such as the session key, server version, product details, and display name. Unauthorized users can extract live session information by accessing this endpoint without authentication.", "updated_at": "2026-10-18T15:10:00.097", "published_at": "2025-12-04T21:16:10.083", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "5.5; 6.2", "fixed": "See vendor advisory", "source_count": 12, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-319", "what_happened": "Solstice Pod API (version 5.5, 6.2) contains an unauthenticated API endpoint (`/api/config`) that exposes sensitive information such as the session key, server version, product details, and display name. Unauthorized users can extract live session information by accessing this endpoint without authentication.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "www.exploit-db.com", "author": "NVD reference", "first_seen": "2025-12-04", "confidence": "High", "verification": "verified", "verified": true, "url": "https://www.exploit-db.com/exploits/52104" } ], "references": [ "https://documentation.mersive.com/en/solstice/about-solstice.html", "https://www.exploit-db.com/exploits/52104", "https://www.mersive.com/", "https://www.vulncheck.com/advisories/solstice-pod-api-session-key-extraction-via-api-endpoint" ], "timeline": [ { "at": "2025-12-04T21:16:10.083", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66573" } ] }, { "id": "CVE-2025-66572", "vendor": "loadedcommerce", "product": "Loaded Commerce", "title": "Loaded Commerce vulnerability", "summary": "Loaded Commerce 6.6 contains a client-side template injection vulnerability via the search parameter that allows unauthenticated attackers to execute arbitrary code in the victim's browser context when they visit a crafted URL.", "updated_at": "2026-10-18T15:10:00.097", "published_at": "2025-12-04T21:16:09.920", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "6.6", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-78", "what_happened": "Loaded Commerce 6.6 contains a client-side template injection vulnerability via the search parameter that allows unauthenticated attackers to execute arbitrary code in the victim's browser context when they visit a crafted URL.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://loadedcommerce.com/", "https://www.exploit-db.com/exploits/52084", "https://www.vulncheck.com/advisories/loaded-commerce-66-client-side-template-injectioncsti" ], "timeline": [ { "at": "2025-12-04T21:16:09.920", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66572" } ] }, { "id": "CVE-2025-66571", "vendor": "Unknown", "product": "UNA CMS", "title": "UNA CMS vulnerability", "summary": "UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 contain a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php where the profile_id POST parameter is passed to PHP unserialize() without proper handling, allowing remote, unauthenticated attackers to inject arbitrary PHP objects and potentially write and execute arbitrary PHP code.", "updated_at": "2026-10-18T15:10:00.097", "published_at": "2025-12-04T21:16:09.747", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "9.0.0-RC1 through 14.0.0-RC4 (custom)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-502", "what_happened": "UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 contain a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php where the profile_id POST parameter is passed to PHP unserialize() without proper handling, allowing remote, unauthenticated attackers to inject arbitrary PHP objects and potentially write and execute arbitrary PHP code.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/unacms/una", "https://karmainsecurity.com/KIS-2025-01", "https://unacms.com", "https://www.exploit-db.com/exploits/52139", "https://www.vulncheck.com/advisories/una-cms-900-rc1-1400-rc4-php-object-injection" ], "timeline": [ { "at": "2025-12-04T21:16:09.747", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66571" } ] }, { "id": "CVE-2025-66564", "vendor": "sigstore", "product": "timestamp-authority", "title": "timestamp-authority vulnerability", "summary": "Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID (which is untrusted data) on periods. Similarly, function api.getContentType splits the Content-Type header (which is also untrusted data) on an application string. As a result, in the face of a malicious request with either an excessively long OID in the payload containing many period characters or a malformed Content-Type header, a call to api.ParseJSONRequest or api.getContentType incurs allocations of O(n) bytes (where n stands for the length of the function's argument). This vulnerability is fixed in 2.0.3.", "updated_at": "2026-10-18T15:10:00.097", "published_at": "2025-12-04T23:15:47.430", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "confidence": 35, "confidence_label": "observed", "affected": "< 2.0.3", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-405", "what_happened": "Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID (which is untrusted data) on periods. Similarly, function api.getContentType splits the Content-Type header (which is also untrusted data) on an application string. As a result, in the face of a malicious request with either an excessively long OID in the payload containing many period characters or a malformed Content-Type header, a call to api.ParseJSONRequest or api.getContentType incurs allocations of O(n) bytes (where n stands for the length of the function's argument). This vulnerability is fixed in 2.0.3.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/sigstore/timestamp-authority/commit/0cae34e197d685a14904e0bad135b89d13b69421", "https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-4qg8-fj49-pxjh" ], "timeline": [ { "at": "2025-12-04T23:15:47.430", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66564" } ] }, { "id": "CVE-2025-66563", "vendor": "monkeytypegame", "product": "monkeytype", "title": "monkeytype vulnerability", "summary": "Monkeytype is a minimalistic and customizable typing test. In 25.49.0 and earlier, there is improper handling of user input which allows an attacker to execute malicious javascript on anyone viewing a malicious quote submission. quote.text and quote.source are user input, and they're inserted straight into the DOM. If they contain HTML tags, they will be rendered (after some escaping using quotes and textarea tags).", "updated_at": "2026-10-18T15:10:00.097", "published_at": "2025-12-04T23:15:47.270", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "<= 25.49.0", "fixed": "See vendor advisory", "source_count": 10, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Monkeytype is a minimalistic and customizable typing test. In 25.49.0 and earlier, there is improper handling of user input which allows an attacker to execute malicious javascript on anyone viewing a malicious quote submission. quote.text and quote.source are user input, and they're inserted straight into the DOM. If they contain HTML tags, they will be rendered (after some escaping using quotes and textarea tags).", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-12-04", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/monkeytypegame/monkeytype/security/advisories/GHSA-mfjh-9552-8g27" } ], "references": [ "https://github.com/monkeytypegame/monkeytype/commit/d6d062a77132ba7d6ba3b482d46ae329d3b8d695", "https://github.com/monkeytypegame/monkeytype/security/advisories/GHSA-mfjh-9552-8g27" ], "timeline": [ { "at": "2025-12-04T23:15:47.270", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66563" } ] }, { "id": "CVE-2025-66561", "vendor": "Syslifters", "product": "sysreptor", "title": "sysreptor vulnerability", "summary": "SysReptor is a fully customizable pentest reporting platform. Prior to 2025.102, there is a Stored Cross-Site Scripting (XSS) vulnerability allows authenticated users to execute malicious JavaScript in the context of other logged-in users by uploading malicious JavaScript files in the web UI. This vulnerability is fixed in 2025.102.", "updated_at": "2026-10-18T15:10:00.097", "published_at": "2025-12-04T23:15:47.107", "cvss": 7.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "< 2025.102", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "SysReptor is a fully customizable pentest reporting platform. Prior to 2025.102, there is a Stored Cross-Site Scripting (XSS) vulnerability allows authenticated users to execute malicious JavaScript in the context of other logged-in users by uploading malicious JavaScript files in the web UI. This vulnerability is fixed in 2025.102.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-64vw-v5c4-mgvm" ], "timeline": [ { "at": "2025-12-04T23:15:47.107", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66561" } ] }, { "id": "CVE-2025-66559", "vendor": "taikoxyz", "product": "taiko-mono", "title": "taiko-mono vulnerability", "summary": "Taiko Alethia is an Ethereum-equivalent, permissionless, based rollup designed to scale Ethereum without compromising its fundamental properties. In 2.3.1 and earlier, TaikoInbox._verifyBatches (packages/protocol/contracts/layer1/based/TaikoInbox.sol:627-678) advanced the local tid to whatever transition matched the current blockHash before knowing whether that batch would actually be verified. When the loop later broke (e.g., cooldown window not yet passed or transition invalidated), the function still wrote that newer tid into batches[lastVerifiedBatchId].verifiedTransitionId after decrementing batchId. Result: the last verified batch could end up pointing at a transition index from the next batch (often zeroed), corrupting the verified chain pointer.", "updated_at": "2026-10-18T15:10:00.097", "published_at": "2025-12-04T23:15:46.940", "cvss": 8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "<= 2.3.1", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-129", "what_happened": "Taiko Alethia is an Ethereum-equivalent, permissionless, based rollup designed to scale Ethereum without compromising its fundamental properties. In 2.3.1 and earlier, TaikoInbox._verifyBatches (packages/protocol/contracts/layer1/based/TaikoInbox.sol:627-678) advanced the local tid to whatever transition matched the current blockHash before knowing whether that batch would actually be verified. When the loop later broke (e.g., cooldown window not yet passed or transition invalidated), the function still wrote that newer tid into batches[lastVerifiedBatchId].verifiedTransitionId after decrementing batchId. Result: the last verified batch could end up pointing at a transition index from the next batch (often zeroed), corrupting the verified chain pointer.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/taikoxyz/taiko-mono/commit/379f5cb4ffe9e1945563ab2c7740bc9f4ea004d8", "https://github.com/taikoxyz/taiko-mono/security/advisories/GHSA-5mxh-r33p-6h5x" ], "timeline": [ { "at": "2025-12-04T23:15:46.940", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66559" } ] }, { "id": "CVE-2025-66555", "vendor": "airkeyboardapp", "product": "AirKeyboard iOS App", "title": "AirKeyboard iOS App vulnerability", "summary": "AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type arbitrary keystrokes directly into the victim's iOS device in real-time without user interaction, resulting in full remote input control.", "updated_at": "2026-10-18T15:10:00.097", "published_at": "2025-12-04T21:16:09.573", "cvss": 8.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "1.0.5", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-306", "what_happened": "AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type arbitrary keystrokes directly into the victim's iOS device in real-time without user interaction, resulting in full remote input control.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://airkeyboardapp.com", "https://apps.apple.com/us/app/air-keyboard/id6463187929", "https://www.exploit-db.com/exploits/52333", "https://www.vulncheck.com/advisories/airkeyboard-ios-app-105-remote-input-injection" ], "timeline": [ { "at": "2025-12-04T21:16:09.573", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66555" } ] }, { "id": "CVE-2025-66552", "vendor": "nextcloud", "product": "security-advisories", "title": "security-advisories vulnerability", "summary": "Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with groupfolders caused the admin_audit app to not properly log all actions on files and folders inside groupfolders. This vulnerability is fixed in Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1.", "updated_at": "2026-10-18T14:10:00.110", "published_at": "2025-12-05T17:16:05.687", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "confidence": 35, "confidence_label": "observed", "affected": ">= 32.0.0beta1, < 32.0.1; < 31.0.9", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-778", "what_happened": "Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with groupfolders caused the admin_audit app to not properly log all actions on files and folders inside groupfolders. This vulnerability is fixed in Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-ww9m-f8j4-jj9x", "https://github.com/nextcloud/server/commit/7cc005c43c72bc384848cf8cb851895827c412f6", "https://github.com/nextcloud/server/pull/50992", "https://hackerone.com/reports/2890071" ], "timeline": [ { "at": "2025-12-05T17:16:05.687", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66552" } ] }, { "id": "CVE-2025-66550", "vendor": "nextcloud", "product": "security-advisories", "title": "security-advisories vulnerability", "summary": "Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a calendar event with a crafted attachment that links to a download link of a file on the same Nextcloud server, the file would be downloaded without the user confirming the action. This vulnerability is fixed in 4.7.17 and 5.2.4.", "updated_at": "2026-10-18T14:10:00.110", "published_at": "2025-12-05T17:16:05.500", "cvss": 5.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": ">= 5.0.0-rc.1, < 5.2.4; < 4.7.17", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-241", "what_happened": "Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a calendar event with a crafted attachment that links to a download link of a file on the same Nextcloud server, the file would be downloaded without the user confirming the action. This vulnerability is fixed in 4.7.17 and 5.2.4.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/nextcloud/calendar/commit/63a6c398db01391eb9fd5297a0d4c3d6e614f769", "https://github.com/nextcloud/calendar/pull/6971", "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-f29c-ppmv-8mcv", "https://hackerone.com/reports/3112033" ], "timeline": [ { "at": "2025-12-05T17:16:05.500", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66550" } ] }, { "id": "CVE-2025-66547", "vendor": "nextcloud", "product": "security-advisories", "title": "security-advisories vulnerability", "summary": "Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31.0.1, non-privileged users can modify tags on files they should not have access to via bulk tagging. This vulnerability is fixed in 31.0.1.", "updated_at": "2026-10-18T14:10:00.110", "published_at": "2025-12-05T17:16:05.330", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "< 31.0.1", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-639", "what_happened": "Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31.0.1, non-privileged users can modify tags on files they should not have access to via bulk tagging. This vulnerability is fixed in 31.0.1.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hq6c-r898-fgf2", "https://github.com/nextcloud/server/commit/b44f1568f2dc97c746281d99e2342ad679e3d8a9", "https://github.com/nextcloud/server/issues/51247", "https://github.com/nextcloud/server/pull/51288", "https://hackerone.com/reports/3040887" ], "timeline": [ { "at": "2025-12-05T17:16:05.330", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66547" } ] }, { "id": "CVE-2025-66546", "vendor": "nextcloud", "product": "security-advisories", "title": "security-advisories vulnerability", "summary": "Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential ID without known the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1.", "updated_at": "2026-10-18T14:10:00.110", "published_at": "2025-12-05T17:16:05.163", "cvss": 3.3, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": ">= 6.0.0-rc.1, < 6.0.1; >= 5.0.0-rc.1, < 5.5.6; >= 3.0.0-beta1, < 4.7.19", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-639", "what_happened": "Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential ID without known the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/nextcloud/calendar/commit/f41650c3681fc4a4130eb883f5c0899c011326b3", "https://github.com/nextcloud/calendar/pull/7537", "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7x2j-2674-fj95", "https://hackerone.com/reports/3275810" ], "timeline": [ { "at": "2025-12-05T17:16:05.163", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66546" } ] }, { "id": "CVE-2025-66512", "vendor": "nextcloud", "product": "security-advisories", "title": "security-advisories vulnerability", "summary": "Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the content security policy when a malicious user manages to trick a user it viewing an uploaded SVG outside of the Nextcloud Servers web page.", "updated_at": "2026-10-18T14:10:00.110", "published_at": "2025-12-05T17:16:04.980", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": ">= 32.0.0beta1, < 32.0.3; < 31.0.12", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-80", "what_happened": "Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the content security policy when a malicious user manages to trick a user it viewing an uploaded SVG outside of the Nextcloud Servers web page.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qcw2-p26m-9gc5", "https://github.com/nextcloud/viewer/commit/5044a27d61bc40c0f134298d36af91f865335b63", "https://github.com/nextcloud/viewer/pull/3023", "https://hackerone.com/reports/3357808" ], "timeline": [ { "at": "2025-12-05T17:16:04.980", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66512" } ] }, { "id": "CVE-2025-66511", "vendor": "nextcloud", "product": "security-advisories", "title": "security-advisories vulnerability", "summary": "Nextcloud Calendar is a calendar app for Nextcloud. Prior to 6.0.3, the Calendar app generates participant tokens for meeting proposals using a hash function, allowing an attacker to compute valid participant tokens, which allowed them to request details and submit dates in meeting proposals. The tokens are not purely random generated. This vulnerability is fixed in 6.0.3.", "updated_at": "2026-10-18T14:10:00.110", "published_at": "2025-12-05T17:16:04.797", "cvss": 4.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": ">= 6.0.0-rc.1, < 6.0.3", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-330", "what_happened": "Nextcloud Calendar is a calendar app for Nextcloud. Prior to 6.0.3, the Calendar app generates participant tokens for meeting proposals using a hash function, allowing an attacker to compute valid participant tokens, which allowed them to request details and submit dates in meeting proposals. The tokens are not purely random generated. This vulnerability is fixed in 6.0.3.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/nextcloud/calendar/commit/8de14ae87f321f5f09280d9895a27d54d24f33fb", "https://github.com/nextcloud/calendar/pull/7659", "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-whm3-vv55-gf27", "https://hackerone.com/reports/3385434" ], "timeline": [ { "at": "2025-12-05T17:16:04.797", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66511" } ] }, { "id": "CVE-2025-66510", "vendor": "nextcloud", "product": "security-advisories", "title": "security-advisories vulnerability", "summary": "Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, contacts search allowed to retrieve personal data of other users (emails, names, identifiers) without proper access control. This allows an authenticated user to retrieve information about accounts that are not related or added as contacts.", "updated_at": "2026-10-18T14:10:00.110", "published_at": "2025-12-05T17:16:04.613", "cvss": 4.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": ">= 32.0.0beta1, < 32.0.1; < 31.0.10", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-359", "what_happened": "Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, contacts search allowed to retrieve personal data of other users (emails, names, identifiers) without proper access control. This allows an authenticated user to retrieve information about accounts that are not related or added as contacts.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-495w-cqv6-wr59", "https://github.com/nextcloud/server/commit/e4866860cbf24a746eb8a125587262a4c8831c57", "https://github.com/nextcloud/server/pull/55657" ], "timeline": [ { "at": "2025-12-05T17:16:04.613", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66510" } ] }, { "id": "CVE-2025-66509", "vendor": "laradashboard", "product": "laradashboard", "title": "laradashboard vulnerability", "summary": "LaraDashboard is an all-In-one solution to start a Laravel Application. In 2.3.0 and earlier, the password reset flow trusts the Host header, allowing attackers to redirect the administrator’s reset token to an attacker-controlled server. This can be combined with the module installation process to automatically execute the ServiceProvider::boot() method, enabling arbitrary PHP code execution.", "updated_at": "2026-10-18T15:10:00.097", "published_at": "2025-12-04T22:15:49.673", "cvss": 8.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "<= 2.3.0", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-284", "what_happened": "LaraDashboard is an all-In-one solution to start a Laravel Application. In 2.3.0 and earlier, the password reset flow trusts the Host header, allowing attackers to redirect the administrator’s reset token to an attacker-controlled server. This can be combined with the module installation process to automatically execute the ServiceProvider::boot() method, enabling arbitrary PHP code execution.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/laradashboard/laradashboard/commit/cc42f9cdf8e59bce794ee2d812a9709b1e6efa87", "https://github.com/laradashboard/laradashboard/security/advisories/GHSA-j9mm-c9cj-pc82" ], "timeline": [ { "at": "2025-12-04T22:15:49.673", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66509" } ] }, { "id": "CVE-2025-66506", "vendor": "sigstore", "product": "fulcio", "title": "fulcio vulnerability", "summary": "Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This vulnerability is fixed in 1.8.3.", "updated_at": "2026-10-18T15:10:00.097", "published_at": "2025-12-04T22:15:49.503", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "confidence": 35, "confidence_label": "observed", "affected": "< 1.8.3", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-405", "what_happened": "Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This vulnerability is fixed in 1.8.3.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/sigstore/fulcio/commit/765a0e57608b9ef390e1eeeea8595b9054c63a5a", "https://github.com/sigstore/fulcio/security/advisories/GHSA-f83f-xpx7-ffpw" ], "timeline": [ { "at": "2025-12-04T22:15:49.503", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66506" } ] }, { "id": "CVE-2025-66479", "vendor": "anthropic-experimental", "product": "sandbox-runtime", "title": "sandbox-runtime vulnerability", "summary": "Anthropic Sandbox Runtime is a lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container. Prior to 0.0.16, due to a bug in sandboxing logic, sandbox-runtime did not properly enforce a network sandbox if the sandbox policy did not configure any allowed domains. This could allow sandboxed code to make network requests outside of the sandbox. A patch for this was released in v0.0.16.", "updated_at": "2026-10-18T15:10:00.097", "published_at": "2025-12-04T21:16:09.393", "cvss": 1.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "< 0.0.16", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Local", "authentication": "High", "complexity": "Low", "cwe": "CWE-693", "what_happened": "Anthropic Sandbox Runtime is a lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container. Prior to 0.0.16, due to a bug in sandboxing logic, sandbox-runtime did not properly enforce a network sandbox if the sandbox policy did not configure any allowed domains. This could allow sandboxed code to make network requests outside of the sandbox. A patch for this was released in v0.0.16.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/anthropic-experimental/sandbox-runtime/commit/bea2930cc1db9c73a1b15acf6dc19c5261aec1f3", "https://github.com/anthropic-experimental/sandbox-runtime/security/advisories/GHSA-9gqj-5w7c-vx47" ], "timeline": [ { "at": "2025-12-04T21:16:09.393", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66479" } ] }, { "id": "CVE-2025-66478", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2025-66478-POC exploit", "summary": "Exploit for CVE-2025-66478.", "updated_at": "2026-10-20T12:05:12Z", "published_at": "2026-10-20T12:05:12Z", "cvss": 8.2, "confidence": 80, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Unauthenticated RCE in Next.js 15.x/16.x via unsafe deserialization in RSC Flight protocol.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for CVE-2025-66478-POC", "summary": "Unauthenticated RCE in Next.js 15.x/16.x via unsafe deserialization in RSC Flight protocol.", "what_happened": "Unauthenticated RCE in Next.js 15.x/16.x via unsafe deserialization in RSC Flight protocol.", "cvss": 8.2, "cvss_vector": "NONE", "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-WANGXSO-CVE-2025-66478-POC", "https://kitploit.com/en/tools/github/wangxso/cve-2025-66478-poc" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-10-20T12:05:12", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-WANGXSO-CVE-2025-66478-POC" }, { "title": "Exploit for CVE-2025-66478-POC", "summary": "Unauthenticated RCE in Next.js 15.x/16.x via unsafe deserialization in RSC Flight protocol.", "what_happened": "Unauthenticated RCE in Next.js 15.x/16.x via unsafe deserialization in RSC Flight protocol.", "cvss": 8.2, "cvss_vector": "NONE", "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-WANGXSO-CVE-2025-66478-POC", "https://kitploit.com/en/tools/github/wangxso/cve-2025-66478-poc" ], "repository": "kitploit.com", "author": "en", "first_seen": "2026-10-20T12:05:12", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/en/tools/github/wangxso/cve-2025-66478-poc" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-WANGXSO-CVE-2025-66478-POC", "https://kitploit.com/en/tools/github/wangxso/cve-2025-66478-poc" ], "timeline": [ { "at": "2026-10-20T12:05:12Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-WANGXSO-CVE-2025-66478-POC" } ], "cvss_vector": "NONE" }, { "id": "CVE-2025-66398", "vendor": "SignalK", "product": "signalk-server", "title": "signalk-server vulnerability", "summary": "Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (`restoreFilePath`) of the server via the `/skServer/validateBackup` endpoint. This allows the attacker to hijack the administrator's \"Restore\" functionality to overwrite critical server configuration files (e.g., `security.json`, `package.json`), leading to account takeover and Remote Code Execution (RCE). Version 2.19.0 patches this vulnerability.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2026-01-01T18:15:40.550", "cvss": 9.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "confidence": 100, "confidence_label": "verified", "affected": "< 2.19.0", "fixed": "See vendor advisory", "source_count": 204, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-78", "what_happened": "Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (`restoreFilePath`) of the server via the `/skServer/validateBackup` endpoint. This allows the attacker to hijack the administrator's \"Restore\" functionality to overwrite critical server configuration files (e.g., `security.json`, `package.json`), leading to account takeover and Remote Code Execution (RCE). Version 2.19.0 patches this vulnerability.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2026-01-01", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-w3x5-7c4c-66p9" }, { "repository": "PoC-in-GitHub · joshuavanderpoll/cve-2025-66398", "author": "joshuavanderpoll", "first_seen": "2026-03-10", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 3, "title": "CVE-2025-66398 — Signal K Server ≤ 2.18.0 RCE PoC", "summary": "CVE-2025-66398 — Signal K Server ≤ 2.18.0 RCE PoC", "url": "https://github.com/joshuavanderpoll/cve-2025-66398" }, { "repository": "PoC-in-GitHub · showy-headteacher114/cve-2025-66398", "author": "showy-headteacher114", "first_seen": "2026-03-23", "confidence": "Medium", "verification": "correlated", "verified": false, "stars": 1, "title": "Demonstrate exploitation of Signal K Server CVE-2025-66398 allowing unauthenticated attackers to inject backdoor and enable remote code execution.", "summary": "Demonstrate exploitation of Signal K Server CVE-2025-66398 allowing unauthenticated attackers to inject backdoor and enable remote code execution.", "url": "https://github.com/showy-headteacher114/cve-2025-66398" } ], "references": [ "https://github.com/SignalK/signalk-server/releases/tag/v2.19.0", "https://github.com/SignalK/signalk-server/security/advisories/GHSA-w3x5-7c4c-66p9", "https://github.com/joshuavanderpoll/cve-2025-66398", "https://github.com/showy-headteacher114/cve-2025-66398" ], "timeline": [ { "at": "2026-01-01T18:15:40.550", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66398" } ] }, { "id": "CVE-2025-66391", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write operations, e.g., the system will send a one-time password to an attacker-controlled email address when the attacker attempts to reset the password of a user account.", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-06-17T14:17:31.467", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 100, "confidence_label": "verified", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 26, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-284", "what_happened": "In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write operations, e.g., the system will send a one-time password to an attacker-controlled email address when the attacker attempts to reset the password of a user account.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "mandeepsohal/CVE-2025-66391", "author": "mandeepsohal", "first_seen": "2026-06-17", "confidence": "High", "verification": "verified", "verified": true, "stars": 0, "title": "CVE-2025-66391 repository", "summary": "", "url": "https://github.com/mandeepsohal/CVE-2025-66391" } ], "references": [ "https://citrix.cloud.com/", "https://github.com/mandeepsohal/CVE-2025-66391/blob/main/Exploit.md", "https://github.com/mandeepsohal/CVE-2025-66391" ], "timeline": [ { "at": "2026-06-17T14:17:31.467", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66391" } ] }, { "id": "CVE-2025-66389", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler URI parameter to fetch_webpage. Therefore, exfiltration could occur if there is indirect prompt injection.", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-06-22T14:16:24.073", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "confidence": 100, "confidence_label": "verified", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 26, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-552", "what_happened": "GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler URI parameter to fetch_webpage. Therefore, exfiltration could occur if there is indirect prompt injection.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "blindcyber.com", "author": "NVD reference", "first_seen": "2026-06-22", "confidence": "High", "verification": "verified", "verified": true, "url": "https://blindcyber.com/2025/10/28/copilot-fun/" } ], "references": [ "https://blindcyber.com/2025/10/28/copilot-fun/", "https://github.com/microsoft/vscode-copilot-chat/", "https://github.com/microsoft/vscode/blob/03baef1008086ed4960042fa463e570072173bb5/src/vs/workbench/contrib/chat/electron-browser/tools/fetchPageTool.ts#L152" ], "timeline": [ { "at": "2026-06-22T14:16:24.073", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66389" } ] }, { "id": "CVE-2025-66270", "vendor": "KDE", "product": "KDE Connect protocol", "title": "KDE Connect protocol vulnerability", "summary": "The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.", "updated_at": "2026-10-18T15:10:00.097", "published_at": "2025-12-05T06:16:09.253", "cvss": 4.7, "cvss_vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "8 (custom)", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Adjacent Network", "authentication": "None", "complexity": "High", "cwe": "CWE-290", "what_happened": "The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/GSConnect/gnome-shell-extension-gsconnect/commit/a38246deec0af50ae218cdc51db32cdd7eb145e3", "https://github.com/andyholmes/valent/commit/85f773124a67ed1add79e7465bb088ec667cccce", "https://invent.kde.org/network/kdeconnect-android/-/commit/675d2d24a1eb95d15d9e5bde2b7e2271d5ada6a9", "https://invent.kde.org/network/kdeconnect-ios/-/commit/6c003c22d04270cabc4b262d399c753d55cf9080", "https://invent.kde.org/network/kdeconnect-kde/-/commit/4e53bcdd5d4c28bd9fefd114b807ce35d7b3373e", "https://kde.org/info/security/advisory-20251128-1.txt" ], "timeline": [ { "at": "2025-12-05T06:16:09.253", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66270" } ] }, { "id": "CVE-2025-66200", "vendor": "Apache Software Foundation", "product": "Apache HTTP Server", "title": "Apache HTTP Server vulnerability", "summary": "mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid.\n\nThis issue affects Apache HTTP Server: from 2.4.7 through 2.4.65.\n\nUsers are recommended to upgrade to version 2.4.66, which fixes the issue.", "updated_at": "2026-10-18T14:10:00.110", "published_at": "2025-12-05T11:15:52.747", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "2.4.7 through 2.4.65 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-288", "what_happened": "mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid.\n\nThis issue affects Apache HTTP Server: from 2.4.7 through 2.4.65.\n\nUsers are recommended to upgrade to version 2.4.66, which fixes the issue.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://httpd.apache.org/security/vulnerabilities_24.html", "http://www.openwall.com/lists/oss-security/2025/12/04/8" ], "timeline": [ { "at": "2025-12-05T11:15:52.747", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66200" } ] }, { "id": "CVE-2025-66160", "vendor": "merkulove", "product": "Select Graphist for Elementor\t Graphist for Elementor", "title": "Select Graphist for Elementor\t Graphist for Elementor vulnerability", "summary": "Missing Authorization vulnerability in merkulove Select Graphist for Elementor\t Graphist for Elementor graphist-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Select Graphist for Elementor\t Graphist for Elementor: from n/a through <= 1.2.10.", "updated_at": "2026-09-23T14:10:00.190", "published_at": "2025-12-31T17:15:50.783", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.2.10 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in merkulove Select Graphist for Elementor\t Graphist for Elementor graphist-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Select Graphist for Elementor\t Graphist for Elementor: from n/a through <= 1.2.10.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/graphist-elementor/vulnerability/wordpress-select-graphist-for-elementor-graphist-for-elementor-plugin-1-2-10-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T17:15:50.783", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66160" } ] }, { "id": "CVE-2025-66159", "vendor": "merkulove", "product": "Walker for Elementor", "title": "Walker for Elementor vulnerability", "summary": "Missing Authorization vulnerability in merkulove Walker for Elementor walker-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Walker for Elementor: from n/a through <= 1.1.6.", "updated_at": "2026-09-23T14:10:00.190", "published_at": "2025-12-31T17:15:50.583", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.1.6 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in merkulove Walker for Elementor walker-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Walker for Elementor: from n/a through <= 1.1.6.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/walker-elementor/vulnerability/wordpress-walker-for-elementor-plugin-1-1-6-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T17:15:50.583", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66159" } ] }, { "id": "CVE-2025-66158", "vendor": "merkulove", "product": "Gmaper for Elementor", "title": "Gmaper for Elementor vulnerability", "summary": "Missing Authorization vulnerability in merkulove Gmaper for Elementor gmaper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gmaper for Elementor: from n/a through <= 1.0.9.", "updated_at": "2026-09-23T14:10:00.190", "published_at": "2025-12-31T17:15:50.410", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.0.9 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in merkulove Gmaper for Elementor gmaper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gmaper for Elementor: from n/a through <= 1.0.9.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/gmaper-elementor/vulnerability/wordpress-gmaper-for-elementor-plugin-1-0-9-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T17:15:50.410", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66158" } ] }, { "id": "CVE-2025-66157", "vendor": "merkulove", "product": "Sliper for Elementor", "title": "Sliper for Elementor vulnerability", "summary": "Missing Authorization vulnerability in merkulove Sliper for Elementor sliper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sliper for Elementor: from n/a through <= 1.0.10.", "updated_at": "2026-09-23T14:10:00.190", "published_at": "2025-12-31T17:15:49.593", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.0.10 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in merkulove Sliper for Elementor sliper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sliper for Elementor: from n/a through <= 1.0.10.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/sliper-elementor/vulnerability/wordpress-sliper-for-elementor-plugin-1-0-10-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T17:15:49.593", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66157" } ] }, { "id": "CVE-2025-66156", "vendor": "merkulove", "product": "Watcher for Elementor", "title": "Watcher for Elementor vulnerability", "summary": "Missing Authorization vulnerability in merkulove Watcher for Elementor watcher-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watcher for Elementor: from n/a through <= 1.0.9.", "updated_at": "2026-09-23T14:10:00.190", "published_at": "2025-12-31T17:15:49.387", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.0.9 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in merkulove Watcher for Elementor watcher-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watcher for Elementor: from n/a through <= 1.0.9.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/watcher-elementor/vulnerability/wordpress-watcher-for-elementor-plugin-1-0-9-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T17:15:49.387", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66156" } ] }, { "id": "CVE-2025-66155", "vendor": "merkulove", "product": "Questionar for Elementor", "title": "Questionar for Elementor vulnerability", "summary": "Missing Authorization vulnerability in merkulove Questionar for Elementor questionar-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Questionar for Elementor: from n/a through <= 1.1.7.", "updated_at": "2026-09-23T14:10:00.190", "published_at": "2025-12-31T17:15:49.240", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.1.7 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in merkulove Questionar for Elementor questionar-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Questionar for Elementor: from n/a through <= 1.1.7.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/questionar-elementor/vulnerability/wordpress-questionar-for-elementor-plugin-1-1-7-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T17:15:49.240", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66155" } ] }, { "id": "CVE-2025-66154", "vendor": "merkulove", "product": "Couponer for Elementor", "title": "Couponer for Elementor vulnerability", "summary": "Missing Authorization vulnerability in merkulove Couponer for Elementor couponer-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Couponer for Elementor: from n/a through <= 1.1.7.", "updated_at": "2026-09-23T14:10:00.190", "published_at": "2025-12-31T17:15:48.977", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.1.7 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in merkulove Couponer for Elementor couponer-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Couponer for Elementor: from n/a through <= 1.1.7.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/couponer-elementor/vulnerability/wordpress-couponer-for-elementor-plugin-1-1-7-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T17:15:48.977", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66154" } ] }, { "id": "CVE-2025-66153", "vendor": "merkulove", "product": "Headinger for Elementor", "title": "Headinger for Elementor vulnerability", "summary": "Missing Authorization vulnerability in merkulove Headinger for Elementor headinger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Headinger for Elementor: from n/a through <= 1.1.4.", "updated_at": "2026-09-23T14:10:00.190", "published_at": "2025-12-31T19:15:44.690", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.1.4 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in merkulove Headinger for Elementor headinger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Headinger for Elementor: from n/a through <= 1.1.4.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/headinger-elementor/vulnerability/wordpress-headinger-for-elementor-plugin-1-1-4-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T19:15:44.690", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66153" } ] }, { "id": "CVE-2025-66152", "vendor": "merkulove", "product": "Criptopayer for Elementor", "title": "Criptopayer for Elementor vulnerability", "summary": "Missing Authorization vulnerability in merkulove Criptopayer for Elementor criptopayer-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Criptopayer for Elementor: from n/a through <= 1.0.1.", "updated_at": "2026-09-23T14:10:00.190", "published_at": "2025-12-31T19:15:44.533", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.0.1 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in merkulove Criptopayer for Elementor criptopayer-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Criptopayer for Elementor: from n/a through <= 1.0.1.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/criptopayer-elementor/vulnerability/wordpress-criptopayer-for-elementor-plugin-1-0-1-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T19:15:44.533", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66152" } ] }, { "id": "CVE-2025-66151", "vendor": "merkulove", "product": "Countdowner for Elementor", "title": "Countdowner for Elementor vulnerability", "summary": "Missing Authorization vulnerability in merkulove Countdowner for Elementor countdowner-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Countdowner for Elementor: from n/a through <= 1.0.4.", "updated_at": "2026-09-23T14:10:00.190", "published_at": "2025-12-31T19:15:44.380", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.0.4 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in merkulove Countdowner for Elementor countdowner-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Countdowner for Elementor: from n/a through <= 1.0.4.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/countdowner-elementor/vulnerability/wordpress-countdowner-for-elementor-plugin-1-0-4-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T19:15:44.380", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66151" } ] }, { "id": "CVE-2025-66150", "vendor": "merkulove", "product": "Appender", "title": "Appender vulnerability", "summary": "Missing Authorization vulnerability in merkulove Appender appender allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Appender: from n/a through <= 1.1.1.", "updated_at": "2026-09-23T14:10:00.190", "published_at": "2025-12-31T19:15:44.237", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.1.1 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in merkulove Appender appender allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Appender: from n/a through <= 1.1.1.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/appender/vulnerability/wordpress-appender-plugin-1-1-1-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T19:15:44.237", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66150" } ] }, { "id": "CVE-2025-66149", "vendor": "merkulove", "product": "UnGrabber", "title": "UnGrabber vulnerability", "summary": "Missing Authorization vulnerability in merkulove UnGrabber ungrabber allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UnGrabber: from n/a through <= 3.1.3.", "updated_at": "2026-09-23T14:10:00.190", "published_at": "2025-12-31T19:15:44.080", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 3.1.3 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in merkulove UnGrabber ungrabber allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UnGrabber: from n/a through <= 3.1.3.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/ungrabber/vulnerability/wordpress-ungrabber-plugin-3-1-3-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T19:15:44.080", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66149" } ] }, { "id": "CVE-2025-66148", "vendor": "merkulove", "product": "Conformer for Elementor", "title": "Conformer for Elementor vulnerability", "summary": "Missing Authorization vulnerability in merkulove Conformer for Elementor conformer-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conformer for Elementor: from n/a through <= 1.0.7.", "updated_at": "2026-09-23T14:10:00.190", "published_at": "2025-12-31T20:15:43.480", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.0.7 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in merkulove Conformer for Elementor conformer-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conformer for Elementor: from n/a through <= 1.0.7.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/conformer-elementor/vulnerability/wordpress-conformer-for-elementor-plugin-1-0-7-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T20:15:43.480", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66148" } ] }, { "id": "CVE-2025-66146", "vendor": "merkulove", "product": "Logger for Elementor", "title": "Logger for Elementor vulnerability", "summary": "Missing Authorization vulnerability in merkulove Logger for Elementor logger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Logger for Elementor: from n/a through <= 1.0.9.", "updated_at": "2026-09-23T14:10:00.190", "published_at": "2025-12-31T20:15:43.350", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.0.9 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in merkulove Logger for Elementor logger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Logger for Elementor: from n/a through <= 1.0.9.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/logger-elementor/vulnerability/wordpress-logger-for-elementor-plugin-1-0-9-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T20:15:43.350", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66146" } ] }, { "id": "CVE-2025-66145", "vendor": "merkulove", "product": "Worker for WPBakery", "title": "Worker for WPBakery vulnerability", "summary": "Missing Authorization vulnerability in merkulove Worker for WPBakery worker-wpbakery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Worker for WPBakery: from n/a through <= 1.1.1.", "updated_at": "2026-09-23T14:10:00.190", "published_at": "2025-12-31T20:15:43.213", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.1.1 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in merkulove Worker for WPBakery worker-wpbakery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Worker for WPBakery: from n/a through <= 1.1.1.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/worker-wpbakery/vulnerability/wordpress-worker-for-wpbakery-plugin-1-1-1-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T20:15:43.213", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66145" } ] }, { "id": "CVE-2025-66144", "vendor": "merkulove", "product": "Worker for Elementor", "title": "Worker for Elementor vulnerability", "summary": "Missing Authorization vulnerability in merkulove Worker for Elementor worker-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Worker for Elementor: from n/a through <= 1.0.10.", "updated_at": "2026-09-23T14:10:00.190", "published_at": "2025-12-31T20:15:43.073", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.0.10 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in merkulove Worker for Elementor worker-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Worker for Elementor: from n/a through <= 1.0.10.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/worker-elementor/vulnerability/wordpress-worker-for-elementor-plugin-1-0-10-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T20:15:43.073", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66144" } ] }, { "id": "CVE-2025-66123", "vendor": "About Envato", "product": "BookPro", "title": "BookPro vulnerability", "summary": "Unauthenticated Insecure Direct Object References (IDOR) in BookPro <= 1.1.0 versions.", "updated_at": "2026-09-29T19:10:00.160", "published_at": "2026-06-26T15:16:35.237", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "n/a through 1.1.0 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-639", "what_happened": "Unauthenticated Insecure Direct Object References (IDOR) in BookPro <= 1.1.0 versions.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/ovabookpro/vulnerability/wordpress-bookpro-plugin-1-1-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-06-26T15:16:35.237", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66123" } ] }, { "id": "CVE-2025-65959", "vendor": "open-webui", "product": "open-webui", "title": "open-webui vulnerability", "summary": "Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Stored XSS vulnerability was discovered in Open-WebUI's Notes PDF download functionality. An attacker can import a Markdown file containing malicious SVG tags into Notes, allowing them to execute arbitrary JavaScript code and steal session tokens when a victim downloads the note as PDF. This vulnerability can be exploited by any authenticated user, and unauthenticated external attackers can steal session tokens from users (both admin and regular users) by sharing specially crafted markdown files. This vulnerability is fixed in 0.6.37.", "updated_at": "2026-10-18T15:10:00.097", "published_at": "2025-12-04T21:16:08.970", "cvss": 8.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "confidence": 100, "confidence_label": "verified", "affected": "< 0.6.37", "fixed": "See vendor advisory", "source_count": 10, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Stored XSS vulnerability was discovered in Open-WebUI's Notes PDF download functionality. An attacker can import a Markdown file containing malicious SVG tags into Notes, allowing them to execute arbitrary JavaScript code and steal session tokens when a victim downloads the note as PDF. This vulnerability can be exploited by any authenticated user, and unauthenticated external attackers can steal session tokens from users (both admin and regular users) by sharing specially crafted markdown files. This vulnerability is fixed in 0.6.37.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-12-04", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-8wvc-869r-xfqf" } ], "references": [ "https://github.com/open-webui/open-webui/commit/03cc6ce8eb5c055115406e2304fbf7e3338b8dce", "https://github.com/open-webui/open-webui/security/advisories/GHSA-8wvc-869r-xfqf" ], "timeline": [ { "at": "2025-12-04T21:16:08.970", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65959" } ] }, { "id": "CVE-2025-65958", "vendor": "open-webui", "product": "open-webui", "title": "open-webui vulnerability", "summary": "Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Server-Side Request Forgery (SSRF) vulnerability in Open WebUI allows any authenticated user to force the server to make HTTP requests to arbitrary URLs. This can be exploited to access cloud metadata endpoints (AWS/GCP/Azure), scan internal networks, access internal services behind firewalls, and exfiltrate sensitive information. No special permissions beyond basic authentication are required. This vulnerability is fixed in 0.6.37.", "updated_at": "2026-10-18T15:10:00.097", "published_at": "2025-12-04T20:16:19.973", "cvss": 8.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "confidence": 100, "confidence_label": "verified", "affected": "< 0.6.37", "fixed": "See vendor advisory", "source_count": 10, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-918", "what_happened": "Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Server-Side Request Forgery (SSRF) vulnerability in Open WebUI allows any authenticated user to force the server to make HTTP requests to arbitrary URLs. This can be exploited to access cloud metadata endpoints (AWS/GCP/Azure), scan internal networks, access internal services behind firewalls, and exfiltrate sensitive information. No special permissions beyond basic authentication are required. This vulnerability is fixed in 0.6.37.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-12-04", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-c6xv-rcvw-v685" } ], "references": [ "https://github.com/open-webui/open-webui/commit/02238d3113e966c353fce18f1b65117380896774", "https://github.com/open-webui/open-webui/security/advisories/GHSA-c6xv-rcvw-v685" ], "timeline": [ { "at": "2025-12-04T20:16:19.973", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65958" } ] }, { "id": "CVE-2025-65945", "vendor": "auth0", "product": "node-jws", "title": "node-jws vulnerability", "summary": "auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, which can allow attackers to bypass signature verification. This issue has been patched in versions 3.2.3 and 4.0.1.", "updated_at": "2026-10-18T15:10:00.097", "published_at": "2025-12-04T19:16:05.550", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "< 3.2.3; >= 4.0.0, <= 4.0.1", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-347", "what_happened": "auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, which can allow attackers to bypass signature verification. This issue has been patched in versions 3.2.3 and 4.0.1.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/auth0/node-jws/commit/34c45b2c04434f925b638de6a061de9339c0ea2e", "https://github.com/auth0/node-jws/security/advisories/GHSA-869p-cjfg-cm3x" ], "timeline": [ { "at": "2025-12-04T19:16:05.550", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65945" } ] }, { "id": "CVE-2025-65885", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "An issue was discovered in the Delight Custom Firmware (CFW) for Nokia Symbian Belle devices on Nokia 808 (Delight v1.8), Nokia N8 (Delight v6.7), Nokia E7 (Delight v1.3), Nokia C7 (Delight v6.7), Nokia 700 (Delight v1.2), Nokia 701 (Delight v1.1), Nokia 603 (Delight v1.0), Nokia 500 (Delight v1.2), Nokia E6 (Delight v1.0), Nokia Oro (Delight v1.0), and Vertu Constellation T (Delight v1.0) allowing local attackers to inject startup scripts via crafted .txt files in the :\\Data directory.", "updated_at": "2026-10-13T09:10:00.323", "published_at": "2025-12-26T15:15:47.357", "cvss": 5.1, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-77", "what_happened": "An issue was discovered in the Delight Custom Firmware (CFW) for Nokia Symbian Belle devices on Nokia 808 (Delight v1.8), Nokia N8 (Delight v6.7), Nokia E7 (Delight v1.3), Nokia C7 (Delight v6.7), Nokia 700 (Delight v1.2), Nokia 701 (Delight v1.1), Nokia 603 (Delight v1.0), Nokia 500 (Delight v1.2), Nokia E6 (Delight v1.0), Nokia Oro (Delight v1.0), and Vertu Constellation T (Delight v1.0) allowing local attackers to inject startup scripts via crafted .txt files in the :\\Data directory.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://gist.github.com/symbuzzer/3315e88adc2bba0b6cc66d192b49546d", "https://www.symwld.com/delight/" ], "timeline": [ { "at": "2025-12-26T15:15:47.357", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65885" } ] }, { "id": "CVE-2025-65570", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "A type confusion in jsish 2.0 allows incorrect control flow during execution of the OP_NEXT opcode. When an “instanceof” expression uses an array element access as the left-hand operand inside a for-in loop, the instructions implementation leaves an additional array reference on the stack rather than consuming it during OP_INSTANCEOF. As a result, OP_NEXT interprets the array as an iterator object and reads the iterCmd function pointer from an invalid structure, potentially causing a crash or enabling code execution depending on heap layout.", "updated_at": "2026-10-13T09:10:00.323", "published_at": "2025-12-29T15:16:01.763", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "confidence": 100, "confidence_label": "verified", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 24, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-843", "what_happened": "A type confusion in jsish 2.0 allows incorrect control flow during execution of the OP_NEXT opcode. When an “instanceof” expression uses an array element access as the left-hand operand inside a for-in loop, the instructions implementation leaves an additional array reference on the stack rather than consuming it during OP_INSTANCEOF. As a result, OP_NEXT interprets the array as an iterator object and reads the iterCmd function pointer from an invalid structure, potentially causing a crash or enabling code execution depending on heap layout.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "blog.mcsky.ro", "author": "NVD reference", "first_seen": "2025-12-29", "confidence": "High", "verification": "verified", "verified": true, "url": "https://blog.mcsky.ro/writeups/2025/11/15/inline8-writeup.html" } ], "references": [ "https://blog.mcsky.ro/writeups/2025/11/15/inline8-writeup.html" ], "timeline": [ { "at": "2025-12-29T15:16:01.763", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65570" } ] }, { "id": "CVE-2025-65427", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "An issue was discovered in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router on firmware version V1.0.0 does not implement rate limiting to /api/login allowing attackers to brute force password enumerations.", "updated_at": "2026-10-13T19:10:00.193", "published_at": "2025-12-16T16:15:59.900", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "confidence": 100, "confidence_label": "verified", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 64, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-307", "what_happened": "An issue was discovered in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router on firmware version V1.0.0 does not implement rate limiting to /api/login allowing attackers to brute force password enumerations.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "title": "Exploit for CVE-2025-65427", "summary": "No rate limiting on /api/login in Dbit N300 T1 Pro router enabling brute-force admin takeover.", "what_happened": "No rate limiting on /api/login in Dbit N300 T1 Pro router enabling brute-force admin takeover.", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-307", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-KIRUBEL-CVE-CVE-2025-65427", "https://kitploit.com/ru/tools/github/kirubel-cve/cve-2025-65427/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-09-16T04:54:30", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-KIRUBEL-CVE-CVE-2025-65427" }, { "title": "Exploit for CVE-2025-65427", "summary": "No rate limiting on /api/login in Dbit N300 T1 Pro router enabling brute-force admin takeover.", "what_happened": "No rate limiting on /api/login in Dbit N300 T1 Pro router enabling brute-force admin takeover.", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-307", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-KIRUBEL-CVE-CVE-2025-65427", "https://kitploit.com/ru/tools/github/kirubel-cve/cve-2025-65427/" ], "repository": "kitploit.com", "author": "ru", "first_seen": "2026-09-16T04:54:30", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/ru/tools/github/kirubel-cve/cve-2025-65427/" }, { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-12-16", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/kirubel-cve/CVE-2025-65427" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-KIRUBEL-CVE-CVE-2025-65427", "https://kitploit.com/ru/tools/github/kirubel-cve/cve-2025-65427/", "https://github.com/kirubel-cve/CVE-2025-65427" ], "timeline": [ { "at": "2025-12-16T16:15:59.900", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65427" } ] }, { "id": "CVE-2025-65342", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "code-projects Blood System 1.0 is vulnerable to Cross Site Scripting (XSS) in /don.php via the city field.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2026-07-30T21:16:51.777", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "code-projects Blood System 1.0 is vulnerable to Cross Site Scripting (XSS) in /don.php via the city field.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/um-dsp/TaintRadar/blob/main/XSS_cve/bloodsystem/XSS1.md" ], "timeline": [ { "at": "2026-07-30T21:16:51.777", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65342" } ] }, { "id": "CVE-2025-65341", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting (XSS) in admin/edit_product.php.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2026-07-30T21:16:51.667", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting (XSS) in admin/edit_product.php.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/um-dsp/TaintRadar/blob/main/XSS_cve/ecommercefruitsbazar/XSS.md" ], "timeline": [ { "at": "2026-07-30T21:16:51.667", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65341" } ] }, { "id": "CVE-2025-65340", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /betweendates-detailsreports.php.", "updated_at": "2026-10-13T09:10:00.323", "published_at": "2026-07-29T21:17:45.880", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-89", "what_happened": "kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /betweendates-detailsreports.php.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-betweendates-detailsreports.php-fromdate-sqli/20250811-hospital-management-system-betweendates-detailsreports.php-fromdate-sqli.md#injection-techniques-as-identified-by-sqlmap" ], "timeline": [ { "at": "2026-07-29T21:17:45.880", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65340" } ] }, { "id": "CVE-2025-65336", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price_by_pdtId.php.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2026-07-30T21:16:50.690", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-89", "what_happened": "Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price_by_pdtId.php.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/ecommercefruitsbazarmaster/20250811-ecommerce-project-with-php-and-mysqli-fruits-bazar-show_price_by_pdtid.php-pid-sqli/20250811-ecommerce-project-with-php-and-mysqli-fruits-bazar-show_price_by_pdtid.php-pid-sqli.md" ], "timeline": [ { "at": "2026-07-30T21:16:50.690", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65336" } ] }, { "id": "CVE-2025-64699", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "An incorrect NULL DACL issue exists in SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5.22). The regService process, which runs with SYSTEM privileges, applies a Security Descriptor to a device object with no explicitly configured DACL. This condition could allow an attacker to perform unauthorized raw disk operations, which could lead to system disruption (DoS) and exposure of sensitive data, and may facilitate local privilege escalation.", "updated_at": "2026-09-23T17:10:00.210", "published_at": "2025-12-31T16:15:48.110", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 100, "confidence_label": "verified", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 94, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-732", "what_happened": "An incorrect NULL DACL issue exists in SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5.22). The regService process, which runs with SYSTEM privileges, applies a Security Descriptor to a device object with no explicitly configured DACL. This condition could allow an attacker to perform unauthorized raw disk operations, which could lead to system disruption (DoS) and exposure of sensitive data, and may facilitate local privilege escalation.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "gist.github.com", "author": "NVD reference", "first_seen": "2025-12-31", "confidence": "High", "verification": "verified", "verified": true, "url": "https://gist.github.com/GunP4ng/42b19ee99e94c315173b74a9fb26c2b9" } ], "references": [ "https://gist.github.com/GunP4ng/42b19ee99e94c315173b74a9fb26c2b9" ], "timeline": [ { "at": "2025-12-31T16:15:48.110", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64699" } ] }, { "id": "CVE-2025-64637", "vendor": "Opal_WP", "product": "Auros Core", "title": "Auros Core vulnerability", "summary": "Unauthenticated Content Injection in Auros Core <= 5.3.1 versions.", "updated_at": "2026-09-29T19:10:00.160", "published_at": "2026-06-26T15:16:35.113", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "n/a through 5.3.1 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-80", "what_happened": "Unauthenticated Content Injection in Auros Core <= 5.3.1 versions.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/auros-core/vulnerability/wordpress-auros-core-plugin-5-3-1-content-injection-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-06-26T15:16:35.113", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64637" } ] }, { "id": "CVE-2025-64636", "vendor": "rhewlif", "product": "Donation Thermometer", "title": "Donation Thermometer vulnerability", "summary": "Unauthenticated Broken Access Control in Donation Thermometer <= 2.2.7 versions.", "updated_at": "2026-09-29T19:10:00.160", "published_at": "2026-06-26T15:16:34.983", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "n/a through 2.2.7 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Unauthenticated Broken Access Control in Donation Thermometer <= 2.2.7 versions.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/donation-thermometer/vulnerability/wordpress-donation-thermometer-plugin-2-2-7-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-06-26T15:16:34.983", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64636" } ] }, { "id": "CVE-2025-64393", "vendor": "Veeam", "product": "Backup and Replication", "title": "Backup and Replication vulnerability", "summary": "This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.", "updated_at": "2026-10-08T04:16:55.397", "published_at": "2026-10-07T09:17:04.273", "cvss": 9.4, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "12 through before 12.3.2.4934 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-502", "what_happened": "This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.veeam.com/KB4934" ], "timeline": [ { "at": "2026-10-07T09:17:04.273", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64393" } ] }, { "id": "CVE-2025-64289", "vendor": "Premmerce", "product": "Premmerce Product Search for WooCommerce", "title": "Premmerce Product Search for WooCommerce vulnerability", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premmerce Premmerce Product Search for WooCommerce premmerce-search allows Stored XSS.This issue affects Premmerce Product Search for WooCommerce: from n/a through 2.2.7.", "updated_at": "2026-09-25T10:17:06.167", "published_at": "2025-10-29T09:15:46.760", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.2.7 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premmerce Premmerce Product Search for WooCommerce premmerce-search allows Stored XSS.This issue affects Premmerce Product Search for WooCommerce: from n/a through 2.2.7.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/premmerce-search/vulnerability/wordpress-premmerce-product-search-for-woocommerce-plugin-2-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-10-29T09:15:46.760", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64289" } ] }, { "id": "CVE-2025-64168", "vendor": "agno-agi", "product": "agno", "title": "agno vulnerability", "summary": "Agno is a multi-agent framework, runtime and control plane. From 2.0.0 to before 2.2.2, under high concurrency, when session_state is passed to Agent or Team during run or arun calls, a race condition can occur, causing a session_state to be assigned and persisted to the incorrect session. This may result in user data from one session being exposed to another user. This has been patched in version 2.2.2.", "updated_at": "2026-10-19T13:10:00.110", "published_at": "2025-10-31T15:15:43.377", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": ">= 2.0.0, < 2.2.2", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "High", "cwe": "CWE-362", "what_happened": "Agno is a multi-agent framework, runtime and control plane. From 2.0.0 to before 2.2.2, under high concurrency, when session_state is passed to Agent or Team during run or arun calls, a race condition can occur, causing a session_state to be assigned and persisted to the incorrect session. This may result in user data from one session being exposed to another user. This has been patched in version 2.2.2.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/agno-agi/agno/security/advisories/GHSA-vw84-hprm-cxmm" ], "timeline": [ { "at": "2025-10-31T15:15:43.377", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64168" } ] }, { "id": "CVE-2025-64152", "vendor": "Apache Software Foundation", "product": "Apache IoTDB", "title": "Apache IoTDB vulnerability", "summary": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB.\n\nThis issue affects Apache IoTDB: from 1.0.0 before 1.3.6, from 2.0.0 before 2.0.7.\n\nUsers are recommended to upgrade to version 1.3.6 and 2.0.7, which fixes the issue.", "updated_at": "2026-09-29T19:10:00.160", "published_at": "2026-06-26T13:16:33.423", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "1.0.0 through before 1.3.6 (semver); 2.0.0 through before 2.0.7 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-22", "what_happened": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB.\n\nThis issue affects Apache IoTDB: from 1.0.0 before 1.3.6, from 2.0.0 before 2.0.7.\n\nUsers are recommended to upgrade to version 1.3.6 and 2.0.7, which fixes the issue.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://lists.apache.org/thread/sjms84rlt4g78fwmjcowxmtjp1q8b9q4", "http://www.openwall.com/lists/oss-security/2026/03/09/3" ], "timeline": [ { "at": "2026-06-26T13:16:33.423", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64152" } ] }, { "id": "CVE-2025-64103", "vendor": "zitadel", "product": "zitadel", "title": "zitadel vulnerability", "summary": "Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMFAForLocalUsers. If a user has set up MFA without this requirement, Zitadel would consider single factor auhtenticated sessions as valid as well and not require multiple factors. Bypassing second authentication factors weakens multifactor authentication and enables attackers to bypass the more secure factor. An attacker can target the TOTP code alone, only six digits, bypassing password verification entirely and potentially compromising accounts with 2FA enabled. This vulnerability is fixed in 4.6.0, 3.4.3, and 2.71.18.", "updated_at": "2026-10-19T13:10:00.110", "published_at": "2025-10-29T19:15:39.067", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": ">= 4.0.0-rc.1, < 4.6.0; >= 3.0.0-rc.1, < 3.4.3; >= 2.55.0, < 2.71.18; >= 2.54.3, <= 2.54.10; >= 2.53.6, <= 2.53.9", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-287", "what_happened": "Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMFAForLocalUsers. If a user has set up MFA without this requirement, Zitadel would consider single factor auhtenticated sessions as valid as well and not require multiple factors. Bypassing second authentication factors weakens multifactor authentication and enables attackers to bypass the more secure factor. An attacker can target the TOTP code alone, only six digits, bypassing password verification entirely and potentially compromising accounts with 2FA enabled. This vulnerability is fixed in 4.6.0, 3.4.3, and 2.71.18.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/zitadel/zitadel/commit/b284f8474eed0cba531905101619e7ae7963156b", "https://github.com/zitadel/zitadel/security/advisories/GHSA-cfjq-28r2-4jv5" ], "timeline": [ { "at": "2025-10-29T19:15:39.067", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64103" } ] }, { "id": "CVE-2025-64102", "vendor": "zitadel", "product": "zitadel", "title": "zitadel vulnerability", "summary": "Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, an attacker can perform an online brute-force attack on OTP, TOTP, and passwords. While Zitadel allows preventing online brute force attacks in scenarios like TOTP, Email OTP, or passwords using a lockout mechanism. The mechanism is not enabled by default and can cause a denial of service for the corresponding user if enabled. Additionally, the mitigation strategies were not fully implemented in the more recent resource-based APIs. This vulnerability is fixed in 4.6.0, 3.4.3, and 2.71.18.", "updated_at": "2026-10-19T13:10:00.110", "published_at": "2025-10-29T19:15:38.927", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": ">= 4.0.0-rc.1, < 4.6.0; >= 3.0.0-rc.1, < 3.4.3; >= 2.0.0, < 2.71.18", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-307", "what_happened": "Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, an attacker can perform an online brute-force attack on OTP, TOTP, and passwords. While Zitadel allows preventing online brute force attacks in scenarios like TOTP, Email OTP, or passwords using a lockout mechanism. The mechanism is not enabled by default and can cause a denial of service for the corresponding user if enabled. Additionally, the mitigation strategies were not fully implemented in the more recent resource-based APIs. This vulnerability is fixed in 4.6.0, 3.4.3, and 2.71.18.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/zitadel/zitadel/commit/b8db8cdf9cc8ea13f461758aef12457f8b7d972a", "https://github.com/zitadel/zitadel/security/advisories/GHSA-xrw9-r35x-x878" ], "timeline": [ { "at": "2025-10-29T19:15:38.927", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64102" } ] }, { "id": "CVE-2025-64101", "vendor": "zitadel", "product": "zitadel", "title": "zitadel vulnerability", "summary": "Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, a potential vulnerability exists in ZITADEL's password reset mechanism. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to construct the URL for the password reset confirmation link. This link, containing a secret code, is then emailed to the user. If an attacker can manipulate these headers (e.g., via host header injection), they could cause ZITADEL to generate a password reset link pointing to a malicious domain controlled by the attacker. If the user clicks this manipulated link in the email, the secret reset code embedded in the URL can be captured by the attacker. This captured code could then be used to reset the user's password and gain unauthorized access to their account. It's important to note that this specific attack vector is mitigated for accounts that have Multi-Factor Authentication (MFA) or Passwordless authentication enabled. This vulnerability is fixed in 4.6.0, 3.4.3, and 2.71.18.", "updated_at": "2026-10-19T13:10:00.110", "published_at": "2025-10-29T19:15:38.763", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": ">= 4.0.0-rc.1, < 4.6.0; >= 3.0.0-rc.1, < 3.4.3; >= 2.0.0, < 2.71.18", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-601", "what_happened": "Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, a potential vulnerability exists in ZITADEL's password reset mechanism. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to construct the URL for the password reset confirmation link. This link, containing a secret code, is then emailed to the user. If an attacker can manipulate these headers (e.g., via host header injection), they could cause ZITADEL to generate a password reset link pointing to a malicious domain controlled by the attacker. If the user clicks this manipulated link in the email, the secret reset code embedded in the URL can be captured by the attacker. This captured code could then be used to reset the user's password and gain unauthorized access to their account. It's important to note that this specific attack vector is mitigated for accounts that have Multi-Factor Authentication (MFA) or Passwordless authentication enabled. This vulnerability is fixed in 4.6.0, 3.4.3, and 2.71.18.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/zitadel/zitadel/commit/72a5c33e6ac302b978d564bd049f9364f5a989b1", "https://github.com/zitadel/zitadel/security/advisories/GHSA-mwmh-7px9-4c23" ], "timeline": [ { "at": "2025-10-29T19:15:38.763", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64101" } ] }, { "id": "CVE-2025-64100", "vendor": "ckan", "product": "ckan", "title": "ckan vulnerability", "summary": "CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login. This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4", "updated_at": "2026-10-19T13:10:00.110", "published_at": "2025-10-29T18:15:42.650", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "< 2.10.9; >= 2.11.0, < 2.11.4", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-384", "what_happened": "CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login. This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/ckan/ckan/commit/c2fe437f88be850a6edf7a32470772428819fab5", "https://github.com/ckan/ckan/security/advisories/GHSA-2hvh-cw5c-8q8q" ], "timeline": [ { "at": "2025-10-29T18:15:42.650", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64100" } ] }, { "id": "CVE-2025-64012", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "InvoicePlane commit debb446c is vulnerable to Incorrect Access Control. The invoices/view handler fails to verify ownership before returning invoice data.", "updated_at": "2026-10-13T19:10:00.193", "published_at": "2025-12-16T16:15:59.177", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "confidence": 100, "confidence_label": "verified", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 23, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-639", "what_happened": "InvoicePlane commit debb446c is vulnerable to Incorrect Access Control. The invoices/view handler fails to verify ownership before returning invoice data.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "gist.github.com", "author": "NVD reference", "first_seen": "2025-12-16", "confidence": "High", "verification": "verified", "verified": true, "url": "https://gist.github.com/tarekramm/797073e9ae991211ff2ae71ed1190c7d" } ], "references": [ "https://gist.github.com/tarekramm/797073e9ae991211ff2ae71ed1190c7d", "https://github.com/InvoicePlane/InvoicePlane/commit/debb446ceaa84efc136987fc1e21b268f34e47b0" ], "timeline": [ { "at": "2025-12-16T16:15:59.177", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64012" } ] }, { "id": "CVE-2025-63823", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication module, which allows remote attackers to bypass authentication and gain unauthorized access to user accounts via predictable OTP values.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2026-08-05T22:17:07.053", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-798", "what_happened": "My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication module, which allows remote attackers to bypass authentication and gain unauthorized access to user accounts via predictable OTP values.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/Leoccc98/cve-reports/blob/main/advisories/CVE-2025-63823/README.md", "https://play.google.com/store/apps/details?id=com.safetipin.mysafetipin" ], "timeline": [ { "at": "2026-08-05T22:17:07.053", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-63823" } ] }, { "id": "CVE-2025-63822", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. An authenticated attacker can manipulate user identifier parameters to bypass authorization controls and gain unauthorized READ and WRITE access to other users' personal information. The API fails to validate that the requesting user is authorized to access the target user's data.", "updated_at": "2026-10-01T08:10:00.183", "published_at": "2026-08-05T22:17:06.927", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-284", "what_happened": "SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. An authenticated attacker can manipulate user identifier parameters to bypass authorization controls and gain unauthorized READ and WRITE access to other users' personal information. The API fails to validate that the requesting user is authorized to access the target user's data.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/Leoccc98/cve-reports/blob/main/advisories/CVE-2025-63822/README.md", "https://play.google.com/store/apps/details?id=com.sirengps.mobile" ], "timeline": [ { "at": "2026-08-05T22:17:06.927", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-63822" } ] }, { "id": "CVE-2025-63564", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests", "updated_at": "2026-09-23T20:17:10.447", "published_at": "2026-09-23T17:17:14.323", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-89", "what_happened": "SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "http://moodle.com", "https://medium.com/@lcrawfqrd/sqli-in-moodle-plugin-9f0ce4eb05f2" ], "timeline": [ { "at": "2026-09-23T17:17:14.323", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-63564" } ] }, { "id": "CVE-2025-63079", "vendor": "bdthemes", "product": "Live Copy Paste for Elementor", "title": "Live Copy Paste for Elementor vulnerability", "summary": "Contributor Broken Access Control in Live Copy Paste for Elementor <= 1.5.3 versions.", "updated_at": "2026-09-29T19:10:00.160", "published_at": "2026-06-26T15:16:34.857", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "n/a through 1.5.3 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Contributor Broken Access Control in Live Copy Paste for Elementor <= 1.5.3 versions.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/live-copy-paste/vulnerability/wordpress-live-copy-paste-for-elementor-plugin-1-5-3-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-06-26T15:16:34.857", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-63079" } ] }, { "id": "CVE-2025-63078", "vendor": "jetmonsters", "product": "Restaurant Menu by MotoPress", "title": "Restaurant Menu by MotoPress vulnerability", "summary": "Subscriber Broken Access Control in Restaurant Menu by MotoPress <= 2.4.11 versions.", "updated_at": "2026-09-29T19:10:00.160", "published_at": "2026-06-26T15:16:34.720", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "n/a through 2.4.11 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Subscriber Broken Access Control in Restaurant Menu by MotoPress <= 2.4.11 versions.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/mp-restaurant-menu/vulnerability/wordpress-restaurant-menu-by-motopress-plugin-2-4-11-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-06-26T15:16:34.720", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-63078" } ] }, { "id": "CVE-2025-63041", "vendor": "Code Amp", "product": "Forget About Shortcode Buttons", "title": "Forget About Shortcode Buttons vulnerability", "summary": "Contributor Broken Access Control in Forget About Shortcode Buttons <= 2.1.3 versions.", "updated_at": "2026-09-29T19:10:00.160", "published_at": "2026-06-26T15:16:33.650", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "n/a through 2.1.3 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Contributor Broken Access Control in Forget About Shortcode Buttons <= 2.1.3 versions.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/forget-about-shortcode-buttons/vulnerability/wordpress-forget-about-shortcode-buttons-plugin-2-1-3-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-06-26T15:16:33.650", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-63041" } ] }, { "id": "CVE-2025-63038", "vendor": "Northern Beaches Websites", "product": "WP Custom Admin Interface", "title": "WP Custom Admin Interface vulnerability", "summary": "Missing Authorization vulnerability in Northern Beaches Websites WP Custom Admin Interface wp-custom-admin-interface allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Custom Admin Interface: from n/a through <= 7.40.", "updated_at": "2026-09-23T14:10:00.190", "published_at": "2025-12-31T17:15:48.583", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 7.40 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in Northern Beaches Websites WP Custom Admin Interface wp-custom-admin-interface allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Custom Admin Interface: from n/a through <= 7.40.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/wp-custom-admin-interface/vulnerability/wordpress-wp-custom-admin-interface-plugin-7-40-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T17:15:48.583", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-63038" } ] }, { "id": "CVE-2025-63021", "vendor": "codetipi", "product": "Valenti Engine", "title": "Valenti Engine vulnerability", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codetipi Valenti Engine valenti-engine allows DOM-Based XSS.This issue affects Valenti Engine: from n/a through <= 1.0.3.", "updated_at": "2026-09-23T14:10:00.190", "published_at": "2025-12-31T17:15:48.330", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.0.3 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codetipi Valenti Engine valenti-engine allows DOM-Based XSS.This issue affects Valenti Engine: from n/a through <= 1.0.3.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/valenti-engine/vulnerability/wordpress-valenti-engine-plugin-1-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T17:15:48.330", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-63021" } ] }, { "id": "CVE-2025-62989", "vendor": "Gora Tech", "product": "Cooked", "title": "Cooked vulnerability", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gora Tech Cooked cooked allows Stored XSS.This issue affects Cooked: from n/a through <= 1.11.3.", "updated_at": "2026-09-23T14:10:00.190", "published_at": "2025-12-31T18:15:45.940", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.11.3 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gora Tech Cooked cooked allows Stored XSS.This issue affects Cooked: from n/a through <= 1.11.3.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/cooked/vulnerability/wordpress-cooked-plugin-1-11-2-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T18:15:45.940", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62989" } ] }, { "id": "CVE-2025-62973", "vendor": "Themekraft", "product": "BuddyForms", "title": "BuddyForms vulnerability", "summary": "Missing Authorization vulnerability in Themekraft BuddyForms buddyforms allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BuddyForms: from n/a through 2.10.2.", "updated_at": "2026-10-07T08:16:56.710", "published_at": "2025-10-27T02:15:57.890", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.10.2 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in Themekraft BuddyForms buddyforms allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BuddyForms: from n/a through 2.10.2.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/buddyforms/vulnerability/wordpress-buddyforms-plugin-2-9-0-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-10-27T02:15:57.890", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62973" } ] }, { "id": "CVE-2025-62874", "vendor": "Alexander", "product": "AnyComment", "title": "AnyComment vulnerability", "summary": "Missing Authorization vulnerability in Alexander AnyComment anycomment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyComment: from n/a through <= 0.3.6.", "updated_at": "2026-09-23T14:10:00.190", "published_at": "2025-12-31T17:15:47.617", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 0.3.6 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in Alexander AnyComment anycomment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyComment: from n/a through <= 0.3.6.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/anycomment/vulnerability/wordpress-anycomment-plugin-0-3-6-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T17:15:47.617", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62874" } ] }, { "id": "CVE-2025-62826", "vendor": "Fortinet", "product": "FortiPAM", "title": "FortiPAM vulnerability", "summary": "An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an attacker able to intercept and modify a user's captive portal authentication request to inject arbitrary headers via crafted HTTP requests.", "updated_at": "2026-09-29T15:10:00.193", "published_at": "2026-07-14T16:16:42.850", "cvss": 3.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "1.7.0; 1.6.0 through 1.6.2 (semver); 1.5.0 through 1.5.1 (semver); 1.4.0 through 1.4.3 (semver); 1.3.0 through 1.3.1 (semver); 1.2.0; 1.1.0 through 1.1.2 (semver); 1.0.0 through 1.0.3 (semver); 7.6.0 through 7.6.4 (semver); 7.4.0 through 7.4.14 (semver); 7.2.0 through 7.2.16 (semver); 7.0.0 through 7.0.23 (semver); 7.6.0 through 7.6.2 (semver); 7.4.0 through 7.4.8 (semver); 7.2.0 through 7.2.13 (semver); 7.0.0 through 7.0.19 (semver); 6.4.0 through 6.4.16 (semver); before * (custom)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-113", "what_happened": "An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an attacker able to intercept and modify a user's captive portal authentication request to inject arbitrary headers via crafted HTTP requests.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://fortiguard.fortinet.com/psirt/FG-IR-26-153", "https://cert-portal.siemens.com/productcert/html/ssa-864900.html" ], "timeline": [ { "at": "2026-07-14T16:16:42.850", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62826" } ] }, { "id": "CVE-2025-62821", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntry_GetDataSize can return success while leaving the reported data size as 0. This causes a caller to make a 1-byte allocation. Later, CopyPixels computes copy_size = stride * abs(roi_height) but does not check the source buffer length before a memmove call.", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-06-19T14:16:21.570", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "confidence": 100, "confidence_label": "verified", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 25, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-125", "what_happened": "Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntry_GetDataSize can return success while leaving the reported data size as 0. This causes a caller to make a 1-byte allocation. Later, CopyPixels computes copy_size = stride * abs(roi_height) but does not check the source buffer length before a memmove call.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2026-06-19", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/hyunjungg/CVE-2025-62821" } ], "references": [ "https://github.com/hyunjungg/CVE-2025-62821" ], "timeline": [ { "at": "2026-06-19T14:16:21.570", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62821" } ] }, { "id": "CVE-2025-62817", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, and 2500. A NULL pointer dereference of session->ncp_hdr_buf in __pilot_parsing_ncp() causes a denial of service.", "updated_at": "2026-09-21T19:17:03.440", "published_at": "2026-03-03T17:16:17.213", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "confidence": 35, "confidence_label": "observed", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-476", "what_happened": "An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, and 2500. A NULL pointer dereference of session->ncp_hdr_buf in __pilot_parsing_ncp() causes a denial of service.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://semiconductor.samsung.com/support/quality-support/product-security-updates/", "https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-62817/" ], "timeline": [ { "at": "2026-03-03T17:16:17.213", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62817" } ] }, { "id": "CVE-2025-62796", "vendor": "PrivateBin", "product": "PrivateBin", "title": "PrivateBin vulnerability", "summary": "PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Versions 1.7.7 through 2.0.1 allow persistent HTML injection via the unsanitized attachment filename (attachment_name) when attachments are enabled. An attacker can modify attachment_name before encryption so that, after decryption, arbitrary HTML is inserted unescaped into the page near the file size hint, enabling redirect (e.g., meta refresh) and site defacement and related phishing attacks. Script execution is normally blocked by the recommended Content Security Policy, limiting confidentiality impact. The issue was introduced in 1.7.7 and fixed in 2.0.2. Update to 2.0.2 or later. Workarounds include enforcing the recommended CSP, deploying PrivateBin on a separate domain, or disabling attachments.", "updated_at": "2026-10-19T13:10:00.110", "published_at": "2025-10-28T21:15:40.760", "cvss": 5.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": ">= 1.7.7, < 2.0.2", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Versions 1.7.7 through 2.0.1 allow persistent HTML injection via the unsanitized attachment filename (attachment_name) when attachments are enabled. An attacker can modify attachment_name before encryption so that, after decryption, arbitrary HTML is inserted unescaped into the page near the file size hint, enabling redirect (e.g., meta refresh) and site defacement and related phishing attacks. Script execution is normally blocked by the recommended Content Security Policy, limiting confidentiality impact. The issue was introduced in 1.7.7 and fixed in 2.0.2. Update to 2.0.2 or later. Workarounds include enforcing the recommended CSP, deploying PrivateBin on a separate domain, or disabling attachments.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/PrivateBin/PrivateBin/commit/c4f8482b3072be7ae012cace1b3f5658dcc3b42e", "https://github.com/PrivateBin/PrivateBin/pull/1550", "https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-867c-p784-5q6g" ], "timeline": [ { "at": "2025-10-28T21:15:40.760", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62796" } ] }, { "id": "CVE-2025-62795", "vendor": "jumpserver", "product": "jumpserver", "title": "jumpserver vulnerability", "summary": "JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.21-lts and v4.10.12-lts, a low-privileged authenticated user can invoke LDAP configuration tests and start LDAP synchronization by sending crafted messages to the /ws/ldap/ WebSocket endpoint, bypassing authorization checks and potentially exposing LDAP credentials or causing unintended sync operations. This vulnerability is fixed in v3.10.21-lts and v4.10.12-lts.", "updated_at": "2026-10-19T13:10:00.110", "published_at": "2025-10-30T17:15:39.723", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "confidence": 100, "confidence_label": "verified", "affected": "< 3.10.21-lts; >= 4.0.0, < 4.10.12-lts", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-863", "what_happened": "JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.21-lts and v4.10.12-lts, a low-privileged authenticated user can invoke LDAP configuration tests and start LDAP synchronization by sending crafted messages to the /ws/ldap/ WebSocket endpoint, bypassing authorization checks and potentially exposing LDAP credentials or causing unintended sync operations. This vulnerability is fixed in v3.10.21-lts and v4.10.12-lts.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-10-30", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/jumpserver/jumpserver/security/advisories/GHSA-7893-256g-m822" } ], "references": [ "https://github.com/jumpserver/jumpserver/security/advisories/GHSA-7893-256g-m822" ], "timeline": [ { "at": "2025-10-30T17:15:39.723", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62795" } ] }, { "id": "CVE-2025-62793", "vendor": "elabftw", "product": "elabftw", "title": "elabftw vulnerability", "summary": "eLabFTW is an open source electronic lab notebook for research labs. The application served uploaded SVG files inline. Because SVG supports active content, an attacker could upload a crafted SVG that executes script when viewed, resulting in stored XSS under the application origin. A victim who opens the SVG URL or any page embedding it could have their session hijacked, data exfiltrated, or actions performed on their behalf. This vulnerability is fixed n 5.3.0.", "updated_at": "2026-10-19T13:10:00.110", "published_at": "2025-10-27T22:15:42.307", "cvss": 6.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "< 5.3.0", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "eLabFTW is an open source electronic lab notebook for research labs. The application served uploaded SVG files inline. Because SVG supports active content, an attacker could upload a crafted SVG that executes script when viewed, resulting in stored XSS under the application origin. A victim who opens the SVG URL or any page embedding it could have their session hijacked, data exfiltrated, or actions performed on their behalf. This vulnerability is fixed n 5.3.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/elabftw/elabftw/commit/09b95e38f82f041edac0dd6962c70499e2d8d8e2", "https://github.com/elabftw/elabftw/security/advisories/GHSA-rq98-8jh9-684f" ], "timeline": [ { "at": "2025-10-27T22:15:42.307", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62793" } ] }, { "id": "CVE-2025-62792", "vendor": "wazuh", "product": "wazuh", "title": "wazuh vulnerability", "summary": "Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.12.0, a buffer over-read occurs in w_expression_match() when strlen() is called on str_test, because the corresponding buffer is not being properly NULL terminated during its allocation in OS_CleanMSG(). A compromised agent can cause a READ operation beyond the end of the allocated buffer (which may contain sensitive information) by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can cause a buffer over-read and potentially access sensitive data. This vulnerability is fixed in 4.12.0.", "updated_at": "2026-10-19T13:10:00.110", "published_at": "2025-10-29T17:15:37.280", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "< 4.12.0", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-126", "what_happened": "Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.12.0, a buffer over-read occurs in w_expression_match() when strlen() is called on str_test, because the corresponding buffer is not being properly NULL terminated during its allocation in OS_CleanMSG(). A compromised agent can cause a READ operation beyond the end of the allocated buffer (which may contain sensitive information) by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can cause a buffer over-read and potentially access sensitive data. This vulnerability is fixed in 4.12.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-10-29", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-2672-vfhm-xhr6" } ], "references": [ "https://github.com/wazuh/wazuh/security/advisories/GHSA-2672-vfhm-xhr6" ], "timeline": [ { "at": "2025-10-29T17:15:37.280", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62792" } ] }, { "id": "CVE-2025-62791", "vendor": "wazuh", "product": "wazuh", "title": "wazuh vulnerability", "summary": "Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.11.0, DecodeCiscat() implementation does not check the return the value of cJSON_GetObjectItem() for a possible NULL value in case of an error. A compromised agent can cause a crash of analysisd by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can cause analysisd to crash and make it unavailable. This vulnerability is fixed in 4.11.0.", "updated_at": "2026-10-19T13:10:00.110", "published_at": "2025-10-29T17:15:37.133", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "< 4.11.0", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-252", "what_happened": "Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.11.0, DecodeCiscat() implementation does not check the return the value of cJSON_GetObjectItem() for a possible NULL value in case of an error. A compromised agent can cause a crash of analysisd by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can cause analysisd to crash and make it unavailable. This vulnerability is fixed in 4.11.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/wazuh/wazuh/security/advisories/GHSA-gcwf-6p6m-gvm7" ], "timeline": [ { "at": "2025-10-29T17:15:37.133", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62791" } ] }, { "id": "CVE-2025-62790", "vendor": "wazuh", "product": "wazuh", "title": "wazuh vulnerability", "summary": "Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.11.0, fim_fetch_attributes_state() implementation does not check whether time_string is NULL or not before calling strlen() on it. A compromised agent can cause a crash of analysisd by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can cause analysisd to crash and make it unavailable. This vulnerability is fixed in 4.11.0.", "updated_at": "2026-10-19T13:10:00.110", "published_at": "2025-10-29T17:15:36.983", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "< 4.11.0", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-252", "what_happened": "Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.11.0, fim_fetch_attributes_state() implementation does not check whether time_string is NULL or not before calling strlen() on it. A compromised agent can cause a crash of analysisd by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can cause analysisd to crash and make it unavailable. This vulnerability is fixed in 4.11.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-10-29", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-9xj3-vc52-48p9" } ], "references": [ "https://github.com/wazuh/wazuh/security/advisories/GHSA-9xj3-vc52-48p9" ], "timeline": [ { "at": "2025-10-29T17:15:36.983", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62790" } ] }, { "id": "CVE-2025-62789", "vendor": "wazuh", "product": "wazuh", "title": "wazuh vulnerability", "summary": "Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.11.0, fim_alert() implementation does not check whether the return value of ctime_r is NULL or not before calling strdup() on it. A compromised agent can cause a crash of analysisd by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can cause analysisd to crash and make it unavailable. This vulnerability is fixed in 4.11.0.", "updated_at": "2026-10-19T13:10:00.110", "published_at": "2025-10-29T17:15:36.823", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "< 4.11.0", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-252", "what_happened": "Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.11.0, fim_alert() implementation does not check whether the return value of ctime_r is NULL or not before calling strdup() on it. A compromised agent can cause a crash of analysisd by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can cause analysisd to crash and make it unavailable. This vulnerability is fixed in 4.11.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-10-29", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-8rvq-mm2f-8q22" } ], "references": [ "https://github.com/wazuh/wazuh/security/advisories/GHSA-8rvq-mm2f-8q22" ], "timeline": [ { "at": "2025-10-29T17:15:36.823", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62789" } ] }, { "id": "CVE-2025-62788", "vendor": "wazuh", "product": "wazuh", "title": "wazuh vulnerability", "summary": "Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.11.0, w_copy_event_for_log() references memory (initially allocated in OS_CleanMSG()) after it has been freed. A compromised agent can potentially compromise the integrity of the application by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can leverage this issue to potentially compromise the integrity of the application (the use of previously freed memory may corrupt valid data, if the memory area in question has been allocated and used properly elsewhere). This vulnerability is fixed in 4.11.0.", "updated_at": "2026-10-19T13:10:00.110", "published_at": "2025-10-29T17:15:36.677", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "< 4.11.0", "fixed": "See vendor advisory", "source_count": 6, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-416", "what_happened": "Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.11.0, w_copy_event_for_log() references memory (initially allocated in OS_CleanMSG()) after it has been freed. A compromised agent can potentially compromise the integrity of the application by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can leverage this issue to potentially compromise the integrity of the application (the use of previously freed memory may corrupt valid data, if the memory area in question has been allocated and used properly elsewhere). This vulnerability is fixed in 4.11.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-10-29", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-qjcw-fjvh-8q4g" } ], "references": [ "https://github.com/wazuh/wazuh/security/advisories/GHSA-qjcw-fjvh-8q4g" ], "timeline": [ { "at": "2025-10-29T17:15:36.677", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62788" } ] }, { "id": "CVE-2025-62787", "vendor": "wazuh", "product": "wazuh", "title": "wazuh vulnerability", "summary": "Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.10.2, a buffer over-read occurs in DecodeWinevt() when child_attr[p]->attributes[j] is accessed, because the corresponding index (j) is incorrect. A compromised agent can cause a READ operation beyond the end of the allocated buffer (which may contain sensitive information) by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can cause a buffer over-read and potentially access sensitive data. While the buffer over-read is always triggered while resolving the arguments of mdebug2, specific configuration options (analysisd.debug=2) need to be in place for the respective data to be leaked. This vulnerability is fixed in 4.10.2.", "updated_at": "2026-10-19T13:10:00.110", "published_at": "2025-10-29T17:15:36.517", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "< 4.10.2", "fixed": "See vendor advisory", "source_count": 8, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-126", "what_happened": "Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.10.2, a buffer over-read occurs in DecodeWinevt() when child_attr[p]->attributes[j] is accessed, because the corresponding index (j) is incorrect. A compromised agent can cause a READ operation beyond the end of the allocated buffer (which may contain sensitive information) by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can cause a buffer over-read and potentially access sensitive data. While the buffer over-read is always triggered while resolving the arguments of mdebug2, specific configuration options (analysisd.debug=2) need to be in place for the respective data to be leaked. This vulnerability is fixed in 4.10.2.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-10-29", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-3hhq-5367-98q6" } ], "references": [ "https://github.com/wazuh/wazuh/commit/267d5d55de490469a9ec24a2b936bb3c5aa8fdda", "https://github.com/wazuh/wazuh/security/advisories/GHSA-3hhq-5367-98q6" ], "timeline": [ { "at": "2025-10-29T17:15:36.517", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62787" } ] }, { "id": "CVE-2025-62786", "vendor": "wazuh", "product": "wazuh", "title": "wazuh vulnerability", "summary": "Wazuh is a free and open source platform used for threat prevention, detection, and response. A heap-based out-of-bounds WRITE occurs in decode_win_permissions, resulting in writing a NULL byte 2 bytes before the start of the buffer allocated to decoded_it. A compromised agent can potentially leverage this issue to perform remote code execution, by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can leverage this issue to potentially achieve remote code execution on the wazuh manager (the exploitability of this vulnerability depends on the specifics of the respective heap allocator). This vulnerability is fixed in 4.10.2.", "updated_at": "2026-10-19T13:10:00.110", "published_at": "2025-10-29T16:15:34.850", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "< 4.10.2", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-124", "what_happened": "Wazuh is a free and open source platform used for threat prevention, detection, and response. A heap-based out-of-bounds WRITE occurs in decode_win_permissions, resulting in writing a NULL byte 2 bytes before the start of the buffer allocated to decoded_it. A compromised agent can potentially leverage this issue to perform remote code execution, by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can leverage this issue to potentially achieve remote code execution on the wazuh manager (the exploitability of this vulnerability depends on the specifics of the respective heap allocator). This vulnerability is fixed in 4.10.2.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-10-29", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-2c8r-p6r5-xxmr" } ], "references": [ "https://github.com/wazuh/wazuh/commit/2257d7998aaff34263169d16f4afc491564a771c", "https://github.com/wazuh/wazuh/security/advisories/GHSA-2c8r-p6r5-xxmr" ], "timeline": [ { "at": "2025-10-29T16:15:34.850", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62786" } ] }, { "id": "CVE-2025-62785", "vendor": "wazuh", "product": "wazuh", "title": "wazuh vulnerability", "summary": "Wazuh is a free and open source platform used for threat prevention, detection, and response. fillData() implementation does not check whether value is NULL or not before calling os_strdup() on it. A compromised agent can cause a crash of analysisd by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can cause analysisd to crash and make it unavailable. This vulnerability is fixed in 4.10.2.", "updated_at": "2026-10-19T13:10:00.110", "published_at": "2025-10-29T16:15:34.690", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "< 4.10.2", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-252", "what_happened": "Wazuh is a free and open source platform used for threat prevention, detection, and response. fillData() implementation does not check whether value is NULL or not before calling os_strdup() on it. A compromised agent can cause a crash of analysisd by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can cause analysisd to crash and make it unavailable. This vulnerability is fixed in 4.10.2.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-10-29", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-mqpq-pcxc-8259" } ], "references": [ "https://github.com/wazuh/wazuh/commit/17f8dc23a6211cbb398a262fcd1b0fe61b0a8eb6", "https://github.com/wazuh/wazuh/security/advisories/GHSA-mqpq-pcxc-8259" ], "timeline": [ { "at": "2025-10-29T16:15:34.690", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62785" } ] }, { "id": "CVE-2025-62755", "vendor": "GS Plugins", "product": "GS Portfolio for Envato", "title": "GS Portfolio for Envato vulnerability", "summary": "Missing Authorization vulnerability in GS Plugins GS Portfolio for Envato gs-envato-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GS Portfolio for Envato: from n/a through <= 1.4.2.", "updated_at": "2026-10-08T08:10:00.227", "published_at": "2025-12-31T16:15:47.240", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.4.2 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in GS Plugins GS Portfolio for Envato gs-envato-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GS Portfolio for Envato: from n/a through <= 1.4.2.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/gs-envato-portfolio/vulnerability/wordpress-gs-portfolio-for-envato-plugin-1-4-2-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T16:15:47.240", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62755" } ] }, { "id": "CVE-2025-62751", "vendor": "extendthemes", "product": "Vireo", "title": "Vireo vulnerability", "summary": "Missing Authorization vulnerability in extendthemes Vireo vireo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Vireo: from n/a through <= 1.0.24.", "updated_at": "2026-09-23T17:10:00.210", "published_at": "2025-12-31T16:15:47.040", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.0.24 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in extendthemes Vireo vireo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Vireo: from n/a through <= 1.0.24.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Theme/vireo/vulnerability/wordpress-vireo-theme-1-0-24-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T16:15:47.040", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62751" } ] }, { "id": "CVE-2025-62747", "vendor": "Aum Watcharapon", "product": "Featured Image Generator", "title": "Featured Image Generator vulnerability", "summary": "Missing Authorization vulnerability in Aum Watcharapon Featured Image Generator featured-image-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Image Generator: from n/a through <= 1.3.4.", "updated_at": "2026-09-23T17:10:00.210", "published_at": "2025-12-31T16:15:46.800", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.3.4 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in Aum Watcharapon Featured Image Generator featured-image-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Image Generator: from n/a through <= 1.3.4.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/featured-image-generator/vulnerability/wordpress-featured-image-generator-plugin-1-3-3-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T16:15:46.800", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62747" } ] }, { "id": "CVE-2025-62726", "vendor": "n8n-io", "product": "n8n", "title": "n8n vulnerability", "summary": "n8n is an open source workflow automation platform. Prior to 1.113.0, a remote code execution vulnerability exists in the Git Node component available in both Cloud and Self-Hosted versions of n8n. When a malicious actor clones a remote repository containing a pre-commit hook, the subsequent use of the Commit operation in the Git Node can inadvertently trigger the hook’s execution. This allows attackers to execute arbitrary code within the n8n environment, potentially compromising the system and any connected credentials or workflows. This vulnerability is fixed in 1.113.0.", "updated_at": "2026-10-19T13:10:00.110", "published_at": "2025-10-30T17:15:39.563", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "< 1.113.0", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-829", "what_happened": "n8n is an open source workflow automation platform. Prior to 1.113.0, a remote code execution vulnerability exists in the Git Node component available in both Cloud and Self-Hosted versions of n8n. When a malicious actor clones a remote repository containing a pre-commit hook, the subsequent use of the Commit operation in the Git Node can inadvertently trigger the hook’s execution. This allows attackers to execute arbitrary code within the n8n environment, potentially compromising the system and any connected credentials or workflows. This vulnerability is fixed in 1.113.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/n8n-io/n8n/commit/5bf3db5ba84d3195bbe11bbd3c62f7086e090997", "https://github.com/n8n-io/n8n/pull/19559", "https://github.com/n8n-io/n8n/security/advisories/GHSA-xgp7-7qjq-vg47" ], "timeline": [ { "at": "2025-10-30T17:15:39.563", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62726" } ] }, { "id": "CVE-2025-62712", "vendor": "jumpserver", "product": "jumpserver", "title": "jumpserver vulnerability", "summary": "JumpServer is an open source bastion host and an operation and maintenance security audit system. In JumpServer versions prior to v3.10.20-lts and v4.10.11-lts, an authenticated, non-privileged user can retrieve connection tokens belonging to other users via the super-connection API endpoint (/api/v1/authentication/super-connection-token/). When accessed from a web browser, this endpoint returns connection tokens created by all users instead of restricting results to tokens owned by or authorized for the requester. An attacker who obtains these tokens can use them to initiate connections to managed assets on behalf of the original token owners, resulting in unauthorized access and privilege escalation across sensitive systems. This vulnerability is fixed in v3.10.20-lts and v4.10.11-lts.", "updated_at": "2026-10-19T13:10:00.110", "published_at": "2025-10-30T16:15:36.620", "cvss": 9.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": ">= 4.0.0, < 4.10.11-lts; < 3.10.20-lts", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "JumpServer is an open source bastion host and an operation and maintenance security audit system. In JumpServer versions prior to v3.10.20-lts and v4.10.11-lts, an authenticated, non-privileged user can retrieve connection tokens belonging to other users via the super-connection API endpoint (/api/v1/authentication/super-connection-token/). When accessed from a web browser, this endpoint returns connection tokens created by all users instead of restricting results to tokens owned by or authorized for the requester. An attacker who obtains these tokens can use them to initiate connections to managed assets on behalf of the original token owners, resulting in unauthorized access and privilege escalation across sensitive systems. This vulnerability is fixed in v3.10.20-lts and v4.10.11-lts.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/jumpserver/jumpserver/commit/453ad331eec9d9667a38de735d6612608e558491", "https://github.com/jumpserver/jumpserver/security/advisories/GHSA-6ghx-6vpv-3wg7" ], "timeline": [ { "at": "2025-10-30T16:15:36.620", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62712" } ] }, { "id": "CVE-2025-62706", "vendor": "authlib", "product": "authlib", "title": "authlib vulnerability", "summary": "Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JWE zip=DEF path performs unbounded DEFLATE decompression. A very small ciphertext can expand into tens or hundreds of megabytes on decrypt, allowing an attacker who can supply decryptable tokens to exhaust memory and CPU and cause denial of service. This issue has been patched in version 1.6.5. Workarounds for this issue involve rejecting or stripping zip=DEF for inbound JWEs at the application boundary, forking and add a bounded decompression guard via decompressobj().decompress(data, MAX_SIZE)) and returning an error when output exceeds a safe limit, or enforcing strict maximum token sizes and fail fast on oversized inputs; combine with rate limiting.", "updated_at": "2026-10-19T13:10:00.110", "published_at": "2025-10-22T22:15:35.557", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "confidence": 100, "confidence_label": "verified", "affected": "< 1.6.5", "fixed": "See vendor advisory", "source_count": 8, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-400", "what_happened": "Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JWE zip=DEF path performs unbounded DEFLATE decompression. A very small ciphertext can expand into tens or hundreds of megabytes on decrypt, allowing an attacker who can supply decryptable tokens to exhaust memory and CPU and cause denial of service. This issue has been patched in version 1.6.5. Workarounds for this issue involve rejecting or stripping zip=DEF for inbound JWEs at the application boundary, forking and add a bounded decompression guard via decompressobj().decompress(data, MAX_SIZE)) and returning an error when output exceeds a safe limit, or enforcing strict maximum token sizes and fail fast on oversized inputs; combine with rate limiting.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-10-22", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/authlib/authlib/security/advisories/GHSA-g7f3-828f-7h7m" } ], "references": [ "https://github.com/authlib/authlib/commit/e0863d5129316b1790eee5f14cece32a03b8184d", "https://github.com/authlib/authlib/security/advisories/GHSA-g7f3-828f-7h7m", "https://lists.debian.org/debian-lts-announce/2025/10/msg00032.html" ], "timeline": [ { "at": "2025-10-22T22:15:35.557", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62706" } ] }, { "id": "CVE-2025-62705", "vendor": "openbao", "product": "openbao", "title": "openbao vulnerability", "summary": "OpenBao is an open source identity-based secrets management system. Prior to version 2.4.2, OpenBao's audit log did not appropriately redact fields when relevant subsystems sent []byte response parameters rather than strings. This includes, but is not limited to sys/raw with use of encoding=base64, all data would be emitted unredacted to the audit log, and Transit, when performing a signing operation with a derived Ed25519 key, would emit public keys to the audit log. This issue has been patched in OpenBao 2.4.2.", "updated_at": "2026-10-19T13:10:00.110", "published_at": "2025-10-22T22:15:35.420", "cvss": 5.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "< 2.4.2", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-532", "what_happened": "OpenBao is an open source identity-based secrets management system. Prior to version 2.4.2, OpenBao's audit log did not appropriately redact fields when relevant subsystems sent []byte response parameters rather than strings. This includes, but is not limited to sys/raw with use of encoding=base64, all data would be emitted unredacted to the audit log, and Transit, when performing a signing operation with a derived Ed25519 key, would emit public keys to the audit log. This issue has been patched in OpenBao 2.4.2.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/openbao/openbao/commit/cc2c476bac66e1d94776c2629793daec3af625f8", "https://github.com/openbao/openbao/security/advisories/GHSA-rc54-2g2c-g36g" ], "timeline": [ { "at": "2025-10-22T22:15:35.420", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62705" } ] }, { "id": "CVE-2025-62675", "vendor": "Fortinet", "product": "FortiOS", "title": "FortiOS vulnerability", "summary": "An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an attacker in possession of a valid web filter override token to inject arbitrary headers via tricking a user into clicking on a crafted link.", "updated_at": "2026-09-29T15:10:00.193", "published_at": "2026-07-14T16:16:42.617", "cvss": 3.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "7.6.0 through 7.6.4 (semver); 7.4.0 through 7.4.12 (semver); 7.2.0 through 7.2.13 (semver); 7.0.0 through 7.0.19 (semver); 6.4.0 through 6.4.16 (semver); 1.7.0; 1.6.0 through 1.6.2 (semver); 1.5.0 through 1.5.1 (semver); 1.4.0 through 1.4.3 (semver); 1.3.0 through 1.3.1 (semver); 1.2.0; 1.1.0 through 1.1.2 (semver); 1.0.0 through 1.0.3 (semver); 7.4.0 through 7.4.14 (semver); 7.2.0 through 7.2.16 (semver); 7.0.0 through 7.0.23 (semver); before * (custom)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-113", "what_happened": "An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an attacker in possession of a valid web filter override token to inject arbitrary headers via tricking a user into clicking on a crafted link.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://fortiguard.fortinet.com/psirt/FG-IR-26-152", "https://cert-portal.siemens.com/productcert/html/ssa-864900.html" ], "timeline": [ { "at": "2026-07-14T16:16:42.617", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62675" } ] }, { "id": "CVE-2025-62673", "vendor": "TP-Link Systems Inc.", "product": "Archer AX53 v1.0", "title": "Archer AX53 v1.0 vulnerability", "summary": "Heap-based Buffer Overflow vulnerability in Archer AX53 v1.0 and AX12 v1.0 (tdpserver modules) allows adjacent attackers to cause a segmentation fault or potentially execute arbitrary code via a specially crafted network packet containing a maliciously formed field.\n\nThis issue affects Archer AX53 v1.0: through 1.3.1 Build 20241120 and Archer AX12 v1.0: up to 1.5.1 Build 20260721.", "updated_at": "2026-09-22T23:17:05.257", "published_at": "2026-02-03T19:16:14.317", "cvss": 8.6, "cvss_vector": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.3.1 Build 20241120 (custom); before 1.5.1 Build 20260721 (custom)", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Adjacent", "authentication": "Low", "complexity": "Low", "cwe": "CWE-122", "what_happened": "Heap-based Buffer Overflow vulnerability in Archer AX53 v1.0 and AX12 v1.0 (tdpserver modules) allows adjacent attackers to cause a segmentation fault or potentially execute arbitrary code via a specially crafted network packet containing a maliciously formed field.\n\nThis issue affects Archer AX53 v1.0: through 1.3.1 Build 20241120 and Archer AX12 v1.0: up to 1.5.1 Build 20260721.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://talosintelligence.com/vulnerability_reports/", "https://www.tp-link.com/en/support/download/archer-ax12/#Firmware", "https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware", "https://www.tp-link.com/kr/support/download/archer-ax12/#Firmware", "https://www.tp-link.com/my/support/download/archer-ax53/v1/#Firmware", "https://www.tp-link.com/us/support/faq/4943/", "https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2290" ], "timeline": [ { "at": "2026-02-03T19:16:14.317", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62673" } ] }, { "id": "CVE-2025-62641", "vendor": "Unknown vendor", "product": "Unknown product", "title": "CVE-2025-62641 exploit", "summary": "Exploit for CVE-2025-62641. CVSS 8.2.", "updated_at": "2026-10-17T23:42:59Z", "published_at": "2026-10-17T23:42:59Z", "cvss": 8.2, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 21, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Vulnerability in the tools repository identified as CVE-2025-62641.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for CVE-2025-62641", "summary": "Vulnerability in the tools repository identified as CVE-2025-62641.", "what_happened": "Vulnerability in the tools repository identified as CVE-2025-62641.", "cvss": 8.2, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "Local", "authentication": "High", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-AL-LORD0X-CVE-2025-62641", "https://kitploit.com/en/tools/github/al-lord0x/cve-2025-62641" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-10-17T23:42:59", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-AL-LORD0X-CVE-2025-62641" }, { "title": "Exploit for CVE-2025-62641", "summary": "Vulnerability in the tools repository identified as CVE-2025-62641.", "what_happened": "Vulnerability in the tools repository identified as CVE-2025-62641.", "cvss": 8.2, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "Local", "authentication": "High", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-AL-LORD0X-CVE-2025-62641", "https://kitploit.com/en/tools/github/al-lord0x/cve-2025-62641" ], "repository": "kitploit.com", "author": "en", "first_seen": "2026-10-17T23:42:59", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/en/tools/github/al-lord0x/cve-2025-62641" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-AL-LORD0X-CVE-2025-62641", "https://kitploit.com/en/tools/github/al-lord0x/cve-2025-62641" ], "timeline": [ { "at": "2026-10-17T23:42:59Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-AL-LORD0X-CVE-2025-62641" } ] }, { "id": "CVE-2025-62618", "vendor": "ELOG", "product": "ELOG", "title": "ELOG vulnerability", "summary": "ELOG allows an authenticated user to upload arbitrary HTML files. The HTML content is executed in the context of other users when they open the file. Because ELOG includes usernames and password hashes in certain HTTP requests, an attacker can obtain the target's credentials and replay them or crack the password hash offline. In ELOG 3.1.5-20251014 release, HTML files are rendered as plain text.", "updated_at": "2026-10-19T13:10:00.110", "published_at": "2025-10-31T19:15:50.753", "cvss": 8.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 3.1.5-20251014 (custom)", "fixed": "See vendor advisory", "source_count": 5, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "ELOG allows an authenticated user to upload arbitrary HTML files. The HTML content is executed in the context of other users when they open the file. Because ELOG includes usernames and password hashes in certain HTTP requests, an attacker can obtain the target's credentials and replay them or crack the password hash offline. In ELOG 3.1.5-20251014 release, HTML files are rendered as plain text.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://bitbucket.org/ritt/elog/commits/7092ff64f6eb9521f8cc8c52272a020bf3730946", "https://bitbucket.org/ritt/elog/commits/f81e5695c40997322fe2713bfdeba459d9de09dc", "https://elog.psi.ch/elog/download/RPMS/?C=M;O=D", "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-304-01.json", "https://www.cve.org/CVERecord?id=CVE-2025-62618" ], "timeline": [ { "at": "2025-10-31T19:15:50.753", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62618" } ] }, { "id": "CVE-2025-62594", "vendor": "ImageMagick", "product": "ImageMagick", "title": "ImageMagick vulnerability", "summary": "ImageMagick is a software suite to create, edit, compose, or convert bitmap images. ImageMagick versions prior to 7.1.2-8 are vulnerable to denial-of-service due to unsigned integer underflow and division-by-zero in the CLAHEImage function. When tile width or height is zero, unsigned underflow occurs in pointer arithmetic, leading to out-of-bounds memory access, and division-by-zero causes immediate crashes. This issue has been patched in version 7.1.2-8.", "updated_at": "2026-10-19T13:10:00.110", "published_at": "2025-10-27T20:15:54.893", "cvss": 4.7, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "confidence": 100, "confidence_label": "verified", "affected": "< 7.1.2-8", "fixed": "See vendor advisory", "source_count": 7, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "High", "cwe": "CWE-119", "what_happened": "ImageMagick is a software suite to create, edit, compose, or convert bitmap images. ImageMagick versions prior to 7.1.2-8 are vulnerable to denial-of-service due to unsigned integer underflow and division-by-zero in the CLAHEImage function. When tile width or height is zero, unsigned underflow occurs in pointer arithmetic, leading to out-of-bounds memory access, and division-by-zero causes immediate crashes. This issue has been patched in version 7.1.2-8.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-10-27", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wpp4-vqfq-v4hp" } ], "references": [ "https://github.com/ImageMagick/ImageMagick/commit/7b47fe369eda90483402fcd3d78fa4167d3bb129", "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wpp4-vqfq-v4hp" ], "timeline": [ { "at": "2025-10-27T20:15:54.893", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62594" } ] }, { "id": "CVE-2025-62555", "vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "title": "Microsoft 365 Apps for Enterprise vulnerability", "summary": "Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.", "updated_at": "2026-10-07T11:10:00.153", "published_at": "2025-12-09T18:16:00.790", "cvss": 7, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "16.0.1 through before https://aka.ms/OfficeSecurityReleases (custom); 19.0.0 through before https://aka.ms/OfficeSecurityReleases (custom); 16.0.0 through before https://aka.ms/OfficeSecurityReleases (custom); 16.0.1 through before 16.104.25121423 (custom); 16.0.0 through before 16.104.25121423 (custom); 16.0.0 through before 16.0.5530.1000 (custom); 16.0.0 through before 16.0.10417.20075 (custom); 16.0.1 through before 16.0.5530.1000 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "High", "cwe": "CWE-416", "what_happened": "Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62555" ], "timeline": [ { "at": "2025-12-09T18:16:00.790", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62555" } ] }, { "id": "CVE-2025-62554", "vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "title": "Microsoft 365 Apps for Enterprise vulnerability", "summary": "Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.", "updated_at": "2026-10-07T11:10:00.153", "published_at": "2025-12-09T18:16:00.620", "cvss": 8.4, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "16.0.1 through before https://aka.ms/OfficeSecurityReleases (custom); 16.0.0 through before 16.0.5530.1001 (custom); 19.0.0 through before https://aka.ms/OfficeSecurityReleases (custom); 16.0.1 through before 16.0.19530.20000 (custom); 16.0.0 through before https://aka.ms/OfficeSecurityReleases (custom); 16.0.1 through before 16.104.25121423 (custom); 16.0.0 through before 16.104.25121423 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-843", "what_happened": "Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62554" ], "timeline": [ { "at": "2025-12-09T18:16:00.620", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62554" } ] }, { "id": "CVE-2025-62552", "vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "title": "Microsoft 365 Apps for Enterprise vulnerability", "summary": "Relative path traversal in Microsoft Office Access allows an unauthorized attacker to execute code locally.", "updated_at": "2026-10-07T11:10:00.153", "published_at": "2025-12-09T18:16:00.287", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "16.0.1 through before https://aka.ms/OfficeSecurityReleases (custom); 16.0.0 through before 16.0.5530.1000 (custom); 19.0.0 through before https://aka.ms/OfficeSecurityReleases (custom); 16.0.0 through before https://aka.ms/OfficeSecurityReleases (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-23", "what_happened": "Relative path traversal in Microsoft Office Access allows an unauthorized attacker to execute code locally.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62552" ], "timeline": [ { "at": "2025-12-09T18:16:00.287", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62552" } ] }, { "id": "CVE-2025-62549", "vendor": "Microsoft", "product": "Windows 10 Version 1607", "title": "Windows 10 Version 1607 vulnerability", "summary": "Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.", "updated_at": "2026-10-07T11:10:00.153", "published_at": "2025-12-09T18:15:59.943", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "10.0.14393.0 through before 10.0.14393.8688 (custom); 10.0.17763.0 through before 10.0.17763.8146 (custom); 10.0.19044.0 through before 10.0.19044.6691 (custom); 10.0.19045.0 through before 10.0.19045.6691 (custom); 10.0.22631.0 through before 10.0.22631.6345 (custom); 10.0.26100.0 through before 10.0.26100.7462 (custom); 10.0.26200.0 through before 10.0.26200.7462 (custom); 6.1.7601.0 through before 6.1.7601.28064 (custom); 6.0.6003.0 through before 6.0.6003.23666 (custom); 6.2.9200.0 through before 6.2.9200.25815 (custom); 6.3.9600.0 through before 6.3.9600.22920 (custom); 10.0.20348.0 through before 10.0.20348.4529 (custom); 10.0.25398.0 through before 10.0.25398.2025 (custom)", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-822", "what_happened": "Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62549", "https://www.vicarius.io/vsociety/posts/cve-2025-62549-detection-script-rce-vulnerability-in-windows-routing-and-remote-access-service", "https://www.vicarius.io/vsociety/posts/cve-2025-62549-mitigation-script-rce-vulnerability-in-windows-routing-and-remote-access-service" ], "timeline": [ { "at": "2025-12-09T18:15:59.943", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62549" } ] }, { "id": "CVE-2025-62474", "vendor": "Microsoft", "product": "Windows 10 Version 1607", "title": "Windows 10 Version 1607 vulnerability", "summary": "Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.", "updated_at": "2026-10-07T11:10:00.153", "published_at": "2025-12-09T18:15:59.763", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "10.0.14393.0 through before 10.0.14393.8688 (custom); 10.0.17763.0 through before 10.0.17763.8146 (custom); 10.0.19044.0 through before 10.0.19044.6691 (custom); 10.0.19045.0 through before 10.0.19045.6691 (custom); 10.0.22631.0 through before 10.0.22631.6345 (custom); 10.0.26100.0 through before 10.0.26100.7462 (custom); 10.0.26200.0 through before 10.0.26200.7462 (custom); 6.1.7601.0 through before 6.1.7601.28064 (custom); 6.2.9200.0 through before 6.2.9200.25815 (custom); 6.3.9600.0 through before 6.3.9600.22920 (custom); 10.0.20348.0 through before 10.0.20348.4529 (custom); 10.0.25398.0 through before 10.0.25398.2025 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-284", "what_happened": "Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62474" ], "timeline": [ { "at": "2025-12-09T18:15:59.763", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62474" } ] }, { "id": "CVE-2025-62473", "vendor": "Microsoft", "product": "Windows 10 Version 1607", "title": "Windows 10 Version 1607 vulnerability", "summary": "Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.", "updated_at": "2026-10-07T11:10:00.153", "published_at": "2025-12-09T18:15:59.590", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "10.0.14393.0 through before 10.0.14393.8688 (custom); 10.0.17763.0 through before 10.0.17763.8146 (custom); 10.0.19044.0 through before 10.0.19044.6691 (custom); 10.0.19045.0 through before 10.0.19045.6691 (custom); 10.0.22631.0 through before 10.0.22631.6345 (custom); 10.0.26100.0 through before 10.0.26100.7462 (custom); 10.0.26200.0 through before 10.0.26200.7462 (custom); 6.1.7601.0 through before 6.1.7601.28064 (custom); 6.0.6003.0 through before 6.0.6003.23666 (custom); 6.2.9200.0 through before 6.2.9200.25815 (custom); 6.3.9600.0 through before 6.3.9600.22920 (custom); 10.0.20348.0 through before 10.0.20348.4529 (custom); 10.0.25398.0 through before 10.0.25398.2025 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-126", "what_happened": "Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62473" ], "timeline": [ { "at": "2025-12-09T18:15:59.590", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62473" } ] }, { "id": "CVE-2025-62472", "vendor": "Microsoft", "product": "Windows 10 Version 1607", "title": "Windows 10 Version 1607 vulnerability", "summary": "Use of uninitialized resource in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.", "updated_at": "2026-10-07T11:10:00.153", "published_at": "2025-12-09T18:15:59.413", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "10.0.14393.0 through before 10.0.14393.8688 (custom); 10.0.17763.0 through before 10.0.17763.8146 (custom); 10.0.19044.0 through before 10.0.19044.6691 (custom); 10.0.19045.0 through before 10.0.19045.6691 (custom); 10.0.22631.0 through before 10.0.22631.6345 (custom); 10.0.26100.0 through before 10.0.26100.7462 (custom); 10.0.26200.0 through before 10.0.26200.7462 (custom); 6.1.7601.0 through before 6.1.7601.28064 (custom); 6.0.6003.0 through before 6.0.6003.23666 (custom); 6.2.9200.0 through before 6.2.9200.25815 (custom); 6.3.9600.0 through before 6.3.9600.22920 (custom); 10.0.20348.0 through before 10.0.20348.4529 (custom); 10.0.25398.0 through before 10.0.25398.2025 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-416", "what_happened": "Use of uninitialized resource in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62472" ], "timeline": [ { "at": "2025-12-09T18:15:59.413", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62472" } ] }, { "id": "CVE-2025-62470", "vendor": "Microsoft", "product": "Windows 10 Version 1607", "title": "Windows 10 Version 1607 vulnerability", "summary": "Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.", "updated_at": "2026-10-07T11:10:00.153", "published_at": "2025-12-09T18:15:59.227", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "10.0.14393.0 through before 10.0.14393.8688 (custom); 10.0.17763.0 through before 10.0.17763.8146 (custom); 10.0.19044.0 through before 10.0.19044.6691 (custom); 10.0.19045.0 through before 10.0.19045.6691 (custom); 10.0.22631.0 through before 10.0.22631.6345 (custom); 10.0.26100.0 through before 10.0.26100.7462 (custom); 10.0.26200.0 through before 10.0.26200.7462 (custom); 6.1.7601.0 through before 6.1.7601.28064 (custom); 6.0.6003.0 through before 6.0.6003.23666 (custom); 6.2.9200.0 through before 6.2.9200.25815 (custom); 6.3.9600.0 through before 6.3.9600.22920 (custom); 10.0.20348.0 through before 10.0.20348.4529 (custom); 10.0.25398.0 through before 10.0.25398.2025 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-122", "what_happened": "Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62470" ], "timeline": [ { "at": "2025-12-09T18:15:59.227", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62470" } ] }, { "id": "CVE-2025-62468", "vendor": "Microsoft", "product": "Windows 11 version 22H3", "title": "Windows 11 version 22H3 vulnerability", "summary": "Out-of-bounds read in Windows Defender Firewall Service allows an authorized attacker to disclose information locally.", "updated_at": "2026-10-07T11:10:00.153", "published_at": "2025-12-09T18:15:58.893", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "10.0.22631.0 through before 10.0.22631.6345 (custom); 10.0.26100.0 through before 10.0.26100.7462 (custom); 10.0.26200.0 through before 10.0.26200.7462 (custom); 10.0.25398.0 through before 10.0.25398.2025 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-125", "what_happened": "Out-of-bounds read in Windows Defender Firewall Service allows an authorized attacker to disclose information locally.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62468" ], "timeline": [ { "at": "2025-12-09T18:15:58.893", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62468" } ] }, { "id": "CVE-2025-62467", "vendor": "Microsoft", "product": "Windows 10 Version 1809", "title": "Windows 10 Version 1809 vulnerability", "summary": "Integer overflow or wraparound in Windows Projected File System allows an authorized attacker to elevate privileges locally.", "updated_at": "2026-10-07T11:10:00.153", "published_at": "2025-12-09T18:15:58.727", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "10.0.17763.0 through before 10.0.17763.8146 (custom); 10.0.19044.0 through before 10.0.19044.6691 (custom); 10.0.19045.0 through before 10.0.19045.6691 (custom); 10.0.22631.0 through before 10.0.22631.6345 (custom); 10.0.26100.0 through before 10.0.26100.7462 (custom); 10.0.26200.0 through before 10.0.26200.7462 (custom); 10.0.20348.0 through before 10.0.20348.4529 (custom); 10.0.25398.0 through before 10.0.25398.2025 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-126", "what_happened": "Integer overflow or wraparound in Windows Projected File System allows an authorized attacker to elevate privileges locally.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62467" ], "timeline": [ { "at": "2025-12-09T18:15:58.727", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62467" } ] }, { "id": "CVE-2025-62466", "vendor": "Microsoft", "product": "Windows 10 Version 1607", "title": "Windows 10 Version 1607 vulnerability", "summary": "Null pointer dereference in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.", "updated_at": "2026-10-07T11:10:00.153", "published_at": "2025-12-09T18:15:58.550", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "10.0.14393.0 through before 10.0.14393.8688 (custom); 10.0.17763.0 through before 10.0.17763.8146 (custom); 10.0.19044.0 through before 10.0.19044.6691 (custom); 10.0.19045.0 through before 10.0.19045.6691 (custom); 10.0.22631.0 through before 10.0.22631.6345 (custom); 10.0.26100.0 through before 10.0.26100.7462 (custom); 10.0.26200.0 through before 10.0.26200.7462 (custom); 6.1.7601.0 through before 6.1.7601.28064 (custom); 6.0.6003.0 through before 6.0.6003.23666 (custom); 6.2.9200.0 through before 6.2.9200.25815 (custom); 6.3.9600.0 through before 6.3.9600.22920 (custom); 10.0.20348.0 through before 10.0.20348.4529 (custom); 10.0.25398.0 through before 10.0.25398.2025 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-476", "what_happened": "Null pointer dereference in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62466" ], "timeline": [ { "at": "2025-12-09T18:15:58.550", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62466" } ] }, { "id": "CVE-2025-62464", "vendor": "Microsoft", "product": "Windows 10 Version 1809", "title": "Windows 10 Version 1809 vulnerability", "summary": "Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally.", "updated_at": "2026-10-07T11:10:00.153", "published_at": "2025-12-09T18:15:58.200", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "10.0.17763.0 through before 10.0.17763.8146 (custom); 10.0.19044.0 through before 10.0.19044.6691 (custom); 10.0.19045.0 through before 10.0.19045.6691 (custom); 10.0.22631.0 through before 10.0.22631.6345 (custom); 10.0.26100.0 through before 10.0.26100.7462 (custom); 10.0.26200.0 through before 10.0.26200.7462 (custom); 10.0.20348.0 through before 10.0.20348.4529 (custom); 10.0.25398.0 through before 10.0.25398.2025 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-126", "what_happened": "Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62464" ], "timeline": [ { "at": "2025-12-09T18:15:58.200", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62464" } ] }, { "id": "CVE-2025-62463", "vendor": "Microsoft", "product": "Windows 10 Version 21H2", "title": "Windows 10 Version 21H2 vulnerability", "summary": "Null pointer dereference in Windows DirectX allows an authorized attacker to deny service locally.", "updated_at": "2026-10-07T11:10:00.153", "published_at": "2025-12-09T18:15:58.030", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "confidence": 35, "confidence_label": "observed", "affected": "10.0.19044.0 through before 10.0.19044.6691 (custom); 10.0.19045.0 through before 10.0.19045.6691 (custom); 10.0.22631.0 through before 10.0.22631.6345 (custom); 10.0.26100.0 through before 10.0.26100.7462 (custom); 10.0.26200.0 through before 10.0.26200.7462 (custom); 10.0.20348.0 through before 10.0.20348.4529 (custom); 10.0.25398.0 through before 10.0.25398.2025 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-476", "what_happened": "Null pointer dereference in Windows DirectX allows an authorized attacker to deny service locally.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62463" ], "timeline": [ { "at": "2025-12-09T18:15:58.030", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62463" } ] }, { "id": "CVE-2025-62462", "vendor": "Microsoft", "product": "Windows 10 Version 1809", "title": "Windows 10 Version 1809 vulnerability", "summary": "Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally.", "updated_at": "2026-10-07T11:10:00.153", "published_at": "2025-12-09T18:15:57.860", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "10.0.17763.0 through before 10.0.17763.8146 (custom); 10.0.19044.0 through before 10.0.19044.6691 (custom); 10.0.19045.0 through before 10.0.19045.6691 (custom); 10.0.22631.0 through before 10.0.22631.6345 (custom); 10.0.26100.0 through before 10.0.26100.7462 (custom); 10.0.26200.0 through before 10.0.26200.7462 (custom); 10.0.20348.0 through before 10.0.20348.4529 (custom); 10.0.25398.0 through before 10.0.25398.2025 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-126", "what_happened": "Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62462" ], "timeline": [ { "at": "2025-12-09T18:15:57.860", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62462" } ] }, { "id": "CVE-2025-62461", "vendor": "Microsoft", "product": "Windows 10 Version 1809", "title": "Windows 10 Version 1809 vulnerability", "summary": "Buffer over-read in Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges locally.", "updated_at": "2026-10-07T11:10:00.153", "published_at": "2025-12-09T18:15:57.680", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "10.0.17763.0 through before 10.0.17763.8146 (custom); 10.0.19044.0 through before 10.0.19044.6691 (custom); 10.0.19045.0 through before 10.0.19045.6691 (custom); 10.0.22631.0 through before 10.0.22631.6345 (custom); 10.0.26100.0 through before 10.0.26100.7462 (custom); 10.0.26200.0 through before 10.0.26200.7462 (custom); 10.0.20348.0 through before 10.0.20348.4529 (custom); 10.0.25398.0 through before 10.0.25398.2025 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-126", "what_happened": "Buffer over-read in Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges locally.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62461" ], "timeline": [ { "at": "2025-12-09T18:15:57.680", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62461" } ] }, { "id": "CVE-2025-62458", "vendor": "Microsoft", "product": "Windows 10 Version 1607", "title": "Windows 10 Version 1607 vulnerability", "summary": "Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.", "updated_at": "2026-10-07T11:10:00.153", "published_at": "2025-12-09T18:15:57.503", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "10.0.14393.0 through before 10.0.14393.8688 (custom); 10.0.17763.0 through before 10.0.17763.8146 (custom); 10.0.19044.0 through before 10.0.19044.6691 (custom); 10.0.19045.0 through before 10.0.19045.6691 (custom); 10.0.22631.0 through before 10.0.22631.6345 (custom); 6.1.7601.0 through before 6.1.7601.28064 (custom); 6.2.9200.0 through before 6.2.9200.25815 (custom); 6.3.9600.0 through before 6.3.9600.22920 (custom); 10.0.20348.0 through before 10.0.20348.4529 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-122", "what_happened": "Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62458" ], "timeline": [ { "at": "2025-12-09T18:15:57.503", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62458" } ] }, { "id": "CVE-2025-62457", "vendor": "Microsoft", "product": "Windows 10 Version 1809", "title": "Windows 10 Version 1809 vulnerability", "summary": "Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.", "updated_at": "2026-10-07T11:10:00.153", "published_at": "2025-12-09T18:15:57.313", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "10.0.17763.0 through before 10.0.17763.8146 (custom); 10.0.19044.0 through before 10.0.19044.6691 (custom); 10.0.19045.0 through before 10.0.19045.6691 (custom); 10.0.22631.0 through before 10.0.22631.6345 (custom); 10.0.26100.0 through before 10.0.26100.7462 (custom); 10.0.26200.0 through before 10.0.26200.7462 (custom); 10.0.20348.0 through before 10.0.20348.4529 (custom); 10.0.25398.0 through before 10.0.25398.2025 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-125", "what_happened": "Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62457" ], "timeline": [ { "at": "2025-12-09T18:15:57.313", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62457" } ] }, { "id": "CVE-2025-62456", "vendor": "Microsoft", "product": "Windows 11 version 22H3", "title": "Windows 11 version 22H3 vulnerability", "summary": "Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code over a network.", "updated_at": "2026-10-07T11:10:00.153", "published_at": "2025-12-09T18:15:57.143", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "10.0.22631.0 through before 10.0.22631.6345 (custom); 10.0.26100.0 through before 10.0.26100.7462 (custom); 10.0.26200.0 through before 10.0.26200.7462 (custom); 10.0.20348.0 through before 10.0.20348.4529 (custom); 10.0.25398.0 through before 10.0.25398.2025 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-122", "what_happened": "Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code over a network.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62456" ], "timeline": [ { "at": "2025-12-09T18:15:57.143", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62456" } ] }, { "id": "CVE-2025-62373", "vendor": "pipecat-ai", "product": "pipecat", "title": "pipecat vulnerability", "summary": "Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Versions 0.0.41 through 0.0.93 have a vulnerability in `LivekitFrameSerializer` – an optional, non-default, undocumented frame serializer class (now deprecated) intended for LiveKit integration. The class's `deserialize()` method uses Python's `pickle.loads()` on data received from WebSocket clients without any validation or sanitization. This means that a malicious WebSocket client can send a crafted pickle payload to execute arbitrary code on the Pipecat server. The vulnerable code resides in `src/pipecat/serializers/livekit.py` (around line 73), where untrusted WebSocket message data is passed directly into `pickle.loads()` for deserialization. If a Pipecat server is configured to use LivekitFrameSerializer and is listening on an external interface (e.g. 0.0.0.0), an attacker on the network (or the internet, if the service is exposed) could achieve remote code execution (RCE) on the server by sending a malicious pickle payload. Version 0.0.94 contains a fix. Users of Pipecat should avoid or replace unsafe deserialization and improve network security configuration. The best mitigation is to stop using the vulnerable LivekitFrameSerializer altogether. Those who require LiveKit functionality should upgrade to the latest Pipecat version and switch to the recommended `LiveKitTransport` or another secure method provided by the framework. Additionally, always follow secure coding practices: never trust client-supplied data, and avoid Python pickle (or similar unsafe deserialization) in network-facing components.", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-04-23T16:16:24.140", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "confidence": 100, "confidence_label": "verified", "affected": ">= 0.0.41, < 0.0.94", "fixed": "See vendor advisory", "source_count": 25, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-502", "what_happened": "Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Versions 0.0.41 through 0.0.93 have a vulnerability in `LivekitFrameSerializer` – an optional, non-default, undocumented frame serializer class (now deprecated) intended for LiveKit integration. The class's `deserialize()` method uses Python's `pickle.loads()` on data received from WebSocket clients without any validation or sanitization. This means that a malicious WebSocket client can send a crafted pickle payload to execute arbitrary code on the Pipecat server. The vulnerable code resides in `src/pipecat/serializers/livekit.py` (around line 73), where untrusted WebSocket message data is passed directly into `pickle.loads()` for deserialization. If a Pipecat server is configured to use LivekitFrameSerializer and is listening on an external interface (e.g. 0.0.0.0), an attacker on the network (or the internet, if the service is exposed) could achieve remote code execution (RCE) on the server by sending a malicious pickle payload. Version 0.0.94 contains a fix. Users of Pipecat should avoid or replace unsafe deserialization and improve network security configuration. The best mitigation is to stop using the vulnerable LivekitFrameSerializer altogether. Those who require LiveKit functionality should upgrade to the latest Pipecat version and switch to the recommended `LiveKitTransport` or another secure method provided by the framework. Additionally, always follow secure coding practices: never trust client-supplied data, and avoid Python pickle (or similar unsafe deserialization) in network-facing components.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2026-04-23", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/pipecat-ai/pipecat/security/advisories/GHSA-c2jg-5cp7-6wc7" } ], "references": [ "https://github.com/pipecat-ai/pipecat/security/advisories/GHSA-c2jg-5cp7-6wc7" ], "timeline": [ { "at": "2026-04-23T16:16:24.140", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62373" } ] }, { "id": "CVE-2025-62347", "vendor": "HCL", "product": "HCL iControl", "title": "HCL iControl vulnerability", "summary": "HCL iControl was affected by Improper Input Validation vulnerability. It is vulnerable to unexpected system behavior and potential security bypasses. This was caused by an implementation flaw in an architectural security tactic that fails to properly validate whether the received input matches the expected type.", "updated_at": "2026-09-29T14:10:00.117", "published_at": "2026-07-31T16:16:56.500", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "4.3.0 and 4.4.0", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-20", "what_happened": "HCL iControl was affected by Improper Input Validation vulnerability. It is vulnerable to unexpected system behavior and potential security bypasses. This was caused by an implementation flaw in an architectural security tactic that fails to properly validate whether the received input matches the expected type.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132395" ], "timeline": [ { "at": "2026-07-31T16:16:56.500", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62347" } ] }, { "id": "CVE-2025-62154", "vendor": "recorp", "product": "AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One", "title": "AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One vulnerability", "summary": "Missing Authorization vulnerability in recorp AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One ai-content-writing-assistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One: from n/a through <= 1.1.7.", "updated_at": "2026-09-23T17:10:00.210", "published_at": "2025-12-31T16:15:46.660", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.1.7 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in recorp AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One ai-content-writing-assistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One: from n/a through <= 1.1.7.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/ai-content-writing-assistant/vulnerability/wordpress-ai-content-writing-assistant-content-writer-chatgpt-image-generator-all-in-one-plugin-1-1-7-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T16:15:46.660", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62154" } ] }, { "id": "CVE-2025-62150", "vendor": "themesawesome", "product": "History Timeline", "title": "History Timeline vulnerability", "summary": "Missing Authorization vulnerability in themesawesome History Timeline timeline-awesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects History Timeline: from n/a through <= 1.0.6.", "updated_at": "2026-09-23T17:10:00.210", "published_at": "2025-12-31T16:15:46.513", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.0.6 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in themesawesome History Timeline timeline-awesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects History Timeline: from n/a through <= 1.0.6.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/timeline-awesome/vulnerability/wordpress-history-timeline-plugin-1-0-6-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T16:15:46.513", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62150" } ] }, { "id": "CVE-2025-62143", "vendor": "nicashmu", "product": "Post Video Players", "title": "Post Video Players vulnerability", "summary": "Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in nicashmu Post Video Players video-playlist-and-gallery-plugin allows Retrieve Embedded Sensitive Data.This issue affects Post Video Players: from n/a through <= 1.163.", "updated_at": "2026-09-23T17:10:00.210", "published_at": "2025-12-31T16:15:46.153", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.163 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-497", "what_happened": "Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in nicashmu Post Video Players video-playlist-and-gallery-plugin allows Retrieve Embedded Sensitive Data.This issue affects Post Video Players: from n/a through <= 1.163.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/video-playlist-and-gallery-plugin/vulnerability/wordpress-post-video-players-plugin-1-163-sensitive-data-exposure-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T16:15:46.153", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62143" } ] }, { "id": "CVE-2025-62122", "vendor": "solwininfotech", "product": "Trash Duplicate and 301 Redirect", "title": "Trash Duplicate and 301 Redirect vulnerability", "summary": "Missing Authorization vulnerability in solwininfotech Trash Duplicate and 301 Redirect trash-duplicate-and-301-redirect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trash Duplicate and 301 Redirect: from n/a through <= 1.9.1.", "updated_at": "2026-09-23T17:10:00.210", "published_at": "2025-12-31T16:15:45.010", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.9.1 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in solwininfotech Trash Duplicate and 301 Redirect trash-duplicate-and-301-redirect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trash Duplicate and 301 Redirect: from n/a through <= 1.9.1.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/trash-duplicate-and-301-redirect/vulnerability/wordpress-trash-duplicate-and-301-redirect-plugin-1-9-1-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T16:15:45.010", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62122" } ] }, { "id": "CVE-2025-62116", "vendor": "quadlayers", "product": "AI Copilot", "title": "AI Copilot vulnerability", "summary": "Missing Authorization vulnerability in quadlayers AI Copilot ai-copilot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Copilot: from n/a through <= 1.5.2.", "updated_at": "2026-09-23T17:10:00.210", "published_at": "2025-12-31T16:15:44.867", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.5.2 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in quadlayers AI Copilot ai-copilot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Copilot: from n/a through <= 1.5.2.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/ai-copilot/vulnerability/wordpress-ai-copilot-plugin-1-4-7-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T16:15:44.867", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62116" } ] }, { "id": "CVE-2025-62115", "vendor": "ThemeBoy", "product": "Hide Plugins", "title": "Hide Plugins vulnerability", "summary": "Missing Authorization vulnerability in ThemeBoy Hide Plugins hide-plugins allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hide Plugins: from n/a through <= 1.0.4.", "updated_at": "2026-09-23T17:10:00.210", "published_at": "2025-12-31T17:15:46.323", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.0.4 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in ThemeBoy Hide Plugins hide-plugins allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hide Plugins: from n/a through <= 1.0.4.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/hide-plugins/vulnerability/wordpress-hide-plugins-plugin-1-0-4-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T17:15:46.323", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62115" } ] }, { "id": "CVE-2025-62099", "vendor": "approveme", "product": "Signature Add-On for Gravity Forms", "title": "Signature Add-On for Gravity Forms vulnerability", "summary": "Missing Authorization vulnerability in approveme Signature Add-On for Gravity Forms gravity-signature-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Signature Add-On for Gravity Forms: from n/a through <= 1.8.6.", "updated_at": "2026-09-23T16:10:00.140", "published_at": "2025-12-31T17:15:45.820", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.8.6 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in approveme Signature Add-On for Gravity Forms gravity-signature-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Signature Add-On for Gravity Forms: from n/a through <= 1.8.6.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/gravity-signature-forms-add-on/vulnerability/wordpress-signature-add-on-for-gravity-forms-plugin-1-8-6-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T17:15:45.820", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62099" } ] }, { "id": "CVE-2025-62088", "vendor": "extendons", "product": "WordPress & WooCommerce Scraper Plugin, Import Data from Any Site", "title": "WordPress & WooCommerce Scraper Plugin, Import Data from Any Site vulnerability", "summary": "Server-Side Request Forgery (SSRF) vulnerability in extendons WordPress & WooCommerce Scraper Plugin, Import Data from Any Site wp_scraper allows Server Side Request Forgery.This issue affects WordPress & WooCommerce Scraper Plugin, Import Data from Any Site: from n/a through <= 1.0.7.", "updated_at": "2026-09-23T17:10:00.210", "published_at": "2025-12-31T17:15:45.577", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.0.7 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-918", "what_happened": "Server-Side Request Forgery (SSRF) vulnerability in extendons WordPress & WooCommerce Scraper Plugin, Import Data from Any Site wp_scraper allows Server Side Request Forgery.This issue affects WordPress & WooCommerce Scraper Plugin, Import Data from Any Site: from n/a through <= 1.0.7.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/wp_scraper/vulnerability/wordpress-wordpress-woocommerce-scraper-plugin-import-data-from-any-site-plugin-1-0-7-server-side-request-forgery-ssrf-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T17:15:45.577", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62088" } ] }, { "id": "CVE-2025-62087", "vendor": "Web Builder 143", "product": "Sticky Notes for WP Dashboard", "title": "Sticky Notes for WP Dashboard vulnerability", "summary": "Missing Authorization vulnerability in Web Builder 143 Sticky Notes for WP Dashboard wb-sticky-notes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sticky Notes for WP Dashboard: from n/a through <= 1.2.4.", "updated_at": "2026-09-23T17:10:00.210", "published_at": "2025-12-31T16:15:44.280", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.2.4 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in Web Builder 143 Sticky Notes for WP Dashboard wb-sticky-notes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sticky Notes for WP Dashboard: from n/a through <= 1.2.4.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/wb-sticky-notes/vulnerability/wordpress-sticky-notes-for-wp-dashboard-plugin-1-2-4-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T16:15:44.280", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62087" } ] }, { "id": "CVE-2025-62083", "vendor": "WP Messiah", "product": "BoomDevs WordPress Coming Soon", "title": "BoomDevs WordPress Coming Soon vulnerability", "summary": "Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Messiah BoomDevs WordPress Coming Soon coming-soon-by-boomdevs allows Retrieve Embedded Sensitive Data.This issue affects BoomDevs WordPress Coming Soon: from n/a through <= 1.0.4.", "updated_at": "2026-09-23T16:10:00.140", "published_at": "2025-12-31T17:15:45.327", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.0.4 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-497", "what_happened": "Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Messiah BoomDevs WordPress Coming Soon coming-soon-by-boomdevs allows Retrieve Embedded Sensitive Data.This issue affects BoomDevs WordPress Coming Soon: from n/a through <= 1.0.4.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/coming-soon-by-boomdevs/vulnerability/wordpress-boomdevs-wordpress-coming-soon-plugin-plugin-1-0-4-sensitive-data-exposure-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T17:15:45.327", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62083" } ] }, { "id": "CVE-2025-62078", "vendor": "Fahad Mahmood", "product": "Easy Upload Files During Checkout", "title": "Easy Upload Files During Checkout vulnerability", "summary": "Missing Authorization vulnerability in Fahad Mahmood Easy Upload Files During Checkout easy-upload-files-during-checkout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Upload Files During Checkout: from n/a through <= 3.0.0.", "updated_at": "2026-09-23T16:10:00.140", "published_at": "2025-12-31T17:15:45.073", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 3.0.0 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in Fahad Mahmood Easy Upload Files During Checkout easy-upload-files-during-checkout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Upload Files During Checkout: from n/a through <= 3.0.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/easy-upload-files-during-checkout/vulnerability/wordpress-easy-upload-files-during-checkout-plugin-3-0-0-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-12-31T17:15:45.073", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62078" } ] }, { "id": "CVE-2025-62023", "vendor": "Cristián Lávaque", "product": "s2Member", "title": "s2Member vulnerability", "summary": "Improper Control of Generation of Code ('Code Injection') vulnerability in Cristián Lávaque s2Member s2member.This issue affects s2Member: from n/a through 250905.", "updated_at": "2026-09-29T07:16:34.037", "published_at": "2025-10-22T15:16:03.667", "cvss": 9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "confidence": 100, "confidence_label": "review", "affected": "0 through 250905 (custom)", "fixed": "See vendor advisory", "source_count": 74, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-94", "what_happened": "Improper Control of Generation of Code ('Code Injection') vulnerability in Cristián Lávaque s2Member s2member.This issue affects s2Member: from n/a through 250905.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "Sploitus", "author": "Sploitus index", "first_seen": "2026-09-29T10:19:25+00:00", "confidence": "Medium", "verification": "candidate", "verified": false, "title": "Exploit for CVE-2025-62023", "summary": "Proof-of-concept exploit for CVE-2025-62023. CVSS 9.", "cvss": 9, "url": "https://sploitus.com/exploit?id=2D842966-9B58-5970-A7DE-52121C5DB985" } ], "references": [ "https://patchstack.com/database/wordpress/plugin/s2member/vulnerability/wordpress-s2member-plugin-250905-remote-code-execution-rce-vulnerability?_s_id=cve", "https://sploitus.com/exploit?id=2D842966-9B58-5970-A7DE-52121C5DB985" ], "timeline": [ { "at": "2025-10-22T15:16:03.667", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62023" } ] }, { "id": "CVE-2025-61782", "vendor": "OpenCTI-Platform", "product": "opencti", "title": "opencti vulnerability", "summary": "OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.3, an open redirect vulnerability exists in the OpenCTI platform's SAML authentication endpoint (/auth/saml/callback). By manipulating the RelayState parameter, an attacker can force the server to issue a 302 redirect to any external URL, enabling phishing, credential theft, and arbitrary site redirection. This issue has been patched in version 6.8.3.", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-01-07T18:15:51.223", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "< 6.8.3", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-601", "what_happened": "OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.3, an open redirect vulnerability exists in the OpenCTI platform's SAML authentication endpoint (/auth/saml/callback). By manipulating the RelayState parameter, an attacker can force the server to issue a 302 redirect to any external URL, enabling phishing, credential theft, and arbitrary site redirection. This issue has been patched in version 6.8.3.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/OpenCTI-Platform/opencti/commit/f755165a26888925c4a58018f7238ff92a0bd378", "https://github.com/OpenCTI-Platform/opencti/releases/tag/6.8.3", "https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-jc3f-c62g-v7qw" ], "timeline": [ { "at": "2026-01-07T18:15:51.223", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61782" } ] }, { "id": "CVE-2025-61781", "vendor": "OpenCTI-Platform", "product": "opencti", "title": "opencti vulnerability", "summary": "OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.1, the GraphQL mutation \"WorkspacePopoverDeletionMutation\" allows users to delete workspace-related objects such as dashboards and investigation cases. However, the mutation lacks proper authorization checks to verify ownership of the targeted resources.\nAn attacker can exploit this by supplying an active UUID of another user. Since the API does not validate whether the requester owns the resource, the mutation executes successfully, resulting in unauthorized deletion of the entire workspace. Version 6.8.1 fixes the issue.", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-01-05T18:15:44.077", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "confidence": 35, "confidence_label": "observed", "affected": "< 6.8.1", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-285", "what_happened": "OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.1, the GraphQL mutation \"WorkspacePopoverDeletionMutation\" allows users to delete workspace-related objects such as dashboards and investigation cases. However, the mutation lacks proper authorization checks to verify ownership of the targeted resources.\nAn attacker can exploit this by supplying an active UUID of another user. Since the API does not validate whether the requester owns the resource, the mutation executes successfully, resulting in unauthorized deletion of the entire workspace. Version 6.8.1 fixes the issue.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-pr6m-q4g7-342c" ], "timeline": [ { "at": "2026-01-05T18:15:44.077", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61781" } ] }, { "id": "CVE-2025-61735", "vendor": "Apache Software Foundation", "product": "Apache Kylin", "title": "Apache Kylin vulnerability", "summary": "Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin.\n\nThis issue affects Apache Kylin: from 4.0.0 through 5.0.2. You are fine as long as the Kylin's system and project admin access is well protected.\n\nUsers are recommended to upgrade to version 5.0.3, which fixes the issue.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T10:15:40.250", "cvss": 7.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "4.0.0 through 5.0.2 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-918", "what_happened": "Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin.\n\nThis issue affects Apache Kylin: from 4.0.0 through 5.0.2. You are fine as long as the Kylin's system and project admin access is well protected.\n\nUsers are recommended to upgrade to version 5.0.3, which fixes the issue.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://lists.apache.org/thread/yscobmx869zvprsykb94r24jtmb58ckh", "http://www.openwall.com/lists/oss-security/2025/09/30/9" ], "timeline": [ { "at": "2025-10-02T10:15:40.250", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61735" } ] }, { "id": "CVE-2025-61734", "vendor": "Apache Software Foundation", "product": "Apache Kylin", "title": "Apache Kylin vulnerability", "summary": "Files or Directories Accessible to External Parties vulnerability in Apache Kylin.\n You are fine as long as the Kylin's system and project admin access is well protected.\n\nThis issue affects Apache Kylin: from 4.0.0 through 5.0.2.\n\nUsers are recommended to upgrade to version 5.0.3, which fixes the issue.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T10:15:40.100", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "4.0.0 through 5.0.2 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-552", "what_happened": "Files or Directories Accessible to External Parties vulnerability in Apache Kylin.\n You are fine as long as the Kylin's system and project admin access is well protected.\n\nThis issue affects Apache Kylin: from 4.0.0 through 5.0.2.\n\nUsers are recommended to upgrade to version 5.0.3, which fixes the issue.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://lists.apache.org/thread/z705g7sn3g0bkchlqbo1hz1tyqorn4d2", "http://www.openwall.com/lists/oss-security/2025/09/30/8" ], "timeline": [ { "at": "2025-10-02T10:15:40.100", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61734" } ] }, { "id": "CVE-2025-61733", "vendor": "Apache Software Foundation", "product": "Apache Kylin", "title": "Apache Kylin vulnerability", "summary": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Kylin.\n\nThis issue affects Apache Kylin: from 4.0.0 through 5.0.2.\n\nUsers are recommended to upgrade to version 5.0.3, which fixes the issue.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T10:15:39.930", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "4.0.0 through 5.0.2 (semver)", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-288", "what_happened": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Kylin.\n\nThis issue affects Apache Kylin: from 4.0.0 through 5.0.2.\n\nUsers are recommended to upgrade to version 5.0.3, which fixes the issue.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://lists.apache.org/thread/8wmcffly6gp50nmfw8j4w3hlmv843yo0", "http://www.openwall.com/lists/oss-security/2025/09/30/7" ], "timeline": [ { "at": "2025-10-02T10:15:39.930", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61733" } ] }, { "id": "CVE-2025-61692", "vendor": "KEYENCE CORPORATION", "product": "VT STUDIO", "title": "VT STUDIO vulnerability", "summary": "VT STUDIO versions 8.53 and prior contain a use after free vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on the affected product.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T06:15:38.193", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "8.53 and prior", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "High", "cwe": "CWE-416", "what_happened": "VT STUDIO versions 8.53 and prior contain a use after free vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on the affected product.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://jvn.jp/en/vu/JVNVU97069449/", "https://www.keyence.com/vt_vulnerability250930" ], "timeline": [ { "at": "2025-10-02T06:15:38.193", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61692" } ] }, { "id": "CVE-2025-61691", "vendor": "KEYENCE CORPORATION", "product": "VT STUDIO", "title": "VT STUDIO vulnerability", "summary": "VT STUDIO versions 8.53 and prior contain an out-of-bounds read vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on the affected product.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T06:15:37.917", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "8.53 and prior", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "High", "cwe": "CWE-125", "what_happened": "VT STUDIO versions 8.53 and prior contain an out-of-bounds read vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on the affected product.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://jvn.jp/en/vu/JVNVU97069449/", "https://www.keyence.com/vt_vulnerability250930" ], "timeline": [ { "at": "2025-10-02T06:15:37.917", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61691" } ] }, { "id": "CVE-2025-61690", "vendor": "KEYENCE CORPORATION", "product": "KV STUDIO", "title": "KV STUDIO vulnerability", "summary": "KV STUDIO versions 12.23 and prior contain a buffer underflow vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on the affected product.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T06:15:37.663", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "12.23 and prior", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "High", "cwe": "CWE-124", "what_happened": "KV STUDIO versions 12.23 and prior contain a buffer underflow vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on the affected product.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://jvn.jp/en/vu/JVNVU97069449/", "https://www.keyence.com/kv_vulnerability2509302" ], "timeline": [ { "at": "2025-10-02T06:15:37.663", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61690" } ] }, { "id": "CVE-2025-61659", "vendor": "magicmonty", "product": "bash-git-prompt", "title": "bash-git-prompt vulnerability", "summary": "bash-git-prompt 2.6.1 through 2.7.1 insecurely uses the /tmp/git-index-private$$ file, which has a predictable name.", "updated_at": "2026-10-09T09:10:00.213", "published_at": "2025-09-29T17:15:32.737", "cvss": 6.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "2.6.1 through 2.7.1 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-377", "what_happened": "bash-git-prompt 2.6.1 through 2.7.1 insecurely uses the /tmp/git-index-private$$ file, which has a predictable name.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/magicmonty/bash-git-prompt/issues/561" ], "timeline": [ { "at": "2025-09-29T17:15:32.737", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61659" } ] }, { "id": "CVE-2025-61624", "vendor": "Fortinet", "product": "FortiOS", "title": "FortiOS vulnerability", "summary": "An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.", "updated_at": "2026-10-17T04:16:43.363", "published_at": "2026-04-14T16:16:31.300", "cvss": 6, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "confidence": 100, "confidence_label": "observed", "affected": "7.6.0 through 7.6.4 (semver); 7.4.0 through 7.4.9 (semver); 7.2.0 through 7.2.13 (semver); 7.0.0 through 7.0.19 (semver); 6.4.0 through 6.4.16 (semver); 7.4.0 through 7.4.11 (semver); 7.2.0 through 7.2.16 (semver); 7.0.0 through 7.0.23 (semver); 7.2.0 through 7.2.7 (semver); 7.0.0 through 7.0.6 (semver); 1.7.0; 1.6.0 through 1.6.2 (semver); 1.5.0 through 1.5.1 (semver); 1.4.0 through 1.4.3 (semver); 1.3.0 through 1.3.1 (semver); 1.2.0; 1.1.0 through 1.1.2 (semver); 1.0.0 through 1.0.3 (semver); before * (custom)", "fixed": "See vendor advisory", "source_count": 16, "kev": true, "attack_vector": "Local", "authentication": "High", "complexity": "Low", "cwe": "CWE-22", "what_happened": "An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://fortiguard.fortinet.com/psirt/FG-IR-26-122", "https://cert-portal.siemens.com/productcert/html/ssa-975644.html", "https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/#post-188095-_guyq53ar8k05", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61624" ], "timeline": [ { "at": "2026-04-14T16:16:31.300", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61624" }, { "at": "2026-10-16", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-10-16", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-10-16", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-10-16", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-10-16", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-10-16", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-10-16", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-10-16", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-10-16", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-10-16", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-10-16", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "at": "2026-10-16", "label": "Added to CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ] }, { "id": "CVE-2025-61598", "vendor": "discourse", "product": "discourse", "title": "discourse vulnerability", "summary": "Discourse is an open source discussion platform. Version before 3.6.2 and 3.6.0.beta2, default Cache-Control response header with value no-store, no-cache was missing from error responses. This may caused unintended caching of those responses by proxies potentially leading to cache poisoning attacks. This vulnerability is fixed in 3.6.2 and 3.6.0.beta2.", "updated_at": "2026-10-19T13:10:00.110", "published_at": "2025-10-28T21:15:40.110", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "< 3.6.2; >= 3.6.0.beta1, < 3.6.0.beta2", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-524", "what_happened": "Discourse is an open source discussion platform. Version before 3.6.2 and 3.6.0.beta2, default Cache-Control response header with value no-store, no-cache was missing from error responses. This may caused unintended caching of those responses by proxies potentially leading to cache poisoning attacks. This vulnerability is fixed in 3.6.2 and 3.6.0.beta2.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/discourse/discourse/commit/3ea1b663c82c067e5ca778db846bad1e082ba6cd", "https://github.com/discourse/discourse/commit/fd567af7bf5a15c70772021acbdf5d38487a31bc", "https://github.com/discourse/discourse/security/advisories/GHSA-jp9x-wwv6-cv3j" ], "timeline": [ { "at": "2025-10-28T21:15:40.110", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61598" } ] }, { "id": "CVE-2025-61587", "vendor": "WeblateOrg", "product": "weblate", "title": "weblate vulnerability", "summary": "Weblate is a web based localization tool. An open redirect exists in versions 5.13.2 and below via the redir parameter on .within.website when Weblate is configured with Anubis and REDIRECT_DOMAINS is not set. An attacker can craft a URL on the legitimate domain that redirects a victim to an attacker-controlled site. The redirect can also be used to initiate drive-by downloads (redirecting to a URL that serves a malicious file), increasing the risk to end users. This issue is fixed in version 5.13.3.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-01T22:15:31.853", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "< 5.13.3", "fixed": "See vendor advisory", "source_count": 29, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-601", "what_happened": "Weblate is a web based localization tool. An open redirect exists in versions 5.13.2 and below via the redir parameter on .within.website when Weblate is configured with Anubis and REDIRECT_DOMAINS is not set. An attacker can craft a URL on the legitimate domain that redirects a victim to an attacker-controlled site. The redirect can also be used to initiate drive-by downloads (redirecting to a URL that serves a malicious file), increasing the risk to end users. This issue is fixed in version 5.13.3.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-10-01", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3xhv-r4gx-xw99" } ], "references": [ "https://github.com/WeblateOrg/docker/commit/76518342f65b8af8c2b7f7c5d37f84813c1253a1", "https://github.com/WeblateOrg/weblate/commit/6b3d73a310279b5630bca8cbd9ea0be28bc67b63", "https://github.com/WeblateOrg/weblate/commit/ec3b900f8a52c5c992d9e7014f09397e159ac381", "https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3xhv-r4gx-xw99" ], "timeline": [ { "at": "2025-10-01T22:15:31.853", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61587" } ] }, { "id": "CVE-2025-61583", "vendor": "joni1802", "product": "ts3-manager", "title": "ts3-manager vulnerability", "summary": "TS3 Manager is modern web interface for maintaining Teamspeak3 servers. A reflected cross-site scripting vulnerability has been identified in versions 2.2.1 and earlier. The vulnerability exists in the error handling mechanism of the login page, where malicious scripts embedded in server hostnames are executed in the victim's browser context without proper sanitization. This issue is fixed in version 2.2.2.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-01T23:15:30.507", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "confidence": 100, "confidence_label": "verified", "affected": "< 2.2.2", "fixed": "See vendor advisory", "source_count": 26, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-20", "what_happened": "TS3 Manager is modern web interface for maintaining Teamspeak3 servers. A reflected cross-site scripting vulnerability has been identified in versions 2.2.1 and earlier. The vulnerability exists in the error handling mechanism of the login page, where malicious scripts embedded in server hostnames are executed in the victim's browser context without proper sanitization. This issue is fixed in version 2.2.2.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-10-01", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/joni1802/ts3-manager/security/advisories/GHSA-qw6j-37r6-m93g" } ], "references": [ "https://github.com/joni1802/ts3-manager/commit/3a069915f97a6f5dae1fe0b2e32aa11a69d83b5e", "https://github.com/joni1802/ts3-manager/security/advisories/GHSA-qw6j-37r6-m93g" ], "timeline": [ { "at": "2025-10-01T23:15:30.507", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61583" } ] }, { "id": "CVE-2025-61582", "vendor": "joni1802", "product": "ts3-manager", "title": "ts3-manager vulnerability", "summary": "TS3 Manager is modern web interface for maintaining Teamspeak3 servers. A Denial of Dervice vulnerability has been identified in versions 2.2.1 and earlier. The vulnerability permits an unauthenticated actor to crash the application through the submission of specially crafted Unicode input, requiring no prior authentication or privileges. The flaw manifests when Unicode tag characters are submitted to the Server field on the login page. The application fails to properly handle these characters during the ASCII conversion process, resulting in an unhandled exception that terminates the application within four to five seconds of submission. This issue is fixed in version 2.2.2.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-01T23:15:30.340", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "confidence": 100, "confidence_label": "verified", "affected": "< 2.2.2", "fixed": "See vendor advisory", "source_count": 26, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-20", "what_happened": "TS3 Manager is modern web interface for maintaining Teamspeak3 servers. A Denial of Dervice vulnerability has been identified in versions 2.2.1 and earlier. The vulnerability permits an unauthenticated actor to crash the application through the submission of specially crafted Unicode input, requiring no prior authentication or privileges. The flaw manifests when Unicode tag characters are submitted to the Server field on the login page. The application fails to properly handle these characters during the ASCII conversion process, resulting in an unhandled exception that terminates the application within four to five seconds of submission. This issue is fixed in version 2.2.2.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-10-01", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/joni1802/ts3-manager/security/advisories/GHSA-4cq4-hp4f-8w7p" } ], "references": [ "https://github.com/joni1802/ts3-manager/commit/3a069915f97a6f5dae1fe0b2e32aa11a69d83b5e", "https://github.com/joni1802/ts3-manager/security/advisories/GHSA-4cq4-hp4f-8w7p" ], "timeline": [ { "at": "2025-10-01T23:15:30.340", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61582" } ] }, { "id": "CVE-2025-60473", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "A NULL pointer dereference in the gf_filter_in_parent_chain function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.", "updated_at": "2026-10-13T09:10:00.323", "published_at": "2026-06-25T00:17:47.267", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "confidence": 100, "confidence_label": "verified", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 117, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-476", "what_happened": "A NULL pointer dereference in the gf_filter_in_parent_chain function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2026-06-25", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/gpac/gpac/issues/3285" }, { "repository": "github.com", "author": "NVD reference", "first_seen": "2026-06-25", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/36/36_gf_filter_in_parent_chain_filter_core_filter_pid_c_2145" }, { "repository": "github.com", "author": "NVD reference", "first_seen": "2026-06-25", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/36/README.md" }, { "repository": "infosec.exchange", "author": "NVD reference", "first_seen": "2026-06-25", "confidence": "High", "verification": "verified", "verified": true, "url": "https://infosec.exchange/@sigdevel/116780471059317580" }, { "repository": "www.openwall.com", "author": "NVD reference", "first_seen": "2026-06-25", "confidence": "High", "verification": "verified", "verified": true, "url": "http://www.openwall.com/lists/oss-security/2026/06/27/3" } ], "references": [ "https://github.com/gpac/gpac/commit/b8d80b44718de10b101e1d7fc17c84d69feb092e", "https://github.com/gpac/gpac/issues/3285", "https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/36/36_gf_filter_in_parent_chain_filter_core_filter_pid_c_2145", "https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/36/README.md", "https://infosec.exchange/@sigdevel/116780471059317580", "http://www.openwall.com/lists/oss-security/2026/06/27/3" ], "timeline": [ { "at": "2026-06-25T00:17:47.267", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60473" } ] }, { "id": "CVE-2025-60458", "vendor": "n/a", "product": "n/a", "title": "n/a vulnerability", "summary": "UxPlay 1.72 contains a double free vulnerability in its RTSP request handling. A specially crafted RTSP TEARDOWN request can trigger multiple calls to free() on the same memory address, potentially causing a Denial of Service.", "updated_at": "2026-10-13T09:10:00.323", "published_at": "2025-12-29T15:16:01.520", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "confidence": 35, "confidence_label": "observed", "affected": "n/a", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-400", "what_happened": "UxPlay 1.72 contains a double free vulnerability in its RTSP request handling. A specially crafted RTSP TEARDOWN request can trigger multiple calls to free() on the same memory address, potentially causing a Denial of Service.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/0pepsi/CVE-2025-60458" ], "timeline": [ { "at": "2025-12-29T15:16:01.520", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60458" } ] }, { "id": "CVE-2025-60374", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Exploit for CVE-2025-60374", "summary": "Stored XSS in Perfex CRM chatbot before 3.3.1 via chat messages enabling session theft.", "updated_at": "2026-10-03T03:03:25Z", "published_at": "2026-10-03T03:03:25Z", "cvss": 6.1, "confidence": 100, "confidence_label": "review", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 69, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Stored XSS in Perfex CRM chatbot before 3.3.1 via chat messages enabling session theft.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "title": "Exploit for CVE-2025-60374", "summary": "Stored XSS in Perfex CRM chatbot before 3.3.1 via chat messages enabling session theft.", "what_happened": "Stored XSS in Perfex CRM chatbot before 3.3.1 via chat messages enabling session theft.", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-AJANSHA-CVE-2025-60374", "https://kitploit.com/ru/tools/github/ajansha/cve-2025-60374/" ], "repository": "Sploitus", "author": "KitPloit", "first_seen": "2026-10-03T05:03:25", "confidence": "Medium", "verification": "candidate", "verified": false, "verification_detail": "Indexed source reference.", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-AJANSHA-CVE-2025-60374" }, { "title": "Exploit for CVE-2025-60374", "summary": "Stored XSS in Perfex CRM chatbot before 3.3.1 via chat messages enabling session theft.", "what_happened": "Stored XSS in Perfex CRM chatbot before 3.3.1 via chat messages enabling session theft.", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-AJANSHA-CVE-2025-60374", "https://kitploit.com/ru/tools/github/ajansha/cve-2025-60374/" ], "repository": "kitploit.com", "author": "ru", "first_seen": "2026-10-03T05:03:25", "confidence": "Medium", "verification": "correlated", "verified": false, "verification_detail": "Linked from Sploitus structured metadata.", "url": "https://kitploit.com/ru/tools/github/ajansha/cve-2025-60374/" } ], "references": [ "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-AJANSHA-CVE-2025-60374", "https://kitploit.com/ru/tools/github/ajansha/cve-2025-60374/" ], "timeline": [ { "at": "2026-10-03T03:03:25Z", "label": "Discovered through Sploitus", "url": "https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-AJANSHA-CVE-2025-60374" } ], "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "id": "CVE-2025-60186", "vendor": "Alex Moss", "product": "Google+ Comments", "title": "Google+ Comments vulnerability", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Moss Google+ Comments google-plus-comments allows Stored XSS.This issue affects Google+ Comments: from n/a through <= 1.0.", "updated_at": "2026-10-09T10:10:00.193", "published_at": "2025-09-26T09:15:48.483", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.0 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Moss Google+ Comments google-plus-comments allows Stored XSS.This issue affects Google+ Comments: from n/a through <= 1.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/google-plus-comments/vulnerability/wordpress-google-comments-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-09-26T09:15:48.483", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60186" } ] }, { "id": "CVE-2025-60185", "vendor": "kontur.us", "product": "kontur Admin Style", "title": "kontur Admin Style vulnerability", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kontur.us kontur Admin Style kontur-admin-style allows Stored XSS.This issue affects kontur Admin Style: from n/a through <= 1.0.4.", "updated_at": "2026-10-09T10:10:00.193", "published_at": "2025-09-26T09:15:48.300", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.0.4 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kontur.us kontur Admin Style kontur-admin-style allows Stored XSS.This issue affects kontur Admin Style: from n/a through <= 1.0.4.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/kontur-admin-style/vulnerability/wordpress-kontur-admin-style-plugin-1-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-09-26T09:15:48.300", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60185" } ] }, { "id": "CVE-2025-60184", "vendor": "Terry L.", "product": "SEO Search Permalink", "title": "SEO Search Permalink vulnerability", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terry L. SEO Search Permalink seo-search-permalink allows Stored XSS.This issue affects SEO Search Permalink: from n/a through <= 1.0.3.", "updated_at": "2026-10-09T10:10:00.193", "published_at": "2025-09-26T09:15:48.143", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.0.3 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terry L. SEO Search Permalink seo-search-permalink allows Stored XSS.This issue affects SEO Search Permalink: from n/a through <= 1.0.3.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/seo-search-permalink/vulnerability/wordpress-seo-search-permalink-plugin-1-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-09-26T09:15:48.143", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60184" } ] }, { "id": "CVE-2025-60181", "vendor": "silence", "product": "Silencesoft RSS Reader", "title": "Silencesoft RSS Reader vulnerability", "summary": "Server-Side Request Forgery (SSRF) vulnerability in silence Silencesoft RSS Reader external-rss-reader allows Server Side Request Forgery.This issue affects Silencesoft RSS Reader: from n/a through <= 0.6.", "updated_at": "2026-10-09T10:10:00.193", "published_at": "2025-09-26T09:15:47.957", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 0.6 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-918", "what_happened": "Server-Side Request Forgery (SSRF) vulnerability in silence Silencesoft RSS Reader external-rss-reader allows Server Side Request Forgery.This issue affects Silencesoft RSS Reader: from n/a through <= 0.6.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/external-rss-reader/vulnerability/wordpress-silencesoft-rss-reader-plugin-0-6-server-side-request-forgery-ssrf-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-09-26T09:15:47.957", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60181" } ] }, { "id": "CVE-2025-60179", "vendor": "Space Studio", "product": "Click & Tweet", "title": "Click & Tweet vulnerability", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Space Studio Click & Tweet allows Stored XSS. This issue affects Click & Tweet: from n/a through 0.8.9.", "updated_at": "2026-10-09T10:10:00.193", "published_at": "2025-09-26T09:15:47.790", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "n/a through 0.8.9 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Space Studio Click & Tweet allows Stored XSS. This issue affects Click & Tweet: from n/a through 0.8.9.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/plugin/click-tweet/vulnerability/wordpress-click-tweet-plugin-0-8-9-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-09-26T09:15:47.790", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60179" } ] }, { "id": "CVE-2025-60177", "vendor": "rozx", "product": "Recaptcha – wp", "title": "Recaptcha – wp vulnerability", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rozx Recaptcha – wp recaptcha-wp allows Stored XSS.This issue affects Recaptcha – wp: from n/a through <= 0.2.6.", "updated_at": "2026-10-09T10:10:00.193", "published_at": "2025-09-26T09:15:47.617", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 0.2.6 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rozx Recaptcha – wp recaptcha-wp allows Stored XSS.This issue affects Recaptcha – wp: from n/a through <= 0.2.6.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/recaptcha-wp/vulnerability/wordpress-recaptcha-wp-plugin-0-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-09-26T09:15:47.617", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60177" } ] }, { "id": "CVE-2025-60173", "vendor": "Ashwani kumar", "product": "GST for WooCommerce", "title": "GST for WooCommerce vulnerability", "summary": "Cross-Site Request Forgery (CSRF) vulnerability in Ashwani kumar GST for WooCommerce gst-for-woocommerce allows Stored XSS.This issue affects GST for WooCommerce: from n/a through <= 2.0.", "updated_at": "2026-10-09T10:10:00.193", "published_at": "2025-09-26T09:15:47.440", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.0 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-352", "what_happened": "Cross-Site Request Forgery (CSRF) vulnerability in Ashwani kumar GST for WooCommerce gst-for-woocommerce allows Stored XSS.This issue affects GST for WooCommerce: from n/a through <= 2.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/gst-for-woocommerce/vulnerability/wordpress-gst-for-woocommerce-plugin-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-09-26T09:15:47.440", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60173" } ] }, { "id": "CVE-2025-60172", "vendor": "flytedesk", "product": "Flytedesk Digital", "title": "Flytedesk Digital vulnerability", "summary": "Cross-Site Request Forgery (CSRF) vulnerability in flytedesk Flytedesk Digital flytedesk-digital allows Stored XSS.This issue affects Flytedesk Digital: from n/a through <= 20181101.", "updated_at": "2026-10-09T10:10:00.193", "published_at": "2025-09-26T09:15:47.253", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 20181101 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-352", "what_happened": "Cross-Site Request Forgery (CSRF) vulnerability in flytedesk Flytedesk Digital flytedesk-digital allows Stored XSS.This issue affects Flytedesk Digital: from n/a through <= 20181101.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/flytedesk-digital/vulnerability/wordpress-flytedesk-digital-plugin-20181101-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-09-26T09:15:47.253", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60172" } ] }, { "id": "CVE-2025-60171", "vendor": "yourplugins", "product": "Conditional Cart Messages for WooCommerce – YourPlugins.com", "title": "Conditional Cart Messages for WooCommerce – YourPlugins.com vulnerability", "summary": "Cross-Site Request Forgery (CSRF) vulnerability in yourplugins Conditional Cart Messages for WooCommerce – YourPlugins.com yourplugins-wc-conditional-cart-notices allows Stored XSS.This issue affects Conditional Cart Messages for WooCommerce – YourPlugins.com: from n/a through <= 1.2.10.", "updated_at": "2026-10-09T10:10:00.193", "published_at": "2025-09-26T09:15:47.023", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.2.10 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-352", "what_happened": "Cross-Site Request Forgery (CSRF) vulnerability in yourplugins Conditional Cart Messages for WooCommerce – YourPlugins.com yourplugins-wc-conditional-cart-notices allows Stored XSS.This issue affects Conditional Cart Messages for WooCommerce – YourPlugins.com: from n/a through <= 1.2.10.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/yourplugins-wc-conditional-cart-notices/vulnerability/wordpress-conditional-cart-messages-for-woocommerce-yourplugins-com-plugin-1-2-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-09-26T09:15:47.023", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60171" } ] }, { "id": "CVE-2025-60170", "vendor": "Taraprasad Swain", "product": "HTACCESS IP Blocker", "title": "HTACCESS IP Blocker vulnerability", "summary": "Cross-Site Request Forgery (CSRF) vulnerability in Taraprasad Swain HTACCESS IP Blocker htaccess-ip-blocker allows Stored XSS.This issue affects HTACCESS IP Blocker: from n/a through <= 1.0.", "updated_at": "2026-10-09T10:10:00.193", "published_at": "2025-09-26T09:15:46.837", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.0 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-352", "what_happened": "Cross-Site Request Forgery (CSRF) vulnerability in Taraprasad Swain HTACCESS IP Blocker htaccess-ip-blocker allows Stored XSS.This issue affects HTACCESS IP Blocker: from n/a through <= 1.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/htaccess-ip-blocker/vulnerability/wordpress-htaccess-ip-blocker-plugin-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-09-26T09:15:46.837", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60170" } ] }, { "id": "CVE-2025-60169", "vendor": "W3S Cloud Technology", "product": "W3SCloud Contact Form 7 to Zoho CRM", "title": "W3SCloud Contact Form 7 to Zoho CRM vulnerability", "summary": "Cross-Site Request Forgery (CSRF) vulnerability in W3S Cloud Technology W3SCloud Contact Form 7 to Zoho CRM w3s-cf7-zoho allows Stored XSS.This issue affects W3SCloud Contact Form 7 to Zoho CRM: from n/a through <= 3.2.", "updated_at": "2026-10-09T10:10:00.193", "published_at": "2025-09-26T09:15:46.660", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 3.2 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-352", "what_happened": "Cross-Site Request Forgery (CSRF) vulnerability in W3S Cloud Technology W3SCloud Contact Form 7 to Zoho CRM w3s-cf7-zoho allows Stored XSS.This issue affects W3SCloud Contact Form 7 to Zoho CRM: from n/a through <= 3.2.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/w3s-cf7-zoho/vulnerability/wordpress-w3scloud-contact-form-7-to-zoho-crm-plugin-3-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-09-26T09:15:46.660", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60169" } ] }, { "id": "CVE-2025-60167", "vendor": "honzat", "product": "Page Manager for Elementor", "title": "Page Manager for Elementor vulnerability", "summary": "Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in honzat Page Manager for Elementor page-manager-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects Page Manager for Elementor: from n/a through <= 2.0.5.", "updated_at": "2026-10-09T10:10:00.193", "published_at": "2025-09-26T09:15:46.500", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.0.5 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-497", "what_happened": "Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in honzat Page Manager for Elementor page-manager-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects Page Manager for Elementor: from n/a through <= 2.0.5.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/page-manager-for-elementor/vulnerability/wordpress-page-manager-for-elementor-plugin-2-0-5-sensitive-data-exposure-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-09-26T09:15:46.500", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60167" } ] }, { "id": "CVE-2025-60166", "vendor": "wpshuffle", "product": "WP Subscription Forms PRO", "title": "WP Subscription Forms PRO vulnerability", "summary": "Missing Authorization vulnerability in wpshuffle WP Subscription Forms PRO wp-subscription-forms-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Subscription Forms PRO: from n/a through <= 2.0.5.", "updated_at": "2026-10-09T10:10:00.193", "published_at": "2025-09-26T09:15:46.343", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.0.5 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in wpshuffle WP Subscription Forms PRO wp-subscription-forms-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Subscription Forms PRO: from n/a through <= 2.0.5.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/wp-subscription-forms-pro/vulnerability/wordpress-wp-subscription-forms-pro-plugin-2-0-5-arbitrary-content-deletion-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-09-26T09:15:46.343", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60166" } ] }, { "id": "CVE-2025-60165", "vendor": "HaruTheme", "product": "Frames", "title": "Frames vulnerability", "summary": "Missing Authorization vulnerability in HaruTheme Frames frames allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Frames: from n/a through <= 1.5.7.", "updated_at": "2026-10-09T10:10:00.193", "published_at": "2025-09-26T09:15:46.170", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 1.5.7 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-862", "what_happened": "Missing Authorization vulnerability in HaruTheme Frames frames allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Frames: from n/a through <= 1.5.7.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Theme/frames/vulnerability/wordpress-frames-theme-1-5-7-broken-access-control-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-09-26T09:15:46.170", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60165" } ] }, { "id": "CVE-2025-60164", "vendor": "NewsMAN", "product": "NewsmanApp", "title": "NewsmanApp vulnerability", "summary": "Cross-Site Request Forgery (CSRF) vulnerability in NewsMAN NewsmanApp newsmanapp allows Stored XSS.This issue affects NewsmanApp: from n/a through <= 2.7.7.", "updated_at": "2026-10-09T10:10:00.193", "published_at": "2025-09-26T09:15:46.000", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.7.7 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-352", "what_happened": "Cross-Site Request Forgery (CSRF) vulnerability in NewsMAN NewsmanApp newsmanapp allows Stored XSS.This issue affects NewsmanApp: from n/a through <= 2.7.7.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/newsmanapp/vulnerability/wordpress-newsmanapp-plugin-2-7-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-09-26T09:15:46.000", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60164" } ] }, { "id": "CVE-2025-60163", "vendor": "Robin W", "product": "bbp topic count", "title": "bbp topic count vulnerability", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robin W bbp topic count bbp-topic-count allows DOM-Based XSS.This issue affects bbp topic count: from n/a through <= 3.2.", "updated_at": "2026-10-09T10:10:00.193", "published_at": "2025-09-26T09:15:45.823", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 3.2 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robin W bbp topic count bbp-topic-count allows DOM-Based XSS.This issue affects bbp topic count: from n/a through <= 3.2.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/bbp-topic-count/vulnerability/wordpress-bbp-topic-count-plugin-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-09-26T09:15:45.823", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60163" } ] }, { "id": "CVE-2025-60162", "vendor": "PickPlugins", "product": "Job Board Manager", "title": "Job Board Manager vulnerability", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Job Board Manager job-board-manager allows DOM-Based XSS.This issue affects Job Board Manager: from n/a through <= 2.1.61.", "updated_at": "2026-10-09T10:10:00.193", "published_at": "2025-09-26T09:15:45.657", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.1.61 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Job Board Manager job-board-manager allows DOM-Based XSS.This issue affects Job Board Manager: from n/a through <= 2.1.61.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/job-board-manager/vulnerability/wordpress-job-board-manager-plugin-2-1-61-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-09-26T09:15:45.657", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60162" } ] }, { "id": "CVE-2025-60161", "vendor": "bdthemes", "product": "ZoloBlocks", "title": "ZoloBlocks vulnerability", "summary": "Server-Side Request Forgery (SSRF) vulnerability in bdthemes ZoloBlocks zoloblocks allows Server Side Request Forgery.This issue affects ZoloBlocks: from n/a through <= 2.3.11.", "updated_at": "2026-10-09T10:10:00.193", "published_at": "2025-09-26T09:15:45.473", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.3.11 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-918", "what_happened": "Server-Side Request Forgery (SSRF) vulnerability in bdthemes ZoloBlocks zoloblocks allows Server Side Request Forgery.This issue affects ZoloBlocks: from n/a through <= 2.3.11.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/zoloblocks/vulnerability/wordpress-zoloblocks-plugin-2-3-9-server-side-request-forgery-ssrf-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-09-26T09:15:45.473", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60161" } ] }, { "id": "CVE-2025-60160", "vendor": "sharkthemes", "product": "Smart Related Products", "title": "Smart Related Products vulnerability", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sharkthemes Smart Related Products ai-related-products allows Stored XSS.This issue affects Smart Related Products: from n/a through <= 2.0.8.", "updated_at": "2026-10-09T10:10:00.193", "published_at": "2025-09-26T09:15:45.310", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "0 through 2.0.8 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "High", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sharkthemes Smart Related Products ai-related-products allows Stored XSS.This issue affects Smart Related Products: from n/a through <= 2.0.8.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/Wordpress/Plugin/ai-related-products/vulnerability/wordpress-smart-related-products-plugin-2-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2025-09-26T09:15:45.310", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60160" } ] }, { "id": "CVE-2025-59990", "vendor": "Juniper Networks", "product": "Junos Space", "title": "Junos Space vulnerability", "summary": "An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the template creation pages that, when visited by another user, enable the attacker to execute commands with the target's permissions, including an administrator.\nThis issue affects all versions of Junos Space before 24.1R4.", "updated_at": "2026-10-01T16:10:00.257", "published_at": "2025-10-09T17:16:01.143", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "before 24.1R4 (semver)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the template creation pages that, when visited by another user, enable the attacker to execute commands with the target's permissions, including an administrator.\nThis issue affects all versions of Junos Space before 24.1R4.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://supportportal.juniper.net/JSA103140" ], "timeline": [ { "at": "2025-10-09T17:16:01.143", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59990" } ] }, { "id": "CVE-2025-59952", "vendor": "minio", "product": "minio-java", "title": "minio-java vulnerability", "summary": "MinIO Java SDK is a Simple Storage Service (aka S3) client to perform bucket and object operations to any Amazon S3 compatible object storage service. In minio-java versions prior to 8.6.0, XML tag values containing references to system properties or environment variables were automatically substituted with their actual values during processing. This unintended behavior could lead to the exposure of sensitive information, including credentials, file paths, or system configuration details, if such references were present in XML content from untrusted sources. This is fixed in version 8.6.0.", "updated_at": "2026-10-09T09:10:00.213", "published_at": "2025-09-30T04:43:46.573", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "< 8.6.0", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-20", "what_happened": "MinIO Java SDK is a Simple Storage Service (aka S3) client to perform bucket and object operations to any Amazon S3 compatible object storage service. In minio-java versions prior to 8.6.0, XML tag values containing references to system properties or environment variables were automatically substituted with their actual values during processing. This unintended behavior could lead to the exposure of sensitive information, including credentials, file paths, or system configuration details, if such references were present in XML content from untrusted sources. This is fixed in version 8.6.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/minio/minio-java/commit/f7a98d06b25e5464bdd4811b044e25ff9101d37f", "https://github.com/minio/minio-java/releases/tag/8.6.0", "https://github.com/minio/minio-java/security/advisories/GHSA-h7rh-xfpj-hpcm" ], "timeline": [ { "at": "2025-09-30T04:43:46.573", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59952" } ] }, { "id": "CVE-2025-59951", "vendor": "LukeGus", "product": "Termix", "title": "Termix vulnerability", "summary": "Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The official Docker image for Termix versions 1.5.0 and below, due to being configured with an Nginx reverse proxy, causes the backend to retrieve the proxy's IP instead of the client's IP when using the req.ip method. This results in isLocalhost always returning True. Consequently, the /ssh/db/host/internal endpoint can be accessed directly without login or authentication. This endpoint records the system's stored SSH host information, including addresses, usernames, and passwords, posing an extremely high security risk. Users who use the official Termix docker image, build their own image using the official dockerfile, or utilize reverse proxy functionality will be affected by this vulnerability. This issue is fixed in version 1.6.0.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-01T22:15:31.683", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "< 1.6.0", "fixed": "See vendor advisory", "source_count": 27, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-284", "what_happened": "Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The official Docker image for Termix versions 1.5.0 and below, due to being configured with an Nginx reverse proxy, causes the backend to retrieve the proxy's IP instead of the client's IP when using the req.ip method. This results in isLocalhost always returning True. Consequently, the /ssh/db/host/internal endpoint can be accessed directly without login or authentication. This endpoint records the system's stored SSH host information, including addresses, usernames, and passwords, posing an extremely high security risk. Users who use the official Termix docker image, build their own image using the official dockerfile, or utilize reverse proxy functionality will be affected by this vulnerability. This issue is fixed in version 1.6.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-10-01", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/LukeGus/Termix/security/advisories/GHSA-92cw-877q-6r94" } ], "references": [ "https://github.com/LukeGus/Termix/pull/221", "https://github.com/LukeGus/Termix/security/advisories/GHSA-92cw-877q-6r94" ], "timeline": [ { "at": "2025-10-01T22:15:31.683", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59951" } ] }, { "id": "CVE-2025-59946", "vendor": "nanomq", "product": "nanomq", "title": "nanomq vulnerability", "summary": "NanoMQ MQTT Broker (NanoMQ) is an Edge Messaging Platform. Prior to version 0.24.2, there is a classical data racing issue about sub info list which could result in heap use after free crash. This issue has been patched in version 0.24.2.", "updated_at": "2026-10-13T09:10:00.323", "published_at": "2025-12-27T01:15:41.880", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 100, "confidence_label": "verified", "affected": "< 0.24.4", "fixed": "See vendor advisory", "source_count": 24, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "High", "cwe": "CWE-416", "what_happened": "NanoMQ MQTT Broker (NanoMQ) is an Edge Messaging Platform. Prior to version 0.24.2, there is a classical data racing issue about sub info list which could result in heap use after free crash. This issue has been patched in version 0.24.2.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-12-27", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/nanomq/nanomq/issues/1863" } ], "references": [ "https://github.com/nanomq/nanomq/issues/1863", "https://github.com/nanomq/nanomq/security/advisories/GHSA-xg37-23w7-72p5" ], "timeline": [ { "at": "2025-12-27T01:15:41.880", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59946" } ] }, { "id": "CVE-2025-59945", "vendor": "Syslifters", "product": "sysreptor", "title": "sysreptor vulnerability", "summary": "SysReptor is a fully customizable pentest reporting platform. In versions from 2024.74 to before 2025.83, authenticated and unprivileged (non-admin) users can assign the is_project_admin permission to their own user. This allows users to read, modify and delete pentesting projects they are not members of and are therefore not supposed to access. This issue has been patched in version 2025.83.", "updated_at": "2026-10-09T10:10:00.193", "published_at": "2025-09-27T01:15:44.073", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": ">= 2024.74, < 2025.83", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-266", "what_happened": "SysReptor is a fully customizable pentest reporting platform. In versions from 2024.74 to before 2025.83, authenticated and unprivileged (non-admin) users can assign the is_project_admin permission to their own user. This allows users to read, modify and delete pentesting projects they are not members of and are therefore not supposed to access. This issue has been patched in version 2025.83.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/Syslifters/sysreptor/commit/de8b5d89d0644479ee0da0a113c6bcc2436ba7f4", "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-r6hm-59cq-gjg6" ], "timeline": [ { "at": "2025-09-27T01:15:44.073", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59945" } ] }, { "id": "CVE-2025-59942", "vendor": "filecoin-project", "product": "go-f3", "title": "go-f3 vulnerability", "summary": "go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.6 and below, go-f3 panics when it validates a \"poison\" messages causing Filecoin nodes consuming F3 messages to become vulnerable. A \"poison\" message can can cause integer overflow in the signer index validation, which can cause the whole node to crash. These malicious messages aren't self-propagating since the bug is in the validator. An attacker needs to directly send the message to all targets. This issue is fixed in version 0.8.7.", "updated_at": "2026-10-09T09:10:00.213", "published_at": "2025-09-29T23:15:32.303", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "confidence": 35, "confidence_label": "observed", "affected": "< 0.8.7", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-190", "what_happened": "go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.6 and below, go-f3 panics when it validates a \"poison\" messages causing Filecoin nodes consuming F3 messages to become vulnerable. A \"poison\" message can can cause integer overflow in the signer index validation, which can cause the whole node to crash. These malicious messages aren't self-propagating since the bug is in the validator. An attacker needs to directly send the message to all targets. This issue is fixed in version 0.8.7.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/filecoin-project/go-f3/security/advisories/GHSA-g99p-47x7-mq88" ], "timeline": [ { "at": "2025-09-29T23:15:32.303", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59942" } ] }, { "id": "CVE-2025-59941", "vendor": "filecoin-project", "product": "go-f3", "title": "go-f3 vulnerability", "summary": "go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.8 and below, go-f3's justification verification caching mechanism has a vulnerability where verification results are cached without properly considering the context of the message. An attacker can bypass justification verification by submitting a valid message with a correct justification and then reusing the same cached justification in contexts where it would normally be invalid. This occurs because the cached verification does not properly validate the relationship between the justification and the specific message context it's being used with. This issue is fixed in version 0.8.9.", "updated_at": "2026-10-09T09:10:00.213", "published_at": "2025-09-29T23:15:32.133", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L", "confidence": 35, "confidence_label": "observed", "affected": "< 0.8.9", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "High", "cwe": "CWE-305", "what_happened": "go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.8 and below, go-f3's justification verification caching mechanism has a vulnerability where verification results are cached without properly considering the context of the message. An attacker can bypass justification verification by submitting a valid message with a correct justification and then reusing the same cached justification in contexts where it would normally be invalid. This occurs because the cached verification does not properly validate the relationship between the justification and the specific message context it's being used with. This issue is fixed in version 0.8.9.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/filecoin-project/go-f3/commit/76fff18cf07b21baccf537024bdb2fb41f75f6e2#diff-e1f646cea41790e1642e4e649c9e3c526344736d67222201703e1c29c23e9625", "https://github.com/filecoin-project/go-f3/security/advisories/GHSA-7pq9-rf9p-wcrf" ], "timeline": [ { "at": "2025-09-29T23:15:32.133", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59941" } ] }, { "id": "CVE-2025-59940", "vendor": "mondeja", "product": "mkdocs-include-markdown-plugin", "title": "mkdocs-include-markdown-plugin vulnerability", "summary": "mkdocs-include-markdown-plugin is an Mkdocs Markdown includer plugin. In versions 7.1.7 and below, there is a vulnerability where unvalidated input can collide with substitution placeholders. This issue is fixed in version 7.1.8.", "updated_at": "2026-10-09T09:10:00.213", "published_at": "2025-09-29T23:15:31.967", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "< 7.1.8", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-20", "what_happened": "mkdocs-include-markdown-plugin is an Mkdocs Markdown includer plugin. In versions 7.1.7 and below, there is a vulnerability where unvalidated input can collide with substitution placeholders. This issue is fixed in version 7.1.8.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/mondeja/mkdocs-include-markdown-plugin/commit/7466d67aa0de8ffbc427204ad2475fed07678915", "https://github.com/mondeja/mkdocs-include-markdown-plugin/issues/274", "https://github.com/mondeja/mkdocs-include-markdown-plugin/pull/277", "https://github.com/mondeja/mkdocs-include-markdown-plugin/security/advisories/GHSA-v39m-5m9j-m9w9" ], "timeline": [ { "at": "2025-09-29T23:15:31.967", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59940" } ] }, { "id": "CVE-2025-59939", "vendor": "LabRedesCefetRJ", "product": "WeGIA", "title": "WeGIA vulnerability", "summary": "WeGIA is a Web manager for charitable institutions. Prior to version 3.5.0, WeGIA is vulnerable to SQL Injection attacks in the control.php endpoint with the following parameters: nomeClasse=ProdutoControle&metodo=excluir&id_produto=[malicious command]. It is necessary to apply prepared statements methods, sanitization, and validations on theid_produto parameter. This issue has been patched in version 3.5.0.", "updated_at": "2026-10-09T10:10:00.193", "published_at": "2025-09-27T01:15:43.903", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 100, "confidence_label": "verified", "affected": "< 3.5.0", "fixed": "See vendor advisory", "source_count": 39, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-89", "what_happened": "WeGIA is a Web manager for charitable institutions. Prior to version 3.5.0, WeGIA is vulnerable to SQL Injection attacks in the control.php endpoint with the following parameters: nomeClasse=ProdutoControle&metodo=excluir&id_produto=[malicious command]. It is necessary to apply prepared statements methods, sanitization, and validations on theid_produto parameter. This issue has been patched in version 3.5.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-09-27", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-jx9m-pgf8-v489" } ], "references": [ "https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-jx9m-pgf8-v489" ], "timeline": [ { "at": "2025-09-27T01:15:43.903", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59939" } ] }, { "id": "CVE-2025-59937", "vendor": "wneessen", "product": "go-mail", "title": "go-mail vulnerability", "summary": "go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands of the SMTP client, there is a possibility of wrong address routing or even ESMTP parameter smuggling. For successful exploitation, it is required that the user's code allows for arbitrary mail address input (i. e. through a web form or similar). If only static mail addresses are used (i. e. in a config file) and the mail addresses in use do not consist of quoted local parts, this should not affect users. This issue is fixed in version 0.7.1", "updated_at": "2026-10-09T09:10:00.213", "published_at": "2025-09-29T23:15:31.807", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "< 0.7.1", "fixed": "See vendor advisory", "source_count": 44, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-88", "what_happened": "go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands of the SMTP client, there is a possibility of wrong address routing or even ESMTP parameter smuggling. For successful exploitation, it is required that the user's code allows for arbitrary mail address input (i. e. through a web form or similar). If only static mail addresses are used (i. e. in a config file) and the mail addresses in use do not consist of quoted local parts, this should not affect users. This issue is fixed in version 0.7.1", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-09-29", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/wneessen/go-mail/issues/495" } ], "references": [ "https://github.com/wneessen/go-mail/commit/42e92cfe027be04aff72921adb0f72f11d517479", "https://github.com/wneessen/go-mail/issues/495", "https://github.com/wneessen/go-mail/pull/496", "https://github.com/wneessen/go-mail/security/advisories/GHSA-wpwj-69cm-q9c5" ], "timeline": [ { "at": "2025-09-29T23:15:31.807", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59937" } ] }, { "id": "CVE-2025-59936", "vendor": "nearform", "product": "get-jwks", "title": "get-jwks vulnerability", "summary": "get-jwks contains fetch utils for JWKS keys. In versions prior to 11.0.2, a vulnerability in get-jwks can lead to cache poisoning in the JWKS key-fetching mechanism. When the iss (issuer) claim is validated only after keys are retrieved from the cache, it is possible for cached keys from an unexpected issuer to be reused, resulting in a bypass of issuer validation. This design flaw enables a potential attack where a malicious actor crafts a pair of JWTs, the first one ensuring that a chosen public key is fetched and stored in the shared JWKS cache, and the second one leveraging that cached key to pass signature validation for a targeted iss value. The vulnerability will work only if the iss validation is done after the use of get-jwks for keys retrieval. This issue has been patched in version 11.0.2.", "updated_at": "2026-10-09T10:10:00.193", "published_at": "2025-09-27T01:15:43.590", "cvss": 9.4, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "confidence": 35, "confidence_label": "observed", "affected": "< 11.0.2", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-116", "what_happened": "get-jwks contains fetch utils for JWKS keys. In versions prior to 11.0.2, a vulnerability in get-jwks can lead to cache poisoning in the JWKS key-fetching mechanism. When the iss (issuer) claim is validated only after keys are retrieved from the cache, it is possible for cached keys from an unexpected issuer to be reused, resulting in a bypass of issuer validation. This design flaw enables a potential attack where a malicious actor crafts a pair of JWTs, the first one ensuring that a chosen public key is fetched and stored in the shared JWKS cache, and the second one leveraging that cached key to pass signature validation for a targeted iss value. The vulnerability will work only if the iss validation is done after the use of get-jwks for keys retrieval. This issue has been patched in version 11.0.2.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/nearform/get-jwks/commit/1706a177a80a1759fe68e3339dc5a219ce03ddb9", "https://github.com/nearform/get-jwks/security/advisories/GHSA-qc2q-qhf3-235m" ], "timeline": [ { "at": "2025-09-27T01:15:43.590", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59936" } ] }, { "id": "CVE-2025-59932", "vendor": "FlagForgeCTF", "product": "flagForge", "title": "flagForge vulnerability", "summary": "Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.1, the /api/resources endpoint previously allowed POST and DELETE requests without proper authentication or authorization. This could have enabled unauthorized users to create, modify, or delete resources on the platform. The issue has been fixed in FlagForge version 2.3.1.", "updated_at": "2026-10-09T10:10:00.193", "published_at": "2025-09-27T01:15:43.430", "cvss": 8.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "confidence": 35, "confidence_label": "observed", "affected": ">= 2.0.0, < 2.3.1", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-284", "what_happened": "Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.1, the /api/resources endpoint previously allowed POST and DELETE requests without proper authentication or authorization. This could have enabled unauthorized users to create, modify, or delete resources on the platform. The issue has been fixed in FlagForge version 2.3.1.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-v8rh-25rf-gfqw" ], "timeline": [ { "at": "2025-09-27T01:15:43.430", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59932" } ] }, { "id": "CVE-2025-59888", "vendor": "Eaton", "product": "UPS Companion software", "title": "UPS Companion software vulnerability", "summary": "Improper quotation in search paths in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to the \n\nfile system. This security issue has been fixed in the latest version of EUC which is available on the Eaton download center.", "updated_at": "2026-10-06T08:10:00.193", "published_at": "2025-12-26T07:15:45.693", "cvss": 6.7, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:H", "confidence": 35, "confidence_label": "observed", "affected": "before 3.0 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "High", "complexity": "High", "cwe": "CWE-428", "what_happened": "Improper quotation in search paths in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to the \n\nfile system. This security issue has been fixed in the latest version of EUC which is available on the Eaton download center.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1026.pdf" ], "timeline": [ { "at": "2025-12-26T07:15:45.693", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59888" } ] }, { "id": "CVE-2025-59868", "vendor": "HCLSoftware", "product": "Traveler for Microsoft Outlook", "title": "Traveler for Microsoft Outlook vulnerability", "summary": "HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a sensitive data exposure vulnerability which could allow an attacker to exploit application information to then attempt additional attacks and cause unknown behavior in the application.", "updated_at": "2026-09-29T19:10:00.160", "published_at": "2026-06-27T02:16:28.593", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "confidence": 35, "confidence_label": "observed", "affected": "<3.0.15", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-532", "what_happened": "HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a sensitive data exposure vulnerability which could allow an attacker to exploit application information to then attempt additional attacks and cause unknown behavior in the application.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131419" ], "timeline": [ { "at": "2026-06-27T02:16:28.593", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59868" } ] }, { "id": "CVE-2025-59845", "vendor": "apollographql", "product": "embeddable-explorer", "title": "embeddable-explorer vulnerability", "summary": "Apollo Studio Embeddable Explorer & Embeddable Sandbox are website embeddable software solutions from Apollo GraphQL. Prior to Apollo Sandbox version 2.7.2 and Apollo Explorer version 3.7.3, a cross-site request forgery (CSRF) vulnerability was identified. The vulnerability arises from missing origin validation in the client-side code that handles window.postMessage events. A malicious website can send forged messages to the embedding page, causing the victim’s browser to execute arbitrary GraphQL queries or mutations against their GraphQL server while authenticated with the victim’s cookies. This issue has been patched in Apollo Sandbox version 2.7.2 and Apollo Explorer version 3.7.3.", "updated_at": "2026-10-09T10:10:00.193", "published_at": "2025-09-26T23:15:31.640", "cvss": 8.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "< 2.7.2; < 3.7.3", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-346", "what_happened": "Apollo Studio Embeddable Explorer & Embeddable Sandbox are website embeddable software solutions from Apollo GraphQL. Prior to Apollo Sandbox version 2.7.2 and Apollo Explorer version 3.7.3, a cross-site request forgery (CSRF) vulnerability was identified. The vulnerability arises from missing origin validation in the client-side code that handles window.postMessage events. A malicious website can send forged messages to the embedding page, causing the victim’s browser to execute arbitrary GraphQL queries or mutations against their GraphQL server while authenticated with the victim’s cookies. This issue has been patched in Apollo Sandbox version 2.7.2 and Apollo Explorer version 3.7.3.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/apollographql/embeddable-explorer/security/advisories/GHSA-w87v-7w53-wwxv" ], "timeline": [ { "at": "2025-09-26T23:15:31.640", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59845" } ] }, { "id": "CVE-2025-59844", "vendor": "SonarSource", "product": "sonarqube-scan-action", "title": "sonarqube-scan-action vulnerability", "summary": "SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. A command injection vulnerability exists in SonarQube GitHub Action in version 4.0.0 to before version 6.0.0 when workflows pass user-controlled input to the args parameter on Windows runners without proper validation. This vulnerability bypasses a previous security fix and allows arbitrary command execution, potentially leading to exposure of sensitive environment variables and compromise of the runner environment. The vulnerability has been fixed in version 6.0.0. Users should upgrade to this version or later.", "updated_at": "2026-10-09T10:10:00.193", "published_at": "2025-09-26T17:15:36.853", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": ">= 4.0.0, < 6.0.0", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-78", "what_happened": "SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. A command injection vulnerability exists in SonarQube GitHub Action in version 4.0.0 to before version 6.0.0 when workflows pass user-controlled input to the args parameter on Windows runners without proper validation. This vulnerability bypasses a previous security fix and allows arbitrary command execution, potentially leading to exposure of sensitive environment variables and compromise of the runner environment. The vulnerability has been fixed in version 6.0.0. Users should upgrade to this version or later.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://community.sonarsource.com/t/sonarqube-scanner-github-action-v6/149281", "https://github.com/SonarSource/sonarqube-scan-action/releases/tag/v6.0.0", "https://github.com/SonarSource/sonarqube-scan-action/security/advisories/GHSA-5xq9-5g24-4g6f" ], "timeline": [ { "at": "2025-09-26T17:15:36.853", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59844" } ] }, { "id": "CVE-2025-59843", "vendor": "FlagForgeCTF", "product": "flagForge", "title": "flagForge vulnerability", "summary": "Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.2, the public endpoint /api/user/[username] returns user email addresses in its JSON response. The fix, intended for release in 2.3.1 but only available starting in version 2.3.2, removes email addresses from public API responses while keeping the endpoint publicly accessible. Users should upgrade to version 2.3.2 or later to eliminate exposure. There are no workarounds for this vulnerability.", "updated_at": "2026-10-09T10:10:00.193", "published_at": "2025-09-26T16:15:49.090", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": ">= 2.0.0, < 2.3.2", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-359", "what_happened": "Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.2, the public endpoint /api/user/[username] returns user email addresses in its JSON response. The fix, intended for release in 2.3.1 but only available starting in version 2.3.2, removes email addresses from public API responses while keeping the endpoint publicly accessible. Users should upgrade to version 2.3.2 or later to eliminate exposure. There are no workarounds for this vulnerability.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/FlagForgeCTF/flagForge/commit/1b033f1b6e20fbf6df422d5d1afc9b2347528ace", "https://github.com/FlagForgeCTF/flagForge/compare/v2.3.1...v2.3.2", "https://github.com/FlagForgeCTF/flagForge/releases/tag/v2.3.1", "https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-qqjv-8r5p-7xpj" ], "timeline": [ { "at": "2025-09-26T16:15:49.090", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59843" } ] }, { "id": "CVE-2025-59838", "vendor": "monkeytypegame", "product": "monkeytype", "title": "monkeytype vulnerability", "summary": "Monkeytype is a minimalistic and customizable typing test. In versions 25.36.0 and prior, improper handling of user input when loading a saved custom text results in XSS. This issue has been fixed in version 25.44.0.", "updated_at": "2026-10-13T16:17:08.897", "published_at": "2025-09-25T15:16:14.390", "cvss": 2.4, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 100, "confidence_label": "verified", "affected": "< 25.44.0", "fixed": "See vendor advisory", "source_count": 26, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Monkeytype is a minimalistic and customizable typing test. In versions 25.36.0 and prior, improper handling of user input when loading a saved custom text results in XSS. This issue has been fixed in version 25.44.0.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-09-25", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/monkeytypegame/monkeytype/security/advisories/GHSA-j4xx-fww5-774w" } ], "references": [ "https://github.com/monkeytypegame/monkeytype/commit/42f6a16c6255d66cbb2be279131454866d98f2c9", "https://github.com/monkeytypegame/monkeytype/commit/f025b121cbe437e29de432b4aa72e0de22c755b7", "https://github.com/monkeytypegame/monkeytype/releases/tag/v25.44.0", "https://github.com/monkeytypegame/monkeytype/security/advisories/GHSA-j4xx-fww5-774w" ], "timeline": [ { "at": "2025-09-25T15:16:14.390", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59838" } ] }, { "id": "CVE-2025-59788", "vendor": "Nextcloud", "product": "Nextcloud", "title": "Nextcloud vulnerability", "summary": "Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted PDF file to viewer.html. This issue is related to CVE-2024-4367, but the root cause of this Nextcloud issue is that the product exposes executable example code on a same-origin basis.", "updated_at": "2026-10-18T15:10:00.097", "published_at": "2025-12-04T19:16:04.380", "cvss": 6.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "confidence": 100, "confidence_label": "verified", "affected": "before 22.2.10.33 (custom); 23 through before 23.0.12.29 (custom); 24 through before 24.0.12.28 (custom); 25 through before 25.0.13.23 (custom); 26 through before 26.0.13.20 (custom); 27 through before 27.1.11.20 (custom); 28 through before 28.0.14.11 (custom); 29 through before 29.0.16.8 (custom); 30 through before 30.0.17 (custom); 31 through before 31.0.10 (custom); 32 through before 32.0.1 (custom)", "fixed": "See vendor advisory", "source_count": 10, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-749", "what_happened": "Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted PDF file to viewer.html. This issue is related to CVE-2024-4367, but the root cause of this Nextcloud issue is that the product exposes executable example code on a same-origin basis.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "www.redteam-pentesting.de", "author": "NVD reference", "first_seen": "2025-12-04", "confidence": "High", "verification": "verified", "verified": true, "url": "https://www.redteam-pentesting.de/en/advisories/rt-sa-2025-003/" } ], "references": [ "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-24wp-p865-7j4r", "https://nextcloud.com", "https://www.redteam-pentesting.de/en/advisories/rt-sa-2025-003/" ], "timeline": [ { "at": "2025-12-04T19:16:04.380", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59788" } ] }, { "id": "CVE-2025-59760", "vendor": "AndSoft", "product": "e-TMS", "title": "e-TMS vulnerability", "summary": "Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_DHL.ASP'.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T15:15:56.367", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "v25.03 version", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_DHL.ASP'.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms" ], "timeline": [ { "at": "2025-10-02T15:15:56.367", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59760" } ] }, { "id": "CVE-2025-59759", "vendor": "AndSoft", "product": "e-TMS", "title": "e-TMS vulnerability", "summary": "Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_DELCROIX.ASP'.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T15:15:56.220", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "v25.03 version", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_DELCROIX.ASP'.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms" ], "timeline": [ { "at": "2025-10-02T15:15:56.220", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59759" } ] }, { "id": "CVE-2025-59758", "vendor": "AndSoft", "product": "e-TMS", "title": "e-TMS vulnerability", "summary": "Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_CYLOG.ASP'.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T15:15:56.073", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "v25.03 version", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_CYLOG.ASP'.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms" ], "timeline": [ { "at": "2025-10-02T15:15:56.073", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59758" } ] }, { "id": "CVE-2025-59757", "vendor": "AndSoft", "product": "e-TMS", "title": "e-TMS vulnerability", "summary": "Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_CATOLD.ASP'.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T15:15:55.930", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "v25.03 version", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_CATOLD.ASP'.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms" ], "timeline": [ { "at": "2025-10-02T15:15:55.930", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59757" } ] }, { "id": "CVE-2025-59756", "vendor": "AndSoft", "product": "e-TMS", "title": "e-TMS vulnerability", "summary": "Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in 'SuppConn in /clt/LOGINFRM_CON.ASP'.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T15:15:55.777", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "v25.03 version", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in 'SuppConn in /clt/LOGINFRM_CON.ASP'.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms" ], "timeline": [ { "at": "2025-10-02T15:15:55.777", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59756" } ] }, { "id": "CVE-2025-59755", "vendor": "AndSoft", "product": "e-TMS", "title": "e-TMS vulnerability", "summary": "Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_CAT.ASP'.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T15:15:55.633", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "v25.03 version", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_CAT.ASP'.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms" ], "timeline": [ { "at": "2025-10-02T15:15:55.633", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59755" } ] }, { "id": "CVE-2025-59754", "vendor": "AndSoft", "product": "e-TMS", "title": "e-TMS vulnerability", "summary": "Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_original.ASP'.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T15:15:55.493", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "v25.03 version", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_original.ASP'.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms" ], "timeline": [ { "at": "2025-10-02T15:15:55.493", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59754" } ] }, { "id": "CVE-2025-59753", "vendor": "AndSoft", "product": "e-TMS", "title": "e-TMS vulnerability", "summary": "Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_BET.ASP'.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T15:15:55.343", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "v25.03 version", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_BET.ASP'.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms" ], "timeline": [ { "at": "2025-10-02T15:15:55.343", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59753" } ] }, { "id": "CVE-2025-59752", "vendor": "AndSoft", "product": "e-TMS", "title": "e-TMS vulnerability", "summary": "Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_LXA.ASP'.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T15:15:55.177", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "v25.03 version", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_LXA.ASP'.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms" ], "timeline": [ { "at": "2025-10-02T15:15:55.177", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59752" } ] }, { "id": "CVE-2025-59751", "vendor": "AndSoft", "product": "e-TMS", "title": "e-TMS vulnerability", "summary": "Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_DJO.ASP'.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T15:15:55.030", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "v25.03 version", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_DJO.ASP'.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms" ], "timeline": [ { "at": "2025-10-02T15:15:55.030", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59751" } ] }, { "id": "CVE-2025-59750", "vendor": "AndSoft", "product": "e-TMS", "title": "e-TMS vulnerability", "summary": "Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM.ASP'.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T15:15:54.870", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "v25.03 version", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM.ASP'.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms" ], "timeline": [ { "at": "2025-10-02T15:15:54.870", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59750" } ] }, { "id": "CVE-2025-59749", "vendor": "AndSoft", "product": "e-TMS", "title": "e-TMS vulnerability", "summary": "Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l' parameter in '/clt/TRACK_REQUEST.ASP'.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T15:15:54.727", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "v25.03 version", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l' parameter in '/clt/TRACK_REQUEST.ASP'.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms" ], "timeline": [ { "at": "2025-10-02T15:15:54.727", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59749" } ] }, { "id": "CVE-2025-59748", "vendor": "AndSoft", "product": "e-TMS", "title": "e-TMS vulnerability", "summary": "Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l' and 'reset' parameters in '/clt/changepassword.asp'.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T15:15:54.580", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "v25.03 version", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l' and 'reset' parameters in '/clt/changepassword.asp'.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms" ], "timeline": [ { "at": "2025-10-02T15:15:54.580", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59748" } ] }, { "id": "CVE-2025-59747", "vendor": "AndSoft", "product": "e-TMS", "title": "e-TMS vulnerability", "summary": "Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l' parameter in '/clt/resetPassword.asp'.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T15:15:54.433", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "v25.03 version", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l' parameter in '/clt/resetPassword.asp'.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms" ], "timeline": [ { "at": "2025-10-02T15:15:54.433", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59747" } ] }, { "id": "CVE-2025-59746", "vendor": "AndSoft", "product": "e-TMS", "title": "e-TMS vulnerability", "summary": "Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'm' parameter in '/lib/asp/alert.asp'.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T15:15:54.287", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "v25.03 version", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'm' parameter in '/lib/asp/alert.asp'.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms" ], "timeline": [ { "at": "2025-10-02T15:15:54.287", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59746" } ] }, { "id": "CVE-2025-59745", "vendor": "AndSoft", "product": "e-TMS", "title": "e-TMS vulnerability", "summary": "Vulnerability in the cryptographic algorithm of AndSoft's e-TMS v25.03, which uses MD5 to encrypt passwords. MD5 is a cryptographically vulnerable hash algorithm and is no longer considered secure for storing or transmitting passwords. It is vulnerable to collision attacks and can be easily cracked with modern hardware, exposing user credentials to potential risks.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T15:15:54.130", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "v25.03 version", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-327", "what_happened": "Vulnerability in the cryptographic algorithm of AndSoft's e-TMS v25.03, which uses MD5 to encrypt passwords. MD5 is a cryptographically vulnerable hash algorithm and is no longer considered secure for storing or transmitting passwords. It is vulnerable to collision attacks and can be easily cracked with modern hardware, exposing user credentials to potential risks.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms" ], "timeline": [ { "at": "2025-10-02T15:15:54.130", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59745" } ] }, { "id": "CVE-2025-59744", "vendor": "AndSoft", "product": "e-TMS", "title": "e-TMS vulnerability", "summary": "Path traversal vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to access files only within the web root using the “docurl” parameter in “/lib/asp/DOCSAVEASASP.ASP”.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T15:15:53.983", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "v25.03 version", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-22", "what_happened": "Path traversal vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to access files only within the web root using the “docurl” parameter in “/lib/asp/DOCSAVEASASP.ASP”.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms" ], "timeline": [ { "at": "2025-10-02T15:15:53.983", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59744" } ] }, { "id": "CVE-2025-59743", "vendor": "AndSoft", "product": "e-TMS", "title": "e-TMS vulnerability", "summary": "SQL injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability could allow an attacker to retrieve, create, update, and delete databases by sending a POST request. The relationship between parameter and assigned identifier is a 'SessionID' cookie in '/inc/connect/CONNECTION.ASP'.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T15:15:53.837", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "v25.03 version", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-89", "what_happened": "SQL injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability could allow an attacker to retrieve, create, update, and delete databases by sending a POST request. The relationship between parameter and assigned identifier is a 'SessionID' cookie in '/inc/connect/CONNECTION.ASP'.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms" ], "timeline": [ { "at": "2025-10-02T15:15:53.837", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59743" } ] }, { "id": "CVE-2025-59742", "vendor": "AndSoft", "product": "e-TMS", "title": "e-TMS vulnerability", "summary": "SQL injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability could allow an attacker to retrieve, create, update, and delete databases by sending a POST request. The relationship between parameter and assigned identifier is a 'USRMAIL' parameter in'/inc/login/TRACK_REQUESTFRMSQL.ASP'.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T15:15:53.680", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "v25.03 version", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-89", "what_happened": "SQL injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability could allow an attacker to retrieve, create, update, and delete databases by sending a POST request. The relationship between parameter and assigned identifier is a 'USRMAIL' parameter in'/inc/login/TRACK_REQUESTFRMSQL.ASP'.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms" ], "timeline": [ { "at": "2025-10-02T15:15:53.680", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59742" } ] }, { "id": "CVE-2025-59741", "vendor": "AndSoft", "product": "e-TMS", "title": "e-TMS vulnerability", "summary": "Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/CLT/LOGINERRORFRM.ASP'.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T15:15:53.527", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "v25.03 version", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-77", "what_happened": "Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/CLT/LOGINERRORFRM.ASP'.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms" ], "timeline": [ { "at": "2025-10-02T15:15:53.527", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59741" } ] }, { "id": "CVE-2025-59740", "vendor": "AndSoft", "product": "e-TMS", "title": "e-TMS vulnerability", "summary": "Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/clt/LOGINFRM_CAT.ASP'.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T14:15:46.763", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "v25.03 version", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-77", "what_happened": "Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/clt/LOGINFRM_CAT.ASP'.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms" ], "timeline": [ { "at": "2025-10-02T14:15:46.763", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59740" } ] }, { "id": "CVE-2025-59739", "vendor": "AndSoft", "product": "e-TMS", "title": "e-TMS vulnerability", "summary": "Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/clt/LOGINFRM_original.ASP'.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T14:15:46.610", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "v25.03 version", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-77", "what_happened": "Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/clt/LOGINFRM_original.ASP'.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms" ], "timeline": [ { "at": "2025-10-02T14:15:46.610", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59739" } ] }, { "id": "CVE-2025-59738", "vendor": "AndSoft", "product": "e-TMS", "title": "e-TMS vulnerability", "summary": "Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/clt/LOGINFRM_BET.ASP'.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T14:15:46.463", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "v25.03 version", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-77", "what_happened": "Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/clt/LOGINFRM_BET.ASP'.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms" ], "timeline": [ { "at": "2025-10-02T14:15:46.463", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59738" } ] }, { "id": "CVE-2025-59737", "vendor": "AndSoft", "product": "e-TMS", "title": "e-TMS vulnerability", "summary": "Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/clt/LOGINFRM_LXA.ASP'.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T14:15:46.317", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "v25.03 version", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-77", "what_happened": "Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/clt/LOGINFRM_LXA.ASP'.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms" ], "timeline": [ { "at": "2025-10-02T14:15:46.317", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59737" } ] }, { "id": "CVE-2025-59736", "vendor": "AndSoft", "product": "e-TMS", "title": "e-TMS vulnerability", "summary": "Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/clt/LOGINFRM_DJO.ASP'.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T14:15:46.173", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "v25.03 version", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-77", "what_happened": "Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/clt/LOGINFRM_DJO.ASP'.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms" ], "timeline": [ { "at": "2025-10-02T14:15:46.173", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59736" } ] }, { "id": "CVE-2025-59735", "vendor": "AndSoft", "product": "e-TMS", "title": "e-TMS vulnerability", "summary": "Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/clt/LOGINFRM.ASP'.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-02T14:15:46.020", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "v25.03 version", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-77", "what_happened": "Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/clt/LOGINFRM.ASP'.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms" ], "timeline": [ { "at": "2025-10-02T14:15:46.020", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59735" } ] }, { "id": "CVE-2025-59682", "vendor": "djangoproject", "product": "Django", "title": "Django vulnerability", "summary": "An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the \"startapp --template\" and \"startproject --template\" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-01T19:15:37.007", "cvss": 3.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "4.2 through before 4.2.25 (custom); 5.1 through before 5.1.13 (custom); 5.2 through before 5.2.7 (custom)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "High", "cwe": "CWE-23", "what_happened": "An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the \"startapp --template\" and \"startproject --template\" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://docs.djangoproject.com/en/dev/releases/security/", "https://groups.google.com/g/django-announce", "https://www.djangoproject.com/weblog/2025/oct/01/security-releases/", "http://www.openwall.com/lists/oss-security/2025/10/01/3" ], "timeline": [ { "at": "2025-10-01T19:15:37.007", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59682" } ] }, { "id": "CVE-2025-59681", "vendor": "djangoproject", "product": "Django", "title": "Django vulnerability", "summary": "An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-01T19:15:36.487", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N", "confidence": 35, "confidence_label": "observed", "affected": "4.2 through before 4.2.25 (custom); 5.1 through before 5.1.13 (custom); 5.2 through before 5.2.7 (custom)", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "High", "cwe": "CWE-89", "what_happened": "An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://docs.djangoproject.com/en/dev/releases/security/", "https://groups.google.com/g/django-announce", "https://www.djangoproject.com/weblog/2025/oct/01/security-releases/", "http://www.openwall.com/lists/oss-security/2025/10/01/3" ], "timeline": [ { "at": "2025-10-01T19:15:36.487", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59681" } ] }, { "id": "CVE-2025-59617", "vendor": "Qualcomm, Inc.", "product": "Snapdragon", "title": "Snapdragon vulnerability", "summary": "Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input.", "updated_at": "2026-09-29T19:10:00.160", "published_at": "2026-07-06T21:16:52.653", "cvss": 6.6, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L", "confidence": 35, "confidence_label": "observed", "affected": "FastConnect 6700; FastConnect 6900; FastConnect 7800; Molokai; Orne; Pandeiro; QCM5430; QCM6490; QMP1000; QMP2001; Qualcomm Video Collaboration VC3 Platform; SC8380XP; SD865 5G; SM6850; SM8845P; Snapdragon 460 Mobile Platform; Snapdragon 662 Mobile Platform; Snapdragon 8 Elite Gen 5; Snapdragon AR1 Gen 1 Platform; Snapdragon XR2 5G Platform; Snapdragon XR2+ Gen 1 Platform; SXR2230P; SXR2250P; WCD9370; WCD9375; WCD9378; WCD9380; WCD9385; WCD9395; WCN3950; WCN3988; WCN6450; WCN7760; WCN7860; WCN7861; WCN7880; WCN7881; WSA8810; WSA8815; WSA8830; WSA8832; WSA8835; WSA8840; WSA8845; WSA8845H; WSA8850; WSA8850W; WSA8855C", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "High", "cwe": "CWE-416", "what_happened": "Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2026-bulletin.html" ], "timeline": [ { "at": "2026-07-06T21:16:52.653", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59617" } ] }, { "id": "CVE-2025-59616", "vendor": "Qualcomm, Inc.", "product": "Snapdragon", "title": "Snapdragon vulnerability", "summary": "Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input due to accessing already freed memory.", "updated_at": "2026-09-29T19:10:00.160", "published_at": "2026-07-06T21:16:52.513", "cvss": 6.6, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L", "confidence": 35, "confidence_label": "observed", "affected": "FastConnect 6700; FastConnect 6900; FastConnect 7800; Molokai; Orne; Pandeiro; QCM5430; QCM6490; QMP1000; QMP2001; Qualcomm Video Collaboration VC3 Platform; SC8380XP; SD865 5G; SM6850; SM8845P; Snapdragon 460 Mobile Platform; Snapdragon 662 Mobile Platform; Snapdragon 8 Elite Gen 5; Snapdragon AR1 Gen 1 Platform; Snapdragon XR2 5G Platform; Snapdragon XR2+ Gen 1 Platform; SXR2230P; SXR2250P; WCD9370; WCD9375; WCD9378; WCD9380; WCD9385; WCD9395; WCN3950; WCN3988; WCN6450; WCN7760; WCN7860; WCN7861; WCN7880; WCN7881; WSA8810; WSA8815; WSA8830; WSA8832; WSA8835; WSA8840; WSA8845; WSA8845H; WSA8850; WSA8850W; WSA8855C", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "High", "cwe": "CWE-416", "what_happened": "Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input due to accessing already freed memory.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2026-bulletin.html" ], "timeline": [ { "at": "2026-07-06T21:16:52.513", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59616" } ] }, { "id": "CVE-2025-59615", "vendor": "Qualcomm, Inc.", "product": "Snapdragon", "title": "Snapdragon vulnerability", "summary": "Memory Corruption when invoking device input/output control operations for mapping and unmapping persistent memory buffers due to improper synchronization.", "updated_at": "2026-09-29T19:10:00.160", "published_at": "2026-07-06T21:16:52.077", "cvss": 6.6, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L", "confidence": 35, "confidence_label": "observed", "affected": "FastConnect 6700; FastConnect 6900; FastConnect 7800; Molokai; Orne; Pandeiro; QCM5430; QCM6490; QLN1083BD; QLN1086BD; QMP1000; QMP2001; QPA1083BD; QPA1086BD; Qualcomm Video Collaboration VC3 Platform; QXM1093; QXM1094; QXM1095; QXM1096; SC8380XP; SD865 5G; SM6850; SM8845P; Snapdragon 460 Mobile Platform; Snapdragon 662 Mobile Platform; Snapdragon 8 Elite Gen 5; Snapdragon AR1 Gen 1 Platform; Snapdragon XR2 5G Platform; Snapdragon XR2+ Gen 1 Platform; SXR2230P; SXR2250P; SXR2330P; SXR2350P; WCD9370; WCD9375; WCD9378; WCD9380; WCD9385; WCD9395; WCN3950; WCN3988; WCN6450; WCN7760; WCN7860; WCN7861; WCN7880; WCN7881; WSA8810; WSA8815; WSA8830; WSA8832; WSA8835; WSA8840; WSA8845; WSA8845H; WSA8850; WSA8850W; WSA8855C; XRV7209; XRV9209", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "High", "cwe": "CWE-416", "what_happened": "Memory Corruption when invoking device input/output control operations for mapping and unmapping persistent memory buffers due to improper synchronization.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2026-bulletin.html" ], "timeline": [ { "at": "2026-07-06T21:16:52.077", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59615" } ] }, { "id": "CVE-2025-59563", "vendor": "SONAAR MUSIC", "product": "Sonaar", "title": "Sonaar vulnerability", "summary": "Subscriber Privilege Escalation in Sonaar <= 4.27.4 versions.", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-06-17T13:19:15.057", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "n/a through 4.27.4 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "Low", "complexity": "Low", "cwe": "CWE-266", "what_happened": "Subscriber Privilege Escalation in Sonaar <= 4.27.4 versions.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/theme/sonaar/vulnerability/wordpress-sonaar-theme-4-27-4-privilege-escalation-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-06-17T13:19:15.057", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59563" } ] }, { "id": "CVE-2025-59560", "vendor": "SONAAR MUSIC", "product": "Sonaar", "title": "Sonaar vulnerability", "summary": "Unauthenticated Cross Site Scripting (XSS) in Sonaar <= 4.27.4 versions.", "updated_at": "2026-10-12T22:10:00.247", "published_at": "2026-06-17T13:19:14.927", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "confidence": 35, "confidence_label": "observed", "affected": "n/a through 4.27.4 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Unauthenticated Cross Site Scripting (XSS) in Sonaar <= 4.27.4 versions.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://patchstack.com/database/wordpress/theme/sonaar/vulnerability/wordpress-sonaar-theme-4-27-4-cross-site-scripting-xss-vulnerability?_s_id=cve" ], "timeline": [ { "at": "2026-06-17T13:19:14.927", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59560" } ] }, { "id": "CVE-2025-59538", "vendor": "argoproj", "product": "argo-cd", "title": "argo-cd vulnerability", "summary": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and 3.0.17, when the webhook.azuredevops.username and webhook.azuredevops.password are not set in the default configuration, the /api/webhook endpoint crashes the entire argocd-server process when it receives an Azure DevOps Push event whose JSON array resource.refUpdates is empty. The slice index [0] is accessed without a length check, causing an index-out-of-range panic. A single unauthenticated HTTP POST is enough to kill the process. This issue is resolved in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-01T21:16:43.800", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "confidence": 100, "confidence_label": "verified", "affected": ">= 2.9.0-rc1, < 2.14.20; >= 3.2.0-rc1, < 3.2.0-rc2; >= 3.1.0-rc1, < 3.1.8; >= 3.0.0-rc1, < 3.0.19", "fixed": "See vendor advisory", "source_count": 27, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-248", "what_happened": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and 3.0.17, when the webhook.azuredevops.username and webhook.azuredevops.password are not set in the default configuration, the /api/webhook endpoint crashes the entire argocd-server process when it receives an Azure DevOps Push event whose JSON array resource.refUpdates is empty. The slice index [0] is accessed without a length check, causing an index-out-of-range panic. A single unauthenticated HTTP POST is enough to kill the process. This issue is resolved in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-10-01", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-gpx4-37g2-c8pv" } ], "references": [ "https://github.com/argoproj/argo-cd/commit/1a023f1ca7fe4ec942b4b6696804988d5a632baf", "https://github.com/argoproj/argo-cd/security/advisories/GHSA-gpx4-37g2-c8pv" ], "timeline": [ { "at": "2025-10-01T21:16:43.800", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59538" } ] }, { "id": "CVE-2025-59537", "vendor": "argoproj", "product": "argo-cd", "title": "argo-cd vulnerability", "summary": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients. With the default configuration, no webhook.gogs.secret set, Argo CD’s /api/webhook endpoint will crash the entire argocd-server process when it receives a Gogs push event whose JSON field commits[].repo is not set or is null. This issue is fixed in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-01T21:16:43.577", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "confidence": 100, "confidence_label": "verified", "affected": ">= 1.2.0, <= 1.8.7; >= 2.0.0-rc1, < 2.14.20; >= 3.2.0-rc1, < 3.2.0-rc2; >= 3.1.0-rc1, < 3.1.8; >= 3.0.0-rc1, < 3.0.19", "fixed": "See vendor advisory", "source_count": 27, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-20", "what_happened": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients. With the default configuration, no webhook.gogs.secret set, Argo CD’s /api/webhook endpoint will crash the entire argocd-server process when it receives a Gogs push event whose JSON field commits[].repo is not set or is null. This issue is fixed in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-10-01", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-wp4p-9pxh-cgx2" } ], "references": [ "https://github.com/argoproj/argo-cd/commit/761fc27068d2d4cd24e1f784eb2a9033b5ee7f43", "https://github.com/argoproj/argo-cd/security/advisories/GHSA-wp4p-9pxh-cgx2" ], "timeline": [ { "at": "2025-10-01T21:16:43.577", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59537" } ] }, { "id": "CVE-2025-59531", "vendor": "argoproj", "product": "argo-cd", "title": "argo-cd vulnerability", "summary": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients. Without a configured webhook.bitbucketserver.secret, Argo CD's /api/webhook endpoint crashes when receiving a malformed Bitbucket Server payload (non-array repository.links.clone field). A single unauthenticated request triggers CrashLoopBackOff, and targeting all replicas causes complete API outage. This issue is fixed in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-01T21:16:43.377", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "confidence": 100, "confidence_label": "verified", "affected": ">= 1.2.0, <= 1.8.7; >= 2.0.0-rc1, < 2.14.20; >= 3.2.0-rc1, < 3.2.0-rc2; >= 3.1.0-rc1, < 3.1.8; >= 3.0.0-rc1, < 3.0.19", "fixed": "See vendor advisory", "source_count": 27, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-703", "what_happened": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients. Without a configured webhook.bitbucketserver.secret, Argo CD's /api/webhook endpoint crashes when receiving a malformed Bitbucket Server payload (non-array repository.links.clone field). A single unauthenticated request triggers CrashLoopBackOff, and targeting all replicas causes complete API outage. This issue is fixed in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "github.com", "author": "NVD reference", "first_seen": "2025-10-01", "confidence": "High", "verification": "verified", "verified": true, "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-f9gq-prrc-hrhc" } ], "references": [ "https://github.com/argoproj/argo-cd/commit/5c466a4e39802e059e75c0008ae7b7b8e842538f", "https://github.com/argoproj/argo-cd/security/advisories/GHSA-f9gq-prrc-hrhc" ], "timeline": [ { "at": "2025-10-01T21:16:43.377", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59531" } ] }, { "id": "CVE-2025-59528", "vendor": "Unknown vendor", "product": "Unknown product", "title": "Flowise 3.0.4 - Remote Code Execution (RCE)", "summary": "Flowise 3.0.4 - Remote Code Execution (RCE)", "updated_at": "2026-09-30T16:46:38Z", "published_at": "2026-09-30T16:46:38Z", "cvss": 10, "confidence": 100, "confidence_label": "verified", "affected": "See original advisory", "fixed": "See vendor advisory", "source_count": 272, "kev": false, "attack_vector": "Unknown", "authentication": "Unknown", "complexity": "Unknown", "cwe": "Unknown", "what_happened": "Flowise AI allows remote code execution via MCP Server Configuration Injection.", "why_matters": "This source correlation may provide earlier visibility while structured CVE metadata is still being updated.", "mitigations": [ "Review the original advisory and validate affected versions.", "Apply vendor-provided updates or mitigations when available." ], "pocs": [ { "repository": "Exploit-DB 52440", "author": "nltt0", "first_seen": "2025-10-31", "confidence": "High", "title": "Flowise 3.0.4 - Remote Code Execution (RCE)", "summary": "Flowise 3.0.4 - Remote Code Execution (RCE)", "url": "https://www.exploit-db.com/exploits/52440", "verification": "verified", "verified": true }, { "title": "Exploit for Code Injection in Flowiseai Flowise CVE-2025-59528", "summary": "Flowise AI allows remote code execution via MCP Server Configuration Injection.", "what_happened": "Flowise AI allows remote code execution via MCP Server Configuration Injection.", "cvss": 10, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=F6CE9614-1DB3-5603-9BA8-CDF5F1CEE0E8", "https://github.com/Amoru-Bek/CVE-2025-59528-Poc" ], "repository": "Sploitus", "author": "Amoru-Bek", "first_seen": "2026-09-30T16:58:22", "confidence": "High", "verification": "verified", "verified": true, "verification_detail": "Sploitus reports working code with at least 90% confidence.", "url": "https://sploitus.com/exploit?id=F6CE9614-1DB3-5603-9BA8-CDF5F1CEE0E8" }, { "title": "Exploit for Code Injection in Flowiseai Flowise CVE-2025-59528", "summary": "Flowise AI allows remote code execution via MCP Server Configuration Injection.", "what_happened": "Flowise AI allows remote code execution via MCP Server Configuration Injection.", "cvss": 10, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "Unknown", "references": [ "https://sploitus.com/exploit?id=F6CE9614-1DB3-5603-9BA8-CDF5F1CEE0E8", "https://github.com/Amoru-Bek/CVE-2025-59528-Poc" ], "repository": "Amoru-Bek/CVE-2025-59528-Poc", "author": "Amoru-Bek", "first_seen": "2026-09-30T16:58:22", "confidence": "High", "verification": "verified", "verified": true, "verification_detail": "Linked by a Sploitus working-code assessment.", "url": "https://github.com/Amoru-Bek/CVE-2025-59528-Poc" } ], "references": [ "https://www.exploit-db.com/exploits/52440", "https://sploitus.com/exploit?id=F6CE9614-1DB3-5603-9BA8-CDF5F1CEE0E8", "https://github.com/Amoru-Bek/CVE-2025-59528-Poc" ], "timeline": [ { "at": "2026-09-30T16:46:38Z", "label": "Discovered through Exploit-DB", "url": "https://www.exploit-db.com/exploits/52440" } ] }, { "id": "CVE-2025-59517", "vendor": "Microsoft", "product": "Windows 10 Version 1607", "title": "Windows 10 Version 1607 vulnerability", "summary": "Improper access control in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.", "updated_at": "2026-10-07T11:10:00.153", "published_at": "2025-12-09T18:15:54.810", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "10.0.14393.0 through before 10.0.14393.8688 (custom); 10.0.17763.0 through before 10.0.17763.8146 (custom); 10.0.19044.0 through before 10.0.19044.6691 (custom); 10.0.19045.0 through before 10.0.19045.6691 (custom); 10.0.22631.0 through before 10.0.22631.6345 (custom); 10.0.26100.0 through before 10.0.26100.7462 (custom); 10.0.26200.0 through before 10.0.26200.7462 (custom); 10.0.20348.0 through before 10.0.20348.4529 (custom); 10.0.25398.0 through before 10.0.25398.2025 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-284", "what_happened": "Improper access control in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59517" ], "timeline": [ { "at": "2025-12-09T18:15:54.810", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59517" } ] }, { "id": "CVE-2025-59516", "vendor": "Microsoft", "product": "Windows 10 Version 1809", "title": "Windows 10 Version 1809 vulnerability", "summary": "Missing authentication for critical function in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.", "updated_at": "2026-10-07T11:10:00.153", "published_at": "2025-12-09T18:15:54.640", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "confidence": 35, "confidence_label": "observed", "affected": "10.0.17763.0 through before 10.0.17763.8146 (custom); 10.0.19044.0 through before 10.0.19044.6691 (custom); 10.0.19045.0 through before 10.0.19045.6691 (custom); 10.0.22631.0 through before 10.0.22631.6345 (custom); 10.0.26100.0 through before 10.0.26100.7462 (custom); 10.0.26200.0 through before 10.0.26200.7462 (custom); 10.0.20348.0 through before 10.0.20348.4529 (custom); 10.0.25398.0 through before 10.0.25398.2025 (custom)", "fixed": "See vendor advisory", "source_count": 1, "kev": false, "attack_vector": "Local", "authentication": "Low", "complexity": "Low", "cwe": "CWE-73", "what_happened": "Missing authentication for critical function in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59516" ], "timeline": [ { "at": "2025-12-09T18:15:54.640", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59516" } ] }, { "id": "CVE-2025-59430", "vendor": "FrontFin", "product": "mesh-web-sdk", "title": "mesh-web-sdk vulnerability", "summary": "Mesh Connect JS SDK contains JS libraries for integrating with Mesh Connect. Prior to version 3.3.2, the lack of sanitization of URLs protocols in the createLink.openLink function enables the execution of arbitrary JavaScript code within the context of the parent page. This is technically indistinguishable from a real page at the rendering level and allows access to the parent page DOM, storage, session, and cookies. If the attacker can specify customIframeId, they can hijack the source of existing iframes. This issue has been patched in version 3.3.2.", "updated_at": "2026-10-01T16:10:00.257", "published_at": "2025-09-22T19:16:23.330", "cvss": 8.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "< 3.3.2", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-79", "what_happened": "Mesh Connect JS SDK contains JS libraries for integrating with Mesh Connect. Prior to version 3.3.2, the lack of sanitization of URLs protocols in the createLink.openLink function enables the execution of arbitrary JavaScript code within the context of the parent page. This is technically indistinguishable from a real page at the rendering level and allows access to the parent page DOM, storage, session, and cookies. If the attacker can specify customIframeId, they can hijack the source of existing iframes. This issue has been patched in version 3.3.2.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/FrontFin/mesh-web-sdk/blob/cf013b85ab95d64c63cbe46d6cb14695474924e7/packages/link/src/Link.ts#L441", "https://github.com/FrontFin/mesh-web-sdk/commit/7f22148516d58e21a8b7670dde927d614c0d15c2", "https://github.com/FrontFin/mesh-web-sdk/pull/124", "https://github.com/FrontFin/mesh-web-sdk/security/advisories/GHSA-vh3f-qppr-j97f" ], "timeline": [ { "at": "2025-09-22T19:16:23.330", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59430" } ] }, { "id": "CVE-2025-59163", "vendor": "safedep", "product": "vet", "title": "vet vulnerability", "summary": "vet is an open source software supply chain security tool. Versions 1.12.4 and below are vulnerable to a DNS rebinding attack due to lack of HTTP Host and Origin header validation. Data from the vet scan sqlite3 database may be exposed to remote attackers when vet is used as an MCP server in SSE mode with default ports through the sqlite3 query MCP tool. This issue is fixed in version 1.12.5.", "updated_at": "2026-10-09T09:10:00.213", "published_at": "2025-09-29T22:15:36.610", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "< 1.12.5", "fixed": "See vendor advisory", "source_count": 3, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "High", "cwe": "CWE-350", "what_happened": "vet is an open source software supply chain security tool. Versions 1.12.4 and below are vulnerable to a DNS rebinding attack due to lack of HTTP Host and Origin header validation. Data from the vet scan sqlite3 database may be exposed to remote attackers when vet is used as an MCP server in SSE mode with default ports through the sqlite3 query MCP tool. This issue is fixed in version 1.12.5.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/safedep/vet/commit/0ae3560ba11846375812377299fe078d45cc3d48", "https://github.com/safedep/vet/releases/tag/v1.12.5", "https://github.com/safedep/vet/security/advisories/GHSA-6q9c-m9fr-865m" ], "timeline": [ { "at": "2025-09-29T22:15:36.610", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59163" } ] }, { "id": "CVE-2025-59161", "vendor": "element-hq", "product": "element-web", "title": "element-web vulnerability", "summary": "Element Web is a Matrix web client built using the Matrix React SDK. Element Web and Element Desktop before version 1.11.112 have insufficient validation of room predecessor links, allowing a remote attacker to attempt to impermanently replace a room's entry in the room list with an unrelated attacker-supplied room. While the effect of this is temporary, it may still confuse users into acting on incorrect assumptions. The issue has been patched and users should upgrade to 1.11.112. A reload/refresh will fix the incorrect room list state, removing the attacker's room and restoring the original room.", "updated_at": "2026-10-01T16:10:00.257", "published_at": "2025-09-16T17:15:41.747", "cvss": 2.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "confidence": 35, "confidence_label": "observed", "affected": "< 1.11.112", "fixed": "See vendor advisory", "source_count": 2, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-20", "what_happened": "Element Web is a Matrix web client built using the Matrix React SDK. Element Web and Element Desktop before version 1.11.112 have insufficient validation of room predecessor links, allowing a remote attacker to attempt to impermanently replace a room's entry in the room list with an unrelated attacker-supplied room. While the effect of this is temporary, it may still confuse users into acting on incorrect assumptions. The issue has been patched and users should upgrade to 1.11.112. A reload/refresh will fix the incorrect room list state, removing the attacker's room and restoring the original room.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://github.com/element-hq/element-web/commit/8e9a43d70c90e6a3b110cd0a377296079e4c81f5", "https://github.com/element-hq/element-web/security/advisories/GHSA-m6c8-98f4-75rr" ], "timeline": [ { "at": "2025-09-16T17:15:41.747", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59161" } ] }, { "id": "CVE-2025-59150", "vendor": "OISF", "product": "suricata", "title": "suricata vulnerability", "summary": "Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Version 8.0.0's usage of the tls.subjectaltname keyword can lead to a segmentation fault when the decoded subjectaltname contains a NULL byte. This issue is fixed in version 8.0.1. To workaround this issue, disable rules using the tls.subjectaltname keyword.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-01T21:16:43.003", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "confidence": 100, "confidence_label": "verified", "affected": ">= 8.0.0, < 8.0.1", "fixed": "See vendor advisory", "source_count": 30, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-476", "what_happened": "Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Version 8.0.0's usage of the tls.subjectaltname keyword can lead to a segmentation fault when the decoded subjectaltname contains a NULL byte. This issue is fixed in version 8.0.1. To workaround this issue, disable rules using the tls.subjectaltname keyword.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [ { "repository": "redmine.openinfosecfoundation.org", "author": "NVD reference", "first_seen": "2025-10-01", "confidence": "High", "verification": "verified", "verified": true, "url": "https://redmine.openinfosecfoundation.org/issues/7881" } ], "references": [ "https://forum.suricata.io/t/suricata-8-0-1-and-7-0-12-released/6018", "https://github.com/OISF/suricata/commit/d590fdfe42e995fd558315f0c24f9a352e21479d", "https://github.com/OISF/suricata/security/advisories/GHSA-mhv7-qfmj-m3f3", "https://redmine.openinfosecfoundation.org/issues/7881", "https://www.vicarius.io/vsociety/posts/cve-2025-59150-suricata-detection-script", "https://www.vicarius.io/vsociety/posts/cve-2025-59150-suricata-mitigation-script" ], "timeline": [ { "at": "2025-10-01T21:16:43.003", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59150" } ] }, { "id": "CVE-2025-59149", "vendor": "OISF", "product": "suricata", "title": "suricata vulnerability", "summary": "Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In version 8.0.0, rules using keyword ldap.responses.attribute_type (which is long) with transforms can lead to a stack buffer overflow during Suricata startup or during a rule reload. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules with ldap.responses.attribute_type and transforms.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-01T20:18:38.703", "cvss": 6.2, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "confidence": 35, "confidence_label": "observed", "affected": ">= 8.0.0, < 8.0.1", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Local", "authentication": "None", "complexity": "Low", "cwe": "CWE-121", "what_happened": "Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In version 8.0.0, rules using keyword ldap.responses.attribute_type (which is long) with transforms can lead to a stack buffer overflow during Suricata startup or during a rule reload. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules with ldap.responses.attribute_type and transforms.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://forum.suricata.io/t/suricata-8-0-1-and-7-0-12-released/6018", "https://github.com/OISF/suricata/commit/38a2cba5c397002047d84645f5ab770ff88020e1", "https://github.com/OISF/suricata/security/advisories/GHSA-vxcg-38x4-gj7j", "https://redmine.openinfosecfoundation.org/issues/7861" ], "timeline": [ { "at": "2025-10-01T20:18:38.703", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59149" } ] }, { "id": "CVE-2025-59148", "vendor": "OISF", "product": "suricata", "title": "suricata vulnerability", "summary": "Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 8.0.0 and below incorrectly handle the entropy keyword when not anchored to a \"sticky\" buffer, which can lead to a segmentation fault. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules using the entropy keyword, or validate they are anchored to a sticky buffer.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-01T20:18:38.480", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "confidence": 35, "confidence_label": "observed", "affected": "< 8.0.1", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-476", "what_happened": "Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 8.0.0 and below incorrectly handle the entropy keyword when not anchored to a \"sticky\" buffer, which can lead to a segmentation fault. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules using the entropy keyword, or validate they are anchored to a sticky buffer.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://forum.suricata.io/t/suricata-8-0-1-and-7-0-12-released/6018", "https://github.com/OISF/suricata/commit/9f32550e18f97ea5d610dd7c36aab0ba142c096c", "https://github.com/OISF/suricata/security/advisories/GHSA-5qf6-92xg-3rr3", "https://redmine.openinfosecfoundation.org/issues/7838" ], "timeline": [ { "at": "2025-10-01T20:18:38.480", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59148" } ] }, { "id": "CVE-2025-59147", "vendor": "OISF", "product": "suricata", "title": "suricata vulnerability", "summary": "Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 7.0.11 and below, as well as 8.0.0, are vulnerable to detection bypass when crafted traffic sends multiple SYN packets with different sequence numbers within the same flow tuple, which can cause Suricata to fail to pick up the TCP session. In IDS mode this can lead to a detection and logging bypass. In IPS mode this will lead to the flow getting blocked. This issue is fixed in versions 7.0.12 and 8.0.1.", "updated_at": "2026-10-12T15:10:00.207", "published_at": "2025-10-01T20:18:38.267", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "confidence": 35, "confidence_label": "observed", "affected": "< 7.0.12; >= 8.0.0, < 8.0.1", "fixed": "See vendor advisory", "source_count": 4, "kev": false, "attack_vector": "Network", "authentication": "None", "complexity": "Low", "cwe": "CWE-358", "what_happened": "Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 7.0.11 and below, as well as 8.0.0, are vulnerable to detection bypass when crafted traffic sends multiple SYN packets with different sequence numbers within the same flow tuple, which can cause Suricata to fail to pick up the TCP session. In IDS mode this can lead to a detection and logging bypass. In IPS mode this will lead to the flow getting blocked. This issue is fixed in versions 7.0.12 and 8.0.1.", "why_matters": "Review the vendor advisory and exposure of the affected product to determine operational impact.", "mitigations": [ "Apply vendor-provided updates or mitigations.", "Review affected product exposure and access logs." ], "pocs": [], "references": [ "https://forum.suricata.io/t/suricata-8-0-1-and-7-0-12-released/6018", "https://github.com/OISF/suricata/commit/be6315dba0d9101b11d16e9dacfe2822b3792f1b", "https://github.com/OISF/suricata/commit/e91b03c90385db15e21cf1a0e85b921bf92b039e", "https://github.com/OISF/suricata/security/advisories/GHSA-v8hv-6v7x-4c2r" ], "timeline": [ { "at": "2025-10-01T20:18:38.267", "label": "CVE record published by NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59147" } ] }, { "id": "CVE-2025-59144", "vendor": "debug-js", "product": "debug", "title": "debug vulnerability", "summary": "debug is a JavaScript debugging utility. On 8 September 2025, the npm publishing account for debug was taken over after a phishing attack. Version 4.4.2 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct